The Security Ladder: Five Tiers, Derived — Never Stored

The usual privacy control is a per-item toggle you set once and forget, and then can't trust, because the item moved and the toggle didn't. Timeline OS asks a different question first. Where does this thing actually live, and who can reach that place?

Five answers exist in my setup, and they form a ladder.

An item's tier is derived from its source every time it renders, never stored. That is the decision that makes the ladder trustworthy. A tax document on my local disk shows tier 1. When its folder gets archived to the NAS, it becomes reachable from more places, so the next render says tier 2. There is no stale label to forget, because there is no label. The tier is a fact about location, recomputed on sight.

The public timeline surface, the only thing a visitor could ever see, doesn't query my private index at all. It reads a physically separate, hand-curated public dataset, holding only things I explicitly shared with named people or explicitly published. Publishing is an act of promotion. A deliberate, hand-made commit moves something up the ladder into that dataset. Tiers 1 through 3 never reach a visitor, not because a filter hides them, but because nothing ever puts them there.

The ladder measures accessibility, not sensitivity. A medical record doesn't get less sensitive when a folder migration makes it more reachable. The ladder just reports the reachability. Whether some item classes deserve a pinned sensitivity floor, a rule like "warn me if this ever climbs the ladder", is an open question I'm sitting with rather than pretending to have solved.

Part of an ongoing series on Timeline OS, a personal operating system for the stream of data that defines a life. See also: Three Ways Back to Your Own Life, PARA Meets Chronology, and Private by Default, Public by Choice.