The idea
What is contextual integrity?
In 2004, the philosopher Helen Nissenbaum gave privacy a better definition. Privacy is not about hiding things. It is not a checkbox that says "I agree." Privacy is the appropriate flow of information. Every part of life has its own rules for how information should move. Your doctor knowing your diagnosis is fine. Your doctor selling it to an advertiser is a violation, even if a form said they could.
The theory names five parts of every information flow: who the information is about, who sends it, who receives it, what kind of information it is, and the rule the flow must follow. Break the rule of the context, and privacy is broken, no matter what anyone clicked.
The mapping
The five parameters are CIRIS wire fields
The CIRIS Constitution never uses the phrase contextual integrity. We found the match after the design was done. Every one of Nissenbaum's five parameters is a field the protocol signs and enforces.
1 · Data subject
subject_key_ids names the person a claim is about, inside the envelope itself. The subject can revoke at the wire level, not just the producer.
Constitution CC 2.3
2 · Sender
attesting_key_id is the producer's cryptographic identity. Every claim is signed, so every flow has a named source.
Constitution CC 2.1
3 · Recipient
Three separate axes, kept apart on purpose: cohort_scope says who can see, subject_key_ids says who can revoke, delivery_mode says who actively receives.
Constitution CC 2.3.3
4 · Information type
dimension is a namespace prefix that says exactly what is being claimed. A strict admission test keeps it objective and machine-checkable.
Constitution CC 3.1
5 · Transmission principle
consent:scope names the rule the flow must follow: retain, share, analyze, train, or publish, with limits like retain:90d and share:cohort:family.
Constitution CC 3.3.1
The hard part
The transmission principle, as bytes
The fifth parameter is the one everyone else drops. Laws and consent forms can say what data was collected. They rarely say the rule the flow must follow afterward. CIRIS makes that rule a signed, machine-readable value that the subject emits and can take back. consent:scope:train is a person saying yes or no to AI training, in the wire format, revocable at any time.
And revocation has teeth. A producer commits to a deletion window when they publish. If the subject revokes and the window passes without proof of deletion, the network itself raises a breach signal.
Beyond the checkbox
What flows like this can do
Context changes are not lies
withdraws takes a claim back because life changed. recants admits it was false when made. The protocol knows the difference, and trust math treats them differently.
Intimate contexts are invisible
Family-scoped data sends no directory advertisement. Outsiders cannot route to it, read it, or even learn that it exists. The strongest flow rule is one the network cannot express breaking.
Norms can evolve
Consent scopes are an open vocabulary. Communities add new flow rules without asking a platform for permission, and local policy decides what they mean.
The honest part
We arrived here from a different road
CIRIS was not designed to implement contextual integrity. It grew from a relational idea: a person is a person through other persons, so every claim must carry its relationships with it. Follow that rule long enough and you end up where Nissenbaum's theory points: privacy is appropriate flow, and the flow rules belong in the structure. Two roads, same place. Ours ships as a wire format.
Why it matters now
AI agents made this urgent
AI assistants read calendars, inboxes, and health records. The research field now measures whether they leak information across contexts, and the standard they measure against is contextual integrity. Most work tries to teach the model to be careful. CIRIS takes the other path: make the inappropriate flow impossible to express.
Sources
Helen Nissenbaum, Privacy as Contextual Integrity, Washington Law Review (2004)
Microsoft Research, Reducing Privacy Leaks in AI: Two Approaches to Contextual Integrity (2025)
Understanding Privacy Norms Around LLM-Based Chatbots: A Contextual Integrity Perspective (2025)
Read the machinery for yourself.