Fix up inconsistencies in the confidentiality of FOs and Council Reports

[frivoal]

See #717

---

💥 Error: 400 Bad Request 💥

PR Preview failed to build. (Last tried on Mar 22, 2023, 3:15 PM UTC).

More

PR Preview relies on a number of web services to run. There seems to be an issue with the following one:

🚨 CSS Spec Preprocessor - CSS Spec Preprocessor is the web service used to build Bikeshed specs.

🔗 Related URL

Error running preprocessor, returned code: 2.
FATAL ERROR: LINE 26: The document's metadata block should be the first thing in the document. Please move this block to the top.
 ✘  Did not generate, due to fatal errors

If you don't have enough information above to solve the error by yourself (or to understand to which web service the error is related to, if any), please file an issue.

[dwsinger]

Isn't there a problem here that the report might cite material that is confidential, and then the report cannot be less confidential than the material it cites/includes?

[nigelmegitt]

This concept of more confidential or less confidential being on a linear scale only works if some assumptions are true. I think of it as a venn diagram where each circle is a group of people who have access. If one circle is inside another, more vs less works, but if they only partially intersect, or don't intersect at all, it doesn't work.

For example, if the Team can see Team confidential stuff, and some of the Council can see AB-confidential stuff, and some TAG-confidential stuff, then the circles are unlikely to nest nicely. It also depends on which of those groups have visibility of the FO.

[frivoal]

@dwsinger: yes, but depending on what needs saying, a report might not need to cite such confidential material, and in such cases, could be more public.

@nigelmegitt I was working off the team-only / member-visible / public confidenciality scale, which is indeed nesting. But there might be edge (or not so edge) cases where that isn't quite as neat, and I don't think it's that essential, so maybe "same level" is simpler.

[nigelmegitt]

There's also the ambiguity that "more confidential" could mean "less visible to the same people" (e.g. redacted) or "visible to fewer people"