The security design tradition descends from military information classification. Its question is: how do we protect assets from unauthorized access? Assets have classifications. Access has clearances. The model works when the thing being protected is a document in a vault.
Allen reframes the question. The thing being protected is not an asset — it is a person. People are not classified; they are “uniquely due respect and dignity.” This reframing changes what counts as a security failure. In the asset model, failure is unauthorized access. In the dignity model, failure includes violation of autonomy, violation of privacy, and denial of informed consent — even when access was technically “authorized” by the system’s rules.
The reframing has architectural consequences. A system designed to protect assets minimizes exposure — least privilege, least access, least everything. A system designed to protect dignity must also ensure agency — the person must have the information and authority to make meaningful choices about their own data. This is why the necessary pattern family matters: least access without necessary access produces a system that minimizes data exposure while denying the person the ability to understand what is being asked of them and why.
The dignity frame also explains why architectural coercion resistance matters. If the system protects assets, coercion is someone else’s problem — the vault is secure, what happens outside is policy. If the system protects people, coercion resistance is a design requirement. A datastore that refuses improper requests is protecting the person, not just the data.
This is not a philosophical nicety layered on top of engineering. It is a design constraint that produces different architectures. Systems designed for dignity build in consent mechanisms, progressive disclosure, bilateral negotiation, and exit rights. Systems designed for asset protection build in walls, gates, and guards. The same data, the same threat model, different architectures — because the thing being protected is different.