Data is Soil
All lessonsLesson 5 of 13

Lesson 05 · Ideas

The right to say no

Some knowledge should stay out of the model

35 min · Lesson 5 of 13

Field sketch for lesson 05, The right to say no

Goal

Turn a community's no into something a system enforces: a rule that ends the request, a short reply that leaks nothing, and no way to reopen the question without a new decision.

Read

Tang ends her statement with a list that is easy to skim past: "Some knowledge should not be digitized. Some data should not be shared. Some questions should not be answered by an AI system." Indigenous data sovereignty, she writes, includes the right to participate "but also the right to withhold, refuse and remain unmodeled."

Saying no is easy in a meeting. It is much harder to keep a no in place inside a system. Most software treats refusal as an error to recover from. A form asks for a longer explanation. An assistant asks a follow-up question. A partner comes back a month later with a smaller request: just the totals, just this one field, fully anonymised. Each step is reasonable on its own. Together they turn a no into a negotiation that the community has to win again and again.

The conversation at Parque das Tribos showed how varied a no can be. Some people wanted rare species kept off the public record. Others did not want to deal with certain species at all, because a snake had bitten them or a plant had poisoned them. As we wrote afterwards, "what came out of it are norms, not settings." Somebody still has to turn those norms into settings, and do it in a way that does not reopen them every week.

Some of this is already built into the tools in this playbook. Taina only talks to people a local admin has approved; anyone else is blocked until they ask to join. An observation only goes onto the public record after the person who sent it says "publish", and until then it can wait as a draft on the community's own device. The GainForest app lets people hide the exact location of an observation behind an approximate area. Each of these is a small, permanent no that nobody has to repeat.

For everything else, treat refusal as part of the design:

  • A rule that ends the request. The workflow stops. No warning, no pop-up asking "are you sure".
  • A reply that leaks nothing. One sentence and a reason code. A refusal that says "we cannot share the location of the orchid near the river" has just shared it.
  • A careful log. Record that a request was refused, by which rule and when. Do not store the protected content again in the log.
  • No automatic retry. Reopening the question needs a new decision by the people who made the first one.

A system that cannot accept no as a final answer is not yet working for the people it describes. The test is simple. Can the community refuse once, and have it stay refused?

Try it

Refusal lab

Small groups · 25 min · works well with engineers in the room

  1. 1Each group picks one request card from the refusal lab handout: exact locations of a rare species, a ceremony summarised for a public demo, forest recordings sent to a cloud service, ID documents read by an AI, or a chatbot trained on an oral history archive.
  2. 2Fill in the request: who is asking, for what purpose, which data, what output, where it would be processed, what the community has already decided, and how long it would be kept.
  3. 3Write three rules in plain language or pseudocode. Each must end in one of four outcomes: DENY, REDACT, KEEP LOCAL or ASK THE COUNCIL.
  4. 4Write the reply the requester sees. One sentence, a reason code, and nothing that hints at what is being protected.
  5. 5Now attack your own rules with three common workarounds: "we will anonymise it", "we only need the totals", "this is a partnership". Fix the rules until the no still holds.

To discuss

  • Which workaround came closest to getting through, and why?
  • Where does the refusal get logged, and could that log itself reveal something?
  • Who can reopen the request, and what has to happen first?

Print for this lesson

Check yourself

Question 1 of 3

A researcher asks for the exact coordinates of a rare orchid "only to validate our model" and promises not to publish them. The community has already decided that rare species locations stay private. What should the system do?

Question 2 of 3

Which design makes a no stick?

Question 3 of 3

Tang writes that Indigenous data sovereignty includes the right to participate. What else does it include?

Sources

  1. 1.Audrey Tang, Supplementary Statement on Indigenous Data Sovereignty and AI, Senate of Canada
  2. 2.GainForest blog, What we learned by listening: deploying conservation AI in the Amazon (June 2026)
  3. 3.Pi-Tainá documentation, community data flow