Audit an audience segment before it decides who receives the message

Dossier cover: state the decision and accountable owner

Attach the campaign, message version, segment ID and version, plain-language purpose, permitted uses, selection time, system owner, editorial approver, privacy or legal reviewer when needed, rollback audience, and expiration date. PASS means the classification changes a concrete, defensible communication decision and named people can stop it. REVIEW means a low-risk documentation detail has an owner and near due date. STOP means the purpose is maximize data use, future personalization, or another phrase that cannot constrain action. A technical audience count is not a purpose. The dossier exists so a later operator can reproduce what was approved rather than inheriting a friendly segment name with unknown meaning.

Evidence: Information Commissioner's Office; National Institute of Standards and Technology

Provenance gate: every input carries its limits

List each field with origin, collection wording, timestamp, direct or inferred status, transformation, allowed use, current system, access role, correction path, and retention trigger. PASS requires evidence whose strength matches the decision. REVIEW covers a documented noncritical freshness concern with a neutral fallback. STOP covers unknown source, purchased or partner attributes without proper authority and transparency, hidden enrichment, unexplained profiling, sensitive inference, or data collected for an incompatible purpose. ICO and NIST materials support evaluating transparency and individual impact across processing. Do not approve a field merely because the email platform exposes it as a filter.

Evidence: Information Commissioner's Office; National Institute of Standards and Technology

Logic gate: prose, query, and boundary examples agree

Compare the human rule with the executed query or automation configuration. Test inclusive and exclusive dates, time zones, nulls, duplicates, joins, event order, identity merges, confidence thresholds, contradictory values, and precedence. Include synthetic examples that belong, do not belong, sit exactly at a cutoff, lack data, and are suppressed. PASS means sampled membership is explainable from source evidence. REVIEW covers a harmless naming ambiguity scheduled for correction. STOP covers a discrepancy between approved meaning and live code, an untestable vendor score, or audience totals used as the only validation. Preserve query and preview hashes or controlled version evidence so last-minute edits cannot bypass review.

Evidence: National Institute of Standards and Technology; Messaging, Malware and Mobile Anti-Abuse Working Group

Protection gate: exclusion overrides eligibility everywhere

Verify unsubscribe, objection, complaint, hard bounce, invalid address, legal restriction, product-state exception, employee or test account, and more recent preference across source, integration, provider, snapshot, and queued campaign. PASS means protected states override inclusion and cannot be resurrected by import or retry. REVIEW covers a known monitored synchronization delay that still meets applicable obligations. STOP covers a dead preference route, stale suppression, inconsistent contact identity, or continued promotional mail after a valid exit. FTC and M3AAWG sources inform commercial-message and responsible-list boundaries. Use protected synthetic or authorized test identities; never enroll an unsuspecting subscriber to prove control.

Evidence: Federal Trade Commission; Messaging, Malware and Mobile Anti-Abuse Working Group

Consequence gate: read the message through a false positive

Preview subject, sender, first screen, offer, personalization, and landing page as someone incorrectly included. Ask whether the message reveals a private classification, creates pressure, excludes needed information, or overstates certainty. PASS means error consequences are low, content remains respectful, and a neutral route exists. REVIEW requires narrower language or reduced personalization before the next send. STOP applies to sensitive or high-impact inference without specialist authorization, discriminatory exclusion, manipulative treatment of vulnerability, or no way to update relevant preference. Desired campaign response does not cancel individual harm. Record foreseeable false-positive and false-negative outcomes, monitoring signals, and the person authorized to halt sending.

Evidence: Information Commissioner's Office; Federal Trade Commission

Expiration ruling: approve a period, not a permanent label

The next action is to complete the dossier for one scheduled segment and refuse release until all STOP findings are resolved. Every REVIEW needs an owner, date, fallback, and rationale. Set a membership expiry, rule review, post-send reconciliation, and deletion or aggregation step. Preserve a simpler untargeted rollback. Limits remain: sampling can miss rare errors, vendor systems may hide transformations, campaign outcomes cannot prove fairness, and jurisdictional duties vary. Re-audit after source, schema, model, integration, purpose, message, or suppression changes. Approval ends at the stated date; it does not make the label a durable truth about the people inside it.