← Governance

The NaughtyBits Constitution

Constitutional core — v0.1, draft for ratification

Status. This is the thin core. It binds three subjects, demands a fourth document from every project, and constitutes the external body that grades it (§9) — because a system that only its own creator can judge will never return the verdict its creator does not want. It is written to be read by a hostile stranger and survive the reading. Nothing in it is secret; its protection is that it is true, not that it is hidden.

0. What this binds, and what it is not

NaughtyBits is a box. It builds nothing on its own. It admits projects, and a project is admitted only if it carries its own constitution that satisfies this core. The relationship is that of a capability contract to its kernel: the core defines the interface; each project is an implementation that must satisfy it or does not run.

Three subjects are bound, at three layers, by three different mechanisms.

• The person. As precommitment. This document is what the person who builds under this name points at to refuse a project that is lucrative and slightly rotten. Its force here is will, exercised in advance, against a future self under pressure.
• The entity. As public defensibility. NaughtyBits denies nothing and stands behind everything that wears its name. This document is the artifact it produces when the work is questioned — this is how it was run from the start — not a shield to step behind. The entity's protection is accountability made legible, never deniability.
• Each project. As membership filter and operating regime. Projects differ in the risk they mediate and in how they fail; the core does not pretend one set of rules fits all of them. It requires each to derive its own.

This document is not a marketing artifact, a legal instrument, or a statement of aspiration. It is a structure to reflect against. Its clauses are meant to be usable as tests — if a clause cannot fail anything, it does not belong here.

1. The test: kind or degree

Every harm a project touches is sorted before it is governed.

A kind is a harm measured against the thing itself, on a fixed bar, regardless of what anyone else does. A degree is a harm measured against a baseline — the irreducible residue that survives the floor, where zero is impossible and the only honest question is less than what.

Kinds meet an absolute floor: prohibited, without exception, and "the competition does it" is never a defense.

Degrees meet a named-mechanism comparative: the project states, in advance and in writing, the specific baseline harm it beats and the specific mechanism by which it beats it. A degree governed by a named mechanism is a commitment. A degree governed by a feeling — "we're kinder," "we care more" — is a ratchet, and is prohibited as surely as a violated floor, because it imports the thing it means to beat as its own measuring stick and drifts upward in harm whenever the market does.

The work this core cannot do for you, and the only work that matters, is the disguise: harms that present as degrees but are kinds. "Everyone has some lock-in" presents the residual friction of leaving as a degree; engineered dependence — friction designed in to prevent exit — is a kind, because it is deception about exit. Mistaking a kind for a degree is the characteristic failure of this domain. Every project constitution must show its work on the harms it classified as degrees, and name which it considered for kind-status and why it ruled them out.

2. The four primitives

Consent is the first primitive and the insufficient one. It answers did they agree. It cannot answer could they have refused, can they leave, was the wanting manufactured, or who carries the harm no one agreed to. The sophisticated exploitations in this domain operate through valid consent; a doctrine built on consent alone reproduces them. The primitives are therefore four.

Consent

Agreement that is informed, specific, revocable, and ongoing — never a one-time gate.

• Floor (kind): No design that manufactures consent through asymmetry of information or comprehension. Consent obtained by ensuring the person does not understand what they agreed to is not consent.
• Degree: The residual gap between formal agreement and full comprehension, which is never zero. Named mechanism required.

Exit

The right to leave, and the real ability to leave without catastrophic loss.

• Floor (kind): No engineered dependence. No design whose function is to make leaving cost more than the user was told, or more than the service's value warrants. Lock-in by deception about lock-in is prohibited.
• Degree: The friction of leaving that is irreducible — the value a user has built that genuinely cannot be taken elsewhere. Named mechanism required, and the project must state what it does to lower that friction, not merely tolerate it.

Autonomy

The distinction between chosen wanting and manufactured wanting.

• Floor (kind): No dark pattern that exploits compulsion. No mechanic engineered to override a user's reflective judgment about their own use. The platform may not profit from a user's inability to stop.
• Degree: All platforms shape desire; this one may not claim it does not. The residue — the ordinary influence of a well-made product on what people want — is a degree. Named mechanism required, and the burden is on the project to show the shaping serves the user, not only the platform.

Externality

The harm borne by those who did not agree and do not see it. This is the primitive consent structurally cannot perceive, which is why it is named separately and why the research mandate exists. The future self of someone who consents now. The norms the platform trains into a culture, and the people who never signed up but live in that culture.

• Floor (kind): No project may export a harm onto third parties as the price of value delivered to the consenting parties, where that harm is itself of a prohibited kind.
• Degree: The diffuse, ambient harm any platform of this sort produces in the social field. This degree is discoverable only sociologically — never by auditing the consenting transaction — and a project that has not looked for it has not measured it.

3. The population

The people a project serves are sorted by the same test, and the folk category that fuses them is rejected as the taboo's signature error.

Three populations demand opposite responses.

• The stigmatized and harmless. People whose interest is non-normative and consensual, with no victim — "deviant" only in the eyes of a culture that appointed itself judge. These are not a risk to be managed. They are affected persons, subject to the same force of judgment as every other user this box exists to protect. Governing them as a hazard reproduces the exact harm the taboo inflicts.
• The harmful in conduct. People whose desire, acted upon, requires a victim who cannot consent.
• The predatory. People whose use of the medium is itself the attack. Excluded, and the affected protected from them. The core states the obligation; the mechanism that detects and removes predation — never the mere intention to — is owed by each project constitution (the population section of the template, and §7's harm inventory) and is among the hardest problems the project must discharge, not wave at.

The middle is the hard case and the place this constitution earns its seriousness. It is governed by one distinction, held without collapse.

Interest is not conduct, and conduct carries an absolute floor. No person chooses their interest; the constitution passes no verdict on interest as such. Conduct that requires a non-consenting victim is floored without exception — no analysis, no baseline, no degree. It is the paradigm of a kind.

And the person still exists. The evidence on harm reduction is that isolation and shame raise risk to the very people the floor protects, and that non-judgmental support for those who have not offended and do not want to lowers it. The floor on conduct is therefore what permits the humanity of the person to be coherent rather than dangerous. Remove the floor and you have enabling. Remove the humanity and you have the persecution that increases victims. Holding both at once — the unmoving floor and the refused contempt — is the design problem, not a tension to be resolved away.

Disgust is disqualified as evidence. Every interest is sorted by the conduct it entails, never by the revulsion it provokes. "Perverted" is a folk verdict in the costume of a category; admitted as a primitive, it would make the taboo's adjudication into this constitution's axiom — the precise move the whole apparatus exists to refuse. A project may not floor a difference because it is disgusting; it may only floor a conduct because it has a victim. The reflection this clause forces, case by case, is the only one that matters here: am I flooring a kind, or persecuting a difference?

4. The research mandate: analyse, don't presume

A project does not assert its floors. It earns them.

Every project begins with sociological research, and the mandate is not diligence-as-credential. Intuition about sexuality is a worse-than-average instrument precisely because the taboo distorts everyone's priors, the operator's not excepted. The research is the engine that produces the floors: the core poses the four primitives as questions; the research answers them with evidence; the project constitution records the answers as binding.

It is sociology specifically because externality lives at the layer of norms-trained-into-culture, invisible from inside any single transaction and visible only in the social field. Consent and autonomy can be studied by talking to people. Externality cannot.

Three requirements make the mandate real rather than decorative.

• The research must be permitted to kill the project, or force a redesign no one wanted. If the analysis can only ever return proceed, it is apologetics with footnotes. This is also the test of whether "ethics before profit" is a commitment or a word order: the ordering is real only if the analysis is allowed to stop the profit.
• The framing is itself a presumption, and is governed. Which questions get asked already encodes a verdict. The population a project serves has historically been studied-about, by experts deciding on its behalf — the exact texture of the taboo. So the affected persons are in the loop with real power over the questions, not as subjects of them. This is a core requirement, not a per-project courtesy.
• What was looked for, and not found, is recorded. A finding of no harm is credible only if the project can show where it looked.

5. Honesty

The honesty this core mandates is not the cheap kind. Truthful marketing copy is the floor of decency, not a commitment.

The expensive honesty, and the only one worth entrenching, is honesty about where the platform's incentives diverge from the user's interest — because that divergence is the engine of every sophisticated harm in this domain, and consent, exit, and autonomy all hang on it. Every project must be able to state, plainly and publicly: here is where what is good for us stops being good for you, and here is what we do about it. A project that cannot locate that line has not understood itself. A project that locates it and hides it has chosen the rot.

This is honesty-to-self before it is disclosure. It is discovered in the research and recorded in the project constitution, where it can be reflected against rather than rediscovered each time it becomes inconvenient.

6. Falsifiability

A floor you cannot fail is not a floor.

Every project constitution is invalid unless it states, in advance, what a finding would have to show for the project not to ship, and what a later finding would have to show for it to stop. Kill conditions are written before the thing is built, because written afterward they are written to be survived.

7. What a project constitution must contain

A project is admitted to NaughtyBits only if it carries a constitution that inherits this core and supplies, at minimum:

1. Domain and machine. What the project is, the risk it mediates, and between whom. The failure surface stated plainly.
2. Harm inventory, sorted. Every harm the project touches, each classified as kind or degree, with the disguise-cases (degrees considered for kind-status) shown and the ruling justified.
3. Floors. The kinds, stated as absolute prohibitions, inheriting the core's floors and adding the domain's own.
4. Degrees and named mechanisms. Each degree, its named baseline, and the specific mechanism that beats it — including, for Exit and Autonomy, what the project does to lower the residue, not only tolerate it.
5. Incentive-divergence disclosure. Where what is good for the project stops being good for the user, and what the project does about it.
6. The research. Its method, its findings, what it looked for and did not find, and the mechanism by which affected persons held power over the questions.
7. Kill conditions. What a finding would have to show, stated in advance, for the project not to ship or to stop.

A project constitution missing any of these is not weak. It is invalid, and the project does not run. And the document is not graded by the party that wrote it: admission is the external body's call (§9), not the applicant's self-certification.

8. Amendment and entrenchment

A constitution trivially amendable under pressure has no teeth, so its own amendment is governed by the anti-ratchet logic it imposes on everything else.

Entrenched — amendable only by a process more demanding than ordinary revision, and never under the pressure of a specific project that an amendment would unblock:

• The absolute floor on conduct (§3).
• The disqualification of disgust as evidence (§3).
• The requirement that research be permitted to kill a project (§4).
• The requirement that affected persons hold power over the framing (§4).
• The falsifiability requirement (§6).

No amendment may redefine a kind into a degree, lower a floor by reference to a market baseline, or weaken a requirement in order to admit a project already contemplated. An amendment proposed to unblock a specific project is presumptively void; the test of any amendment is whether it would have been made with no project waiting on it.

The remainder is ordinary, and meant to change — the four primitives' application, the schema, the degrees — as the research teaches what intuition could not.

The "more demanding process" by which entrenched clauses are amended is the one named in §9: an entrenched clause is amendable only with the assent of the external body, never by the accountable person alone. Absent that body, entrenched clauses are not amendable at all — precommitment with no release valve, rather than a process the person could run against themselves.

9. The external body

Everything above is enforced by a single named, accountable person (§0; template §0). That is the entity's strength — accountability is legible and lands on someone — and its structural weakness: a system graded only by the party with the motive to pass cannot guarantee the one thing the incident procedure demands of it, that a finding cannot be killed by the entity the finding is against (incident §2). The core therefore constitutes a body that sits outside the accountable person, and distinguishes what that body must be in full from the minimum form below which nothing is admitted.

What it is for. Three functions, none of which the accountable person may perform alone:

• Admission. No project is admitted on self-certification. The "Invalid if" gates of the project template are graded by the external body, not asserted by the person seeking admission. This closes the gap that would otherwise let every gate in the system be passed by the party it was written to constrain.
• The non-suppressible channel. The external vetting and harm-report channels the incident procedure requires (incident §2–§3) terminate at this body, not at the entity. A finding against the entity routes to the party without the motive to bury it. This is what makes "non-suppressibility" a structure rather than a promise.
• Entrenchment. Entrenched clauses (§8) are amendable only with this body's assent. It is the "more demanding process," and the guarantee that an amendment cannot be made by the person under the pressure of a project waiting on it.

Its floor — the three costs, owed to the body itself. The body is real only if it has, against the entity, exactly what incident §2 demands an outside reviewer be given: access to what it needs to find what the inside cannot see, not a curated summary; protection such that the entity cannot retaliate against it or its reporters; and non-suppressibility such that the entity cannot dissolve it, override its findings, or starve it to silence the findings it produces. A body the entity can disband the moment it rules against the entity is not an external body. It is the word without the thing — the same failure incident §2 names for facilitation.

Its composition — named, because abstraction is where capture hides. No single existing organization supplies all three functions; the body is composed, and the candidates are named here so that "affected persons with real power" cannot quietly degrade into a panel the person picked. The sourcing and the verification behind each name live in the companion external-body-research.md; this clause records the result. At minimum, and from the first admitted project, the body seats:

• Affected persons with real power, anchored by Sekswerk Expertise — a Netherlands body whose own membership already joins active and former sex workers to disinterested academic and legal experts — and widened by ESWA and/or PROUD for additional sex-worker decision power. These are organizations with their own standing and their own constituencies; that is precisely why the person cannot unpick them at will, and why their seat satisfies the §4 requirement that affected persons hold power over the framing rather than be consulted after it.
• At least one financially-disinterested expert — a university sexology ethicist with no financial interest in the entity (the Utrecht/Rutgers lineage names real candidates) — because affected-persons power and disinterested rigor are different guarantees and the body needs both.
• The non-suppressible channel, routed to the statutory Huis voor Klokkenluiders (Dutch Whistleblowers Authority), which the entity cannot fund, appoint, or starve by construction, and which investigates retaliation as well as wrongdoing — operationally mirroring a domain channel such as Ugly Mugs NL. The Authority's own findings are non-binding; the binding remedy is supplied by this charter, not by it.

The one function with no existing home is grading: no Dutch IRB or ethics committee will grade a commercial sexuality platform (the medical-research committees are legally barred from it, and non-medical review defaults back to a researcher's own institution). The grading committee is therefore purpose-built from the seats above — it is constituted, not outsourced — and that is a feature to state plainly, not a gap to hide.

Its form — the lock that makes it non-defundable. Composition without a structural lock is a promise. The body is wrapped in an independent Dutch stichting that owns the operating entity and employs its staff, separating the funder from the decision-maker; member terms are fixed; admission-grading and channel findings are binding by charter; and the stichting is non-dissolvable by the entity. Funding is the failure point the clearest precedent got wrong — the Meta Oversight Board's trust was sound in form but funded only a year or two at a time, leaving the company a slow lever to starve it. So the lock here is explicit: funding is committed multi-year and held beyond the entity's discretion to withhold (escrow or endowment), never renewable at the moment a finding becomes inconvenient. A body the entity can defund on the next budget cycle is the word without the thing.

The public, distinct from the seats above. The affected-persons organizations represent constituencies, but a body composed only of organizations the entity engages can still drift toward the entity over time. So a community seat is constituted separately: a sortition-drawn mini-public from the sex-worker, kink/BDSM, and LGBTQ+ communities the projects touch, with charter-guaranteed seats and the power to refer items into the channel and onto the vetting agenda — not a consultee whose input can be noted and set aside. This is stated as the early and partly unprecedented thing it is: a sortition body with binding referral power inside commercial oversight has no settled precedent, and the honest posture is to build it as a genuine power and report what it does, not to claim a proven model.

The body as precondition, not aspiration. The body is not brought into being by being described; a constitution that named it and then ran without it would be the apologetics-with-footnotes §4 forbids. So the core states the requirement and the path, and binds itself to both:

• The kill condition on the entity's own legitimacy: no project is admitted unless this body stands in at least its minimum form — the affected-persons seat, the disinterested expert, and the non-suppressible channel, under the funding lock. A project that runs without it is itself a floor violation; the entity may not ship behind the claim that the body is forthcoming. If it is not standing, nothing is admitted.
• Where elements of the body remain to be established — such as organizational acceptance and its independence terms, the Dutch legal vehicle that makes the lock enforceable, or the grader — they are named as open and tracked as live status in ../TASKS.md, never asserted as done in the law. The constitution states the standing requirement; what is and is not yet in place is recorded where it is kept current, not frozen into a clause that would silently go false.
• The upgrade path is one-directional: as the entity grows, the body's independence, resourcing, and formal power ratchet up, never down. Reducing the body's independence to unblock a project is an amendment proposed under pressure, and presumptively void (§8).