Digital Duty of Care & Safety by Design Toolkit

Executive Overview

The Digital Duty of Care & Safety by Design Toolkit bridges the divide between statutory online safety mandates and software engineering practice. Translating Australia’s statutory Digital Duty of Care and the eSafety Commissioner’s Safety by Design (SbD) framework, this toolkit provides production software architectures, schemas, and CI/CD linters that enforce user protection as a fundamental compile-time invariant.

Rather than treating safety as an afterthought managed by retroactive customer support or post-incident PR, this toolkit establishes safety guardrails directly within pull requests, database schemas, and API ingress pipelines.

---

The Four Engineering Pillars

1. UI/UX Dark Pattern Auditing (audit/)

The toolkit introduces the UiSafetyEvaluator, an automated CI/CD linter that analyzes application interface configurations to eliminate manipulative design:

• Algorithmic Agency: Enforces “My Feed, My Way” compliance, requiring a prominent reverse-chronological toggle rather than forced engagement-maximizing recommendation feeds.
• Cognitive Safety: Flags infinite scrolls, addictive streak mechanics, and missing quiet hours defaults.
• Honest Affordances: Detects confirmshaming, asymmetric cancellation journeys (1-click unsubscribe parity), and artificial countdown timers.

import { UiSafetyEvaluator } from './audit/ui-safety-evaluator';

const report = UiSafetyEvaluator.evaluate({
  flowName: 'UserOnboardingAndFeed',
  targetAudience: 'general',
  isPrivateByDefault: true,
  locationSharingByDefault: false,
  quarantineStrangerDms: true,
  allowCrossSiteTrackingByDefault: false,
  hasReverseChronologicalToggle: true, // "My Feed, My Way" compliance
  infiniteScrollEnabled: false,
  hasAddictiveStreakMechanic: false,
  quietHoursEnabledByDefault: true,
  preCheckedConsentBoxes: false,
  usesConfirmshaming: false,
  registrationStepCount: 3,
  cancellationStepCount: 2,
  accountDeletionStepCount: 3,
  usesArtificialUrgencyTimers: false
});

console.log(`Passed: ${report.passed} (Score: ${report.score}%)`);

---

2. Statutory Incident Triage (triage/)

A production Prisma relational schema and service layer that formalizes incident intake, multi-tier classification, and strict statutory Service Level Agreements (SLAs):

• Mandatory Statutory Escalation: High-severity harms (child exploitation, violent threats, severe cyberbullying) trigger immediate law enforcement and regulatory reporting queues with sub-hour resolution SLAs.
• Auditable Chain of Custody: Every intake event, tier reassignment, and mitigation action is recorded with cryptographic timestamps and investigator signatures.

---

3. AI Safety & Content Moderation (guardrails/)

An extensible middleware layer for modern LLM and multimodal systems:

• Pre-Flight Prompt Guard: Intercepts indirect prompt injections, system jailbreaks, and adversarial input vectors before invoking model inference.
• PII & Telemetry Masking: Redacts residential coordinates, medical identifiers, and contact details client-side.
• C2PA Provenance Tracking: Integrates cryptographic manifest signing to distinguish human-authored captures from synthetic media.

---

4. STRIDE-H Abuse Threat Matrix (governance/)

Extending the classic security STRIDE model into STRIDE-H (Human Harms):

• Psychological Coercion: Analyzing algorithmic rabbit holes and dark nudges.
• Reputational Injury: Modeling targeted harassment swarms and non-consensual deepfakes.
• Physical Endangerment: Auditing unauthorized micro-geotagging and real-time location leaks.

---

Architectural Impact

By transforming policy into executable code, the Digital Duty of Care Toolkit proves that humane engineering, user dignity, and regulatory compliance are not frictions to be minimized—they are the architectural foundations of durable, trustworthy software.