Make the decision path visible
When records from different systems appear to describe the same person, a confident-looking link can still be wrong. This guide shows how to separate evidence of identity from convenient similarity, detect false matches and give people a route to correction.
When records from different systems appear to describe the same person, a confident-looking link can still be wrong. This guide shows how to separate evidence of identity from convenient similarity, detect false matches and give people a route to correction. The aim is not to force certainty where the evidence is conditional. It is to show what can be used now, what needs further testing and what must remain visible to the next person.
The chapters move from first principles to a worked case, changed-context transfer, explicit limits, practical checks and an auditable decision. Start with the route closest to your task or read in sequence.
Choose the route closest to your decision
Chapter contents
Route 1: chapters 1–3
Route 2: chapters 4–6
Route 3: chapters 7–9
1. Define the linkage decision and unit
Begin with the decision that needs a link, not with the fields that happen to be available. A research join, duplicate check, benefit decision and historical reconstruction impose different error costs. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. What person, household, event or role is the unit, and what action will the link support? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. Two clinic records share a name and birth month. For aggregate research they may be reviewed as a candidate pair; for withholding treatment they require stronger evidence. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Transfer the unit test to kinship archives where one individual may legitimately appear under several household roles. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. A matching score does not define the social unit, and a stable identifier can still be attached to the wrong person. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Record purpose, unit, affected decisions, data owners, lawful basis, acceptable error and the person accountable for approving the link. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
2. Inventory identifiers and their provenance
List each name, date, address, household relationship, contact detail and system identifier with its source and collection context. Treat copied fields as dependent evidence. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. Can the team tell which fields were independently observed and which were propagated from an earlier record? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. A birth date appears in four databases, but all four inherited it from one intake form; the apparent agreement is one item of evidence, not four. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Apply the same provenance map when one system stores a transliterated name and another stores the original script. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. Repeated values are not independent corroboration, and official-looking fields may still be stale or mistyped. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Keep field lineage, collection date, transformation history, source reliability, access constraints and known data-quality warnings. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
3. Standardise without erasing meaningful difference
Normalise case, spacing, punctuation, dates and address formats while preserving the raw values. Document transliteration, tokenisation and nickname rules rather than silently rewriting them. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. Would the pair still look similar if every normalisation step were visible to a reviewer? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. The names Noor Aisyah bte Rahman and Aisyah Rahman become comparable only after the system records how honorifics, patronymics and token order were handled. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Transfer the method to married names, double surnames and characters that have several Romanisations. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. Aggressive standardisation can turn genuinely different people into the same string and can privilege one naming convention. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Retain raw fields, standardised fields, rule version, locale, exceptions and examples that test culturally varied names. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
| Checkpoint | What to test |
|---|---|
| Decision question | Would the pair still look similar if every normalisation step were visible to a reviewer? |
| Worked comparison | The names Noor Aisyah bte Rahman and Aisyah Rahman become comparable only after the system records how honorifics, patronymics and token order were handled. |
| Transfer test | Transfer the method to married names, double surnames and characters that have several Romanisations. |
| Known boundary | Aggressive standardisation can turn genuinely different people into the same string and can privilege one naming convention. |
4. Generate candidate pairs with bounded blocking
Blocking reduces comparisons by requiring agreement on selected features, but every block creates a route to false nonmatch. Use several defensible passes and measure who falls outside them. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. Which true pairs would be excluded by each blocking rule? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. A strict birth-date block misses a person whose day and month were transposed, so a second pass uses name, year and prior address with a tighter review threshold. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Transfer the design to archival records where age is approximate and place names change over time. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. Efficient blocking is not neutral if error patterns differ across languages, ages, migration histories or housing stability. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Record blocking passes, candidate counts, exclusion analysis, computational constraints and subgroup-specific miss rates. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
5. Score agreement and disagreement transparently
Weights should reflect how informative a field is among plausible candidates and how often it is wrong. Strong disagreement can matter as much as superficial agreement. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. Does the score explain why a pair is plausible, or only rank it above other pairs? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. A rare full-name agreement adds evidence, but a verified conflicting birth year and simultaneous activity in distant places outweigh it. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Transfer the scoring logic to household records where address agreement is common and therefore less distinctive. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. A high relative score may still be unsafe when every candidate is weak, and a global threshold may hide subgroup differences. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Keep comparison features, weights, training data, thresholds, calibration results, uncertainty and the reason each field was included. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
| Checkpoint | What to test |
|---|---|
| Decision question | Does the score explain why a pair is plausible, or only rank it above other pairs? |
| Worked comparison | A rare full-name agreement adds evidence, but a verified conflicting birth year and simultaneous activity in distant places outweigh it. |
| Transfer test | Transfer the scoring logic to household records where address agreement is common and therefore less distinctive. |
| Known boundary | A high relative score may still be unsafe when every candidate is weak, and a global threshold may hide subgroup differences. |
6. Work a false-match case
Build the case from raw records, candidate generation, field comparisons, independent evidence and consequences. Test the leading alternative before confirming identity. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. Would the link survive if the most common field were removed? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. Two people named Lim Wei Ming share a birth year and old postcode. Different middle-name characters, overlapping transactions and separate relatives reveal a false match before accounts are merged. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Change the context to an aggregate census table and decide whether unresolved pairs can be represented probabilistically rather than forced into one identity. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. The absence of an obvious contradiction is not proof of identity, especially for common names and shared addresses. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Save the candidate set, reviewer notes, disconfirming evidence, decision, affected systems and a reversible hold on downstream propagation. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
7. Find false nonmatches and changed attributes
A missed link can arise from name change, transliteration, data-entry error, unstable housing, incomplete records or a rule that overvalues exact agreement. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. Which people are systematically less likely to link because their attributes change or fit poorly into the form? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. A person appears under a birth name, married name and shortened work name. A documented relationship between the records is found through consistent history rather than string identity. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Transfer the test to displaced communities whose addresses and documents are episodic. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. Relaxing thresholds to recover more links can raise false matches, so evaluate both errors together. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Record unresolved cases, false-nonmatch samples, exception reasons, subgroup performance and any field design that creates recurring failures. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
8. Use clerical review and exception handling carefully
Send ambiguous cases to trained review when the consequence warrants it. Limit the reviewer to necessary information and use referral rules for conflicts or missing evidence. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. Can two reviewers apply the same criteria and explain their decision without seeing protected information they do not need? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. An automated link near the threshold is reviewed using a masked comparison sheet; a sensitive narrative is withheld because it adds little identity evidence. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Transfer the workflow to a small community where reviewers may know the people and conflicts of interest need management. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. Human review is not automatically fairer; fatigue, familiarity and cultural assumptions can reproduce error. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Keep instructions, training examples, inter-reviewer checks, referral outcomes, access logs and the evidence needed to appeal. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
| Checkpoint | What to test |
|---|---|
| Decision question | Can two reviewers apply the same criteria and explain their decision without seeing protected information they do not need? |
| Worked comparison | An automated link near the threshold is reviewed using a masked comparison sheet; a sensitive narrative is withheld because it adds little identity evidence. |
| Transfer test | Transfer the workflow to a small community where reviewers may know the people and conflicts of interest need management. |
| Known boundary | Human review is not automatically fairer; fatigue, familiarity and cultural assumptions can reproduce error. |
9. Handle one-to-many and household identities
Do not force one-to-one identity when systems describe roles, episodes or shared contact points. Model person, household, account and event separately. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. Is a duplicate truly the same person, or are several people legitimately using one phone, address or representative? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. A family shares a telephone number and correspondence address. The system links the household context while preserving separate personal identities. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Transfer the model to proxy respondents who answer for several members at different times. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. Deduplication can erase people when shared attributes are mistaken for unique identity. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Record entity types, relationship edges, temporal validity, household changes and rules against automatic person-level collapse. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
10. Contain downstream harm and propagate uncertainty
A link should carry provenance, confidence, purpose limits and correction status into every authorised consumer. High-impact action may require confirmation beyond the linkage. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. Can a downstream system distinguish confirmed identity, candidate link and unresolved conflict? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. A tentative research link is exported with a status flag; an eligibility system is prohibited from treating it as verified identity. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Transfer the safeguard to archived data releases by documenting linkage uncertainty and restricting re-identification. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. A numeric confidence score can be misread as a probability of truth or reused outside its calibrated population. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Keep consumer inventory, data contracts, decision gates, propagation logs, reversals and notifications when an error is corrected. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
| Checkpoint | What to test |
|---|---|
| Decision question | Can a downstream system distinguish confirmed identity, candidate link and unresolved conflict? |
| Worked comparison | A tentative research link is exported with a status flag; an eligibility system is prohibited from treating it as verified identity. |
| Transfer test | Transfer the safeguard to archived data releases by documenting linkage uncertainty and restricting re-identification. |
| Known boundary | A numeric confidence score can be misread as a probability of truth or reused outside its calibrated population. |
11. Answer the questions people ask
Explain why matching names are not enough, what a false match means, why an apparently missing record may be the same person, and how correction works. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. Can the explanation be understood by the person affected without revealing another person’s protected data? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. A person challenges a merged history. The organisation separates the records, annotates the cause and tells every authorised recipient that relied on the link. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Transfer the answer to researchers by distinguishing correction of the linkage from alteration of the source records. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. Do not require a person to prove a negative when the system created the uncertain match. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Publish plain-language criteria, challenge routes, response times, evidence requirements, privacy limits and escalation. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
Can one threshold settle every case?
No. A threshold belongs to a purpose, population, evidence base and consequence structure. Recheck it when any of those change.
Does more data always make the answer safer?
No. Repeated or poorly controlled data can reproduce the same blind spot and increase confidence without increasing validity.
When should an irreversible action pause?
Pause when a plausible unresolved condition could change the action and targeted evidence or a reversible alternative is proportionate to the risk.
What makes the process auditable?
Another person must be able to find the inputs, transformations, assumptions, alternatives, authority, decision and residual uncertainty without relying on memory.
12. Audit linkage quality and redesign the system
Monitor link rates, false-match and false-nonmatch evidence, clerical errors, subgroup differences and downstream reversals. Feed recurring causes into forms and data standards. In proxy records that stand in for people across surveys, services, archives and administrative systems, the practical claim is whether two or more records can safely be treated as referring to the same person for a stated purpose. The chapter therefore begins with the decision boundary: what the evidence must support, what it may suggest and what it cannot safely establish.
First-principles check. Could an independent reviewer reproduce the linkage and identify every decision that relied on it? Name the object being compared, the mechanism that could create error and the consequence of a wrong answer. Make the time window, population, method and authority explicit before accepting a score, label or workflow result.
Worked practice. An audit finds address standardisation merging separate hostel units. The parser is fixed, affected links are reopened and downstream decisions are reassessed. The important sequence is visible: observations come first, alternative explanations are tested, the bounded inference is stated and the action follows. This prevents the conclusion from becoming stronger merely because it is convenient.
Changed-context transfer. Transfer the audit to a new dataset by recalibrating instead of assuming yesterday’s threshold still works. Carry over the reasoning steps, not the old threshold. Replace the local data, controls, costs and consequences, then ask whether the same conclusion still holds. A copied answer is not transfer if a hidden assumption changed.
Limit and misconception. Stable overall accuracy can conceal severe errors for a small group or a high-consequence use. The recurring danger is that an uncertain linkage becomes an invisible fact that follows a person into later decisions. A careful analysis marks the boundary and keeps competing explanations available until evidence genuinely excludes them.
Evidence record. Keep code and rule versions, test data, error estimates, corrective actions, unresolved risks and verified reading routes. Add source, date, operator or analyst, method and software version, exclusions and uncertainty. Preserve earlier states and link raw observations to derived decisions so that a later reviewer can challenge one step without losing the chain.
Decision-quality drill. Write one sentence naming the action supported now and one naming the strongest unsupported claim. Then change one plausible condition—threshold, method, missing record or stakeholder cost. If the action reverses, label the decision sensitive and set a review trigger.
Continue through verified routes
Return to the core Gold Standard framework or continue into the specialist routes that directly extend this decision. The external sources below define or test the concepts used here.
Core routes
Authoritative sources
- U.S. Census Bureau Statistical Quality Standard C4: Linking Data Records
- U.S. Census Bureau coverage-measurement definitions for matching errors
- NIST SP 800-63A: Identity Proofing and Enrollment
- U.S. Census Bureau: Estimating Record Linkage False Match Rate
Guidance, methods and datasets can change. Recheck the linked source, local evidence and decision context before carrying the conclusion into a new case.