Ethics
Advice changes what people notice, what they ignore, and what they decide to do. That gives the adviser obligations.
These are the commitments I make when Proper Tools accepts work. They apply whether the work is paid, public, or both.
They are not claims about personal virtue. They are standards against which my work can be examined, challenged, and corrected.
Giving advice also means remaining accountable for what the advice leaves out.
I do not offer certainty. I offer clearer trade-offs.
Truth and uncertainty
I distinguish what is known from what is inferred.
Where evidence is incomplete, contested, or unavailable, I say so. Where an answer depends on an assumption, I make the assumption visible.
- I explain the evidence and reasoning on which consequential advice depends.
- I name important assumptions, dependencies, and gaps.
- I do not manufacture certainty to make a recommendation easier to accept.
- I correct material errors visibly and without waiting for them to become convenient.
A confident answer is not necessarily a useful one. Sometimes the most important result is a clearer account of what remains unknown.
Agency and consequences
Advice should improve a decision.
I will give a clear view when I have one. I will also distinguish that view from the authority and responsibility of the people who must take the actual decision.
- I make material trade-offs and likely consequences visible.
- I do not use urgency, fear, or technical obscurity to compel an answer.
- I consider who may bear the consequences of a decision without being present in the room.
- I do not knowingly help create deceptive, coercive, or deliberately harmful outcomes.
Technology can usually be used in more than one way. Foreseeable misuse is part of the analysis, not somebody else’s problem to discover later.
Independence and confidentiality
Independent advice is useful only while the independence is real.
- I disclose relevant incentives, and conflicts of interest.
- I do not present a preferred supplier, product, policy, or answer as though it emerged neutrally from the evidence.
- I do not claim privileged access, institutional authority, influence, or certainty that I do not possess.
- I say when I am not the right adviser, or when the question requires expertise I do not have.
Information entrusted to Proper Tools is protected and used only for the purpose for which it was provided, except where disclosure is required by law or necessary to prevent serious harm.
I do not turn confidential client knowledge into public standing. Client names, details, and results are not used as evidence of capability without permission.
Public research, standards work, and paid advice can inform one another without becoming the same thing. Clients do not purchase privileged access to public processes, confidential drafts, or institutional influence.
Where a lesson from paid work may be useful publicly, it is generalised, anonymised, or shared with permission. Its origin and status should not be disguised.
Continuity without capture
A continuing advisory relationship should deepen the client’s own judgement, records, and capability.
Context built over time makes advice more useful. It should not become knowledge that only the adviser can navigate.
- I leave a usable account of important assumptions, reasoning, and decisions.
- I share context rather than hoarding it as a source of leverage.
- I do not create unnecessary work to preserve the relationship.
- I say when a question has become ordinary enough to return to the client’s usual channels.
Continuity is useful. Dependency is not.
The measure of a good relationship is not whether Proper Tools becomes indispensable. It is whether the people we serve are better able to understand their situation and act within it.
Correction and accountability
Advice is given at a particular time, with particular evidence, under particular constraints. Those conditions will change.
- I invite disagreement, correction, and evidence that does not fit my account.
- I do not treat criticism as insult or uncertainty as failure.
- I tell clients when new information changes a material conclusion.
- I keep corrections proportionate, findable, and attached to the work they correct.
Ethical commitments sometimes pull in different directions. Confidentiality may conflict with public interest. Speed may conflict with due care. Respect for agency may conflict with concern about foreseeable harm.
A list of principles cannot resolve those cases automatically. When commitments conflict, I will name the conflict and explain the choice I make.
If you believe I have fallen short of these commitments, say so. I would rather examine the problem than defend the appearance of consistency.
A related public text
The Hippocratic Oath of the Cybersecurity Practitioner develops some of these obligations in first-person form.
It is intended for practitioners to discuss, adapt, or adopt. It is offered under CC BY 4.0 as a tool, not a credential.