Ethical Impact Assessment
Deliberately examining who could be harmed by a system and how, at the point in design where the answer can still change the outcome.
Architectural decisions distribute consequences to people who are not in the room. The assessment is the mechanism by which that becomes a decision rather than a side effect.
The questions worth asking explicitly, early:
Who could be harmed by this working as intended? Not by a bug — by the system doing exactly what it was built to do. Ranking, matching, pricing and eligibility systems are where this concentrates.
Who could be harmed by misuse? Data collected for one purpose is used for another; an access mechanism built for support becomes a surveillance capability.
What does this system make possible that was not possible before? Capability tends to be used to its limit eventually, by someone other than the people who built it.
Whose data is this, and would they consider this use reasonable? Legal permission and reasonable expectation are different tests, and the second is the one that determines reputational consequence.
What happens to people the system classifies wrongly, and is there a route to appeal that a person without technical knowledge can use?
The architectural expressions of these answers: data minimisation — not collecting what is not needed is the strongest privacy control available; retention limits; access controls with audit; explainability where decisions affect people; and a human appeal path.
And the professional obligation that sits behind it: raising the concern, in writing, clearly, once — and recording it. The decision may not be yours; the record is.