Update patterns/1-initial/transparent-catalog-privacy-controls-posture.md

Co-authored-by: Amburi Roy <amburi.roy@gmail.com>

Author: shrutibist

patterns/1-initial/transparent-catalog-privacy-controls-posture.md

@@ -100,7 +100,7 @@ Different stakeholders benefit in different, specific ways:
 
 This solution introduces new, smaller problems that may need their own patterns: maintaining two repositories in parallel requires discipline to keep control IDs and posture entries mapped consistently; the trusted-committer group can itself become a bottleneck if the number of proposed controls or posture updates grows faster than review capacity; and access tiering on the posture register requires ongoing administration (who counts as a "privacy champion" or "team lead") as the organization's team structure changes.
 
-# Rationale
+## Rationale
 
 The pattern works by giving the two problems, lack of standardization and lack of visibility, separate solutions with separate risk profiles, rather than solving both with a single undifferentiated space. Standardization benefits from maximum openness where openness is low-risk: the wider the catalog is read and refined, the more consistent implementations become, and refinements to an existing control carry little risk because they come from engineers who have actually tried to implement it. Authorship of new controls stays centralized because that judgment, whether a new legal or regulatory obligation exists, is not something breadth of contribution improves; the catalog itself still carries little risk once merged, because it describes the *standard*, not any specific organization's current *gaps*. Visibility, by contrast, is only safe to distribute as widely as the sensitivity of the underlying data allows; a full account of "who is not compliant with what" is functionally a prioritized attack-surface map if it leaks or is over-shared. Applying InnerSource's usual mechanics (pull requests, versioning, trusted committers) to both repositories keeps the workload distributed and the record current in both cases, while applying access control asymmetrically preserves the safety of the more sensitive artifact without sacrificing the org-wide benefit of the less sensitive one.