The Whistleblower's Promise

In practice

Start with the maxim, stated honestly: "break a confidentiality promise when keeping it conceals serious danger to others." Universalize. A world where confidentiality yields to serious-danger disclosure does not destroy promising — contracts survive; narrow, principled exceptions are part of what makes signatures worth trusting. No contradiction; and could everyone will it? A rational signer, who is also a rational customer, can. The maxim passes where the lying promise failed — note the difference: that maxim, universalized, ate promising whole; this one carves an exception the practice itself can endorse. Now the humanity formulation. Keeping silent treats the endangered customers merely as means — their injuries absorbed, without consent, as the price of the firm's convenience. Disclosure treats the firm as what it is: a consenting party that never bought the right to other people's bodies. Both formulations point the same way. The conflicting-rules objection asks its question — keep promises, protect the innocent — and the near-absolute lesson answers it: the confidentiality rule's own rationale, trust, cannot demand concealing harms, so the exception comes from inside the rule. Last, the utility audit: list the affected — customers, firm, engineer, future signers — and the sums favor disclosure on any honest estimate. The verdicts converge. Where the transplant case split the theories, this one gathers them — and convergence is itself evidence: when maxim, humanity, and sums agree, the engineer is not choosing between moralities, only between courage and its absence.