Sarus enables data practitioners to manipulate user-level information, define cohorts of interest, and take action upon them. The query-only interface guarantees that no user-level information can be extracted throughout this process.
But to take action upon data, it is sometimes necessary to extract lists of records. For instance, the data scientist may wish to identify patients with a certain health risk, list citizens that are eligible for social services, report suspicious activities or to define marketing campaigns. In this case, the data scientist does not need to know the names or ids, they just need to export those findings to a selected system (e.g.: internal reporting API, marketing tool).
Privacy policies can include exceptions to push selected outputs to endpoints trusted by the data owner. This way, data scientists are able to go all the way from building models to seeing it in action.