OPINION
Bob Pemberton, JusticeThis appeal concerns whether the common-law right to withhold “public information” from disclosure under the Public Information Act (PIA) when disclosure “would create a substantial threat of physical harm,” first recognized by the Texas Supreme Court in its Cox Texas Newspapers decision,1 shields the identity of a supplier of the lethal-injection drugs Texas uses in executions. At least on this record, we conclude it does not.
BACKGROUND
In the course of their legal representation of Texas death-row inmates, and against the backdrop of legal and policy controversy regarding so-called “botched” executions by lethal injection in other states, appellees made written requests of the Texas Department of Criminal Justice under the PIA for the agency’s “execution protocol,” the drugs it uses in lethal injections, any results of testing on such drugs, and the drugs’ source. TDCJ would eventually produce all of the information appel-lees requested except with regard to the drugs’ source; it divulged only that the source is a licensed compounding pharmacy that is open to the public and located in an urban area of some Texas city. TDCJ requested a ruling from the Attorney General that it could withhold the specific identity of that pharmacy or pharmacist,2 relying (as relevant to this appeal) on the Cox common-law protection against disclosure that would threatén physical harm. The Attorney General ruled that the Cox protection applied and required TDCJ to withhold the identifying information.3 Ap-pellees then sought judicial relief that included a writ of mandamus to compel disclosure,4 arguing that the Cox protection was inapplicable. The parties agreed to present the merits of that issue for resolution through competing summary-judgment motions. The district court granted appellees’ motion while denying TDCJ’s. Following an agreed severance to make the summary-judgment rulings final,5 TDCJ perfected this appeal.
ANALYSIS
In two issues on appeal, TDCJ urges that the district court erred in granting summary judgment for appellees and that the court should have instead granted TDCJ’s motion or, alternatively, denied both motions.
*227Statutory and procedural context
Through the PIA, the Texas Legislature has prioritized a “policy of this state that each person is entitled, unless otherwise expressly provided by law, at all times to complete information about the affairs of government and the official acts of public officials and employees,” in the view that “government is the servant and not the master of the people” and that “[t]he people, in delegating authority, do not give their public servants the right to decide what is good for the people to know and what is not good for them to know,” but “insist on remaining informed so that they may retain control over the instruments they have created.”6 To that end, the PIA generally mandates that “public information” (a broadly defined category of information created or maintained incident to governmental functions)7 must be made available by a governmental body upon request,8 and cannot be withheld “except as expressly provided by [the Act].”9 The Legislature has further instructed that the PIA “shall be liberally construed in favor of granting a request for information.”10 Reflecting these policies, the governmental body has the burden of proving that information is not subject to' disclosure under the Act.11
But as the Texas Supreme Court has emphasized recently, “liberal construction” under the PIA “is not tantamount to boundless reach,”12 and the Act’s express limitations include exceptions to the PIA’s duty of disclosure—now dozens, in fact— that “embrace the understanding that the public’s right to know is tempered by the individual and other interests at stake in disclosing that information.”13 Among these exceptions is Section 552.101, which excepts “information considered to be confidential by law, either constitutional, statutory, or by judicial decision.”14 The Texas Supreme Court has recognized that “information considered to be confidential ... by judicial decision” has the effect of incorporating protections from the common law. As early as the 1970s, the supreme court held in the Industrial Foundation case that the substantively identical predecessor to Section 552.101 excepted information whose' disclosure would violate one’s common-law right to “privacy” in the sense of being left alone and free of unwarranted publicity.15 The information is *228so shielded, the high court held, if: “(1) the information contains highly intimate or embarrassing facts .the publication of which would be highly objectionable to a reasonable person, and (2) the information is not of legitimate concern to the public.” 16 More recently, in the Cox decision, the Texas Supreme Court recognized a similar protection against PIA disclosure that is deemed to infringe the long-recognized common-law right to be free of physical harm, the same interest underlying the cause of action for battery.17
The Legislature has tipped the balance back toward disclosure somewhat by providing, in Section 552.022 of the PIA, that the Act’s exceptions shield certain specified categories of “public information” (commonly termed “core” or “super public” public information)18 only to the extent such information is also “made confidential under this chapter [the PIA] or other law.”19 “‘Other law’” for these purposes “includes other statutes, judicial decisions, and rules promulgated by the judiciary,”20 and “do[ ] not have to use the word ‘confidential’ to ... impose confidentiality.”21 The common-law protections recognized in Cox and Industrial Foundation are considered to impose “confidentiality” in this sense,22 so their applicability effectively obviates Section 552.022’s enhanced access to “core” public information.
There is no dispute that the identifying information at issue in this appeal is “public information” potentially subject to PIA mandatory disclosure, and would include at least some “core” public information.23 The parties also agree that TDCJ, as the party resisting disclosure, has the burden of proving that the information is not subject to disclosure under the PIA. Finally, the parties each acknowledge that TDCJ could meet its burden here solely by proving the information is shielded by the Cox protection.
*229The parties agreed to submit that controlling issue on cross-motions for summary judgment, as previously noted, and both motions relied on the “traditional” standard as applied to a common universe of summary-judgment evidence. We review summary-judgment rulings de novo.24 Summary judgment is proper when there are no disputed issues of material fact and the movant is entitled to judgment as a matter of law.25 We take as true any evidence favorable to the non-movant and indulge every reasonable inference and resolve any doubts in the non-mov-ant’s favor.26 Where, as here, both sides move for summary judgment on overlapping issues and the trial court grants one motion and denies the other, we review the summary-judgment evidence presented by both sides, determine all questions presented, and render the judgment that the trial court should have rendered.27
In the posture of this appeal, our analysis distills initially to whether, on this summary-judgment record, viewed in the light favorable to TDCJ, the Cox protection does not apply to the identifying information as a matter of law (i.e., the summary-judgment evidence does not present any genuine issue of material fact as to whether the protection would shield the identifying information).28 If the evidence does not present such a fact issue, we affirm; if it does, we must reverse and next consider whether, viewing the summary-judgment evidence in the light favorable to appellees, the Cox protection applies as a matter of law (i.e., the evidence does not present any genuine issue of material fact to the contrary). If such a fact issue is present, we remand; if none, we render summary judgment for TDCJ.
The parties accordingly focus their appellate advocacy on the summary-judgment evidence and the significance they perceive various items to have under Cox. Their arguments reflect divergent understandings of the Cox protection and how it is satisfied. Any meaningful .analysis of the summary-judgment evidence must begin with a clear understanding of that legal yardstick.29
The Cox protection
In addition to holding that the common-law right to be free of physical harm made information “confidential” as against the PIA, the Cox court prescribed “the appropriate standard for assessing whether disclosure would violate that interest.”30 For this standard, the court looked to the PIA itself, reasoning that “[wjhile we are not bound by the Legislature’s policy decisions when we consider protections afforded by the common law, ‘the boundaries the Legislature has drawn do inform our decision.’”31 The court borrowed from the *230same PIA exception that the Legislature had enacted immediately following this Court’s decision in Cox, in which we had held that the travel vouchers were subject to PIA disclosure in the absence of any contrary precedents from the Texas Supreme Court as of that time.32 That exception, now codified in PIA Section 552.152, states:
Information' in the custody of a governmental body that relates to an employee or officer of the governmental body is excepted from the requirements of Section 552.021 if, under the specific circumstances pertaining to the employee or officer, disclosure of the information would subject the employee or officer to a substantial threat of physical harm.33
With reference to that provision, the Cox court “concluded] that the ‘substantial threat of physical harm’ standard enunciated by the Legislature appropriately describes the interest protected under the common law, and information may be withheld if disclosure would create a substantial threat of physical harm.”34
Because Texas law had never previously recognized this “common law physical safety exception to the PIA”35 and the case had been tried under legal theories that the supreme court termed “close, but not identical, to the standard we announce today for the common law right of physical safety,”36 the court remanded the case to the trial court in the interest of justice.37 However, the supreme court gave direction regarding the proceedings on remand, and this and other aspects of its opinion further illuminate the parameters of its new standard, especially when viewed in the context of the evidence in the appellate record before it.
In responding to arguments advanced by the concurrence, the Cox court made clear that the standard it announced—“information may be withheld if disclosure would create a substantial threat of physical harm”38—contemplated “disclosure” (which, under the PIA, is tantamount to public availability39) “creating” a threat of harm less in the sense of any inherent quality of the information at issue than one presented through the potential uses of the information by members of the public.40 *231Such a threat is necessarily a function of: (1) the existence of an underlying threat that some person or persons will inflict physical harm upon another; and (2) the propensity for the particular information in question to be used, if made publicly available in the context of the underlying threat, to bring about that outcome. These relationships are stated more explicitly in the PIA exception from which the Cox court derived its standard, which refers to whether, “under the specific circumstances pertaining to the employee or officer, disclosure of the information would subject the employee or officer to a substantial threat of physical harm.”41
DPS had presented evidence of both components of a threat of physical harm “created” by PIA disclosure, albeit in an effort to invoke legal protections that differed somewhat from the one eventually announced by the supreme court. DPS had relied—and successfully, at least before the Attorney General—upon a “special circumstances” aspect of common-law privacy that the Attorney General had recognized in several decades’ worth of open-records decisions and rulings.42 Under this standard, information could be withheld “under [SJection 552.101 in conjunction with common law privacy” where disclosure was determined to create “ ‘an imminent threat of physical danger,’” as contrasted with “‘a generalized and speculative fear of harassment or retribution.’ ”43 Alternatively, DPS attempted to invoke a claimed constitutional privacy right, recognized in a Sixth Circuit decision, entitling government to withhold information where release “places an individual at substantial risk of serious bodily harm, possibly even death, from a perceived likely threat.”44 To support these asserted bases for withholding the vouchers after being challenged in court, DPS had presented live testimony from the supervisor of the Governor’s protective detail, Lieutenant David Armistead.45
Lt. Armistead attestéd to an underlying risk of physical harm faced by the Governor (then Honorable Rick Perry) and his family. Among other facts, Armistead explained that DPS had compiled “file cabinet after file cabinet after file cabinet of threats” made against Governor Perry or his family, including explicit death threats, to an extent that DPS had assigned an agent to work solely on investigating these threats. He added that Governor Perry had two “stalkers” as well. Armistead further indicated that the Governor regularly received threats in connection with his travels, observing in this regard that “our position on the death penalty”- in particular *232tended to “gamer a lot of attention,” especially when traveling internationally. Armi-stead also recounted an incident in which an individual had emailed an explicit death threat while the Governor was traveling in another state, and that subsequent investigation had determined that the sender had been a mere twenty miles from the Governor at the time.
Armistead also gave testimony tending to establish that disclosing the vouchers’ contents would, in the context of the underlying threat of physical harm, compromise the physical safety that the security detail provided the Governor and family. He explained that persons intending to “target” a public figure like the Governor would seek “information to their tactical advantage,” including “consistencies and patterns in movements and methods of movements,” “patterns with security officers!,] ... how many are placed!,] • • • what positions they are[,] and how far in advance they go to look at a site prior to the protected individual’s arrival.” Armi-stead maintained that this sort of information could be discerned from examining the vouchers, and the vouchers themselves were also before the trial court through in camera submission.
In giving guidance for proceedings on remand, the Cox court did not question the evidence regarding the existence or extent of an underlying threat of physical harm faced by the Governor and his family.46 Instead, its focus was entirely on the second variable, proof regarding the effects of disclosing the vouchers in the context of that underlying threat.47 The Cox court observed that the vouchers “divulge the number of officers the DPS deemed necessary for the governor’s security, the specific location (hotel and room number) where the officers resided when providing that security, and the identity of each officer the Department assigned to the governor’s protection.”48 These contents, the court indicated, demonstrated that “DPS is likely correct in one sense: disclosure of some of the information in the vouchers may create a substantial threat of physical harm because it reveals specific details about the number of officers assigned to protect the governor, their general location in relation to him, and their dates of travel.”49 The supreme court rejected the notion that “information from prior trips could not be used to inflict future harm,” observing that “the past is prologue, at least when it reveals protocol DPS has implemented for ensuring the safety of government officials.”50
But these considerations, the Cox court continued, did not necessarily “justify withholding all but the ultimate dollar figure,” as DPS had proposed, acknowledging that the vouchers “provide[d] a more complete picture of how taxpayer money is spent than do the general categories and totals,” that “certain information” contained within them was “core public information,” and that “the public has a legitimate interest in how public money is spent on official state business.”51 “The dividing line between disclosure and restraint,” the court explained, “must be determined by proof,” elaborating:
To the extent DPS can show, with detailed evidence or expert testimony, that revelation substantially threatens harm ... then the information at issue may be *233withheld. A certain amount of deference must be afforded DPS officers and other law enforcement experts about the probability of harm, although vague assertions of risk will not carry the day.52
If this standard is met, the Cox court emphasized, “the public’s right to ‘complete information’ [under the PIA] must yield.”53 The court further indicated that DPS’s evidence had met this burden “with respect to the number of guards protecting the governor,”54
The Cox opinion itself remains virtually our only guidance as to the precise scope or meaning of the standard the Texas Supreme Court announced there—the high court has not had occasion since to address that standard, and only one opinion from an intermediate court of appeals has engaged in any substantive analysis of the protection.55 That opinion came from this Court, in one of its cases arising from PIA requests made to the City of Carrollton.56 In that case, an appeal from a final summary judgment compelling disclosure, the City attempted to resist disclosure of various law-enforcement-related documents that had been requested by an individual who had a historical propensity toward violent altercations with his neighbors.57 Emphasizing that history, the City invoked the Cox protection alongside various other PIA exceptions, arguing essentially that the requestor would commit violence against any neighbors who were identified in responsive documents as having reported him to police or otherwise being involved in prior incidents with him.58 Our analysis of other issues made it necessary for us to consider Cox’s application only as to certain information pertaining to a police call that the requestor had initiated and an ensuing investigation in which he had been involved.59 On that record, we held that—assuming without deciding that the City had raised a fact issue as to an underlying threat of physical harm presented by the requestor60—it had not done so with respect to disclosure of the particular information remaining at issue, as the information was already within the re-questor’s knowledge.61 City of Carrollton thus represents a case where, in contrast to the situation in Cox, disclosure of the particular information in question would have no impact on the threat of physical harm faced by a person as compared to the preexisting threat that had existed even without disclosure.
*234The present case differs from both Cox and City of Carrollton. At stake here is the bare public knowledge that a particular pharmacy or pharmacist supplied TDCJ with lethal-injection drugs, and it is urged that this revelation alone would create or subject the pharmacy or pharmacist to “a substantial threat of physical harm.” As such, application of the Cox standard must focus not on the effects of disclosing particular information in the context of underlying threats of physical harm, as in Cox and City of Carrollton, but entirely upon whether an underlying “substantial threat of physical harm” exists in the first place. More specifically in the posture of this case, the issue is whether there exists an undifferentiated “substantial threat of physical harm” to any supplier of lethal-injection drugs, whomever they might be, such that mere revelation of the supplier’s identity would bring that threat to bear upon any supplier whose identity is known publicly, with individual characteristics only secondarily relevant as they might bear upon the vulnerability or accessibility of a particular target. The key issue, in other words, distills to whether a person’s manufacturing or supplying of lethal-injection drugs is the sort of activity that “would create a substantial threat,” within the contemplation of Cox, that others will attempt to physically injure or kill the person.
Resolution of that question is aided by some parameters of the Cox standard that the Texas Supreme Court did not have occasion to emphasize in that case, nor this Court in City of Carrollton. First, it bears repeating here that the Cox standard is concerned with a “substantial threat of physical harm,” consistent with the long-established common-law right from which it derives, the same right to be safe and free of physical harm that underlies the battery cause of action.62 The concern is not, for example, the common-law privacy interest in “be[ing] left alone” or avoiding “unwarranted publicity” that underlies Industrial Foundation,63 nor any economic interest.64 That limitation has important ramifications in this case.
' Not far beneath the surface of the parties’ argument in this case is a much larger (and often vigorous, divisive, sensational, and volatile) legal and policy debate surrounding the enforcement and administration of the death penalty in Texas and other jurisdictions. There are myriad reasons why a private business or professional involved in thé process would not want that fact known publicly—potential adverse marketplace effects, unwanted publicity, critical written or oral communications from members of the public, or protests, to name but a few of the un-pleasantriés that can accompany one’s association with such a controversial public *235issue. Indeed, a prominent undercurrent of this case is that such considerations have spurred significant reductions in the numbers of willing suppliers of drugs used for lethal injections in recent years, to a point that state authorities like TDCJ are relegated (at least so long as they continue to rely on the lethal-injection method) to turn to a dwindling number of smaller suppliers. But while the Legislature can take account of such concerns and their broader ramifications for the death penalty’s administration through statutory amendments (as it presumably did in later making the drug suppliers’ identity confidential and excepted from PIA disclosure65), the sole permissible focus under the Cox standard is the threat of physical harm from disclosure of the pharmacy’s or pharmacist’s identity—not, in themselves, any threats of harm to privacy or economic interests, threats of media or political “firestorms,” or even threats of harm to property short of harm to persons. Nor is it our proper role under Cox to consider whether or how disclosure might impact the availability of this particular source of supply to TDCJ, or any others, in the future. But it is equally true that if TDCJ turns out to have demonstrated that disclosure would create the requisite “substantial threat of physical harm” as contemplated in Cox, we are bound to withhold the information at issue without regard to any ramifications for the larger debates being waged about capital punishment and the lethal-injection method. Cox squarely held that “the public’s right to ‘complete information’ [under the PIA] must yield when disclosure of that information would substantially threaten physical harm.”66
Yet even while limited in its focus to threats of physical harm, the Cox standard is potentially susceptible to vastly expansive application in cases where, as here, the information at issue is solely a person’s identity and the controlling variable becomes whether there exists an underlying “substantial threat of physical harm” to any person in a particular position or undertaking. Events seem to remind us periodically that virtually all who participate in our government and its functions face not only the potential comment and criticism that are fair game in our free society, but will at some point bear some degree of risk of reactions that extend to physical violence—whether fueled by the passions incident to the disputed and difficult issues with which a self-governing People must grapple; by base resentments of role, power, or status; or by whatever myriad other triggers might lie amid the twists and warps of individual human minds. Indeed, those like us who serve in the Judiciary are unfortunately not immune, as the recent high-profile assassination attempt of a local trial-level judge has pointedly illustrated.
But the proposed remedies for such ongoing perils of judicial service have not included a return to the Star Chamber, and we conclude that the Cox standard, similarly, imposes a higher threshold before the public’s right to “complete information” under the PIA must yield. The moderating variable, in our view, is the requirement that “disclosure would create a substantial threat of physical harm.”67 Cox did not elaborate as to precisely what was meant by a “substantial threat of physical harm” beyond indicating that *236DPS’s proof had met that threshold with respect to both an underlying threat of physical harm to the Governor and the effect of disclosing “the number of guards protecting the governor” in the context of that threat.68 We can obtain some additional guidance, however, from the standard’s origins. Because the Cox court borrowed the standard from the PIA exception now codified at Section 552.152, it presumably intended to incorporate the meaning and scope that would be ascribed to that text under the familiar principles of statutory construction as they would operate in that context. The Texas Supreme Court has recently summarized these guiding principles as follows:
When interpreting a statute, our primary objective is to ascertain and give effect to the Legislature’s intent without unduly restricting or expanding, the Act’s scope. We seek that intent first and foremost in the plain meaning of the text. Undefined terms in a statute are typically given their ordinary meaning, but if a different or more precise definition is apparent from the term’s use in the context of the statute, we apply that meaning. However, we will not give an undefined term a meaning that is out of harmony or inconsistent with other terms in the statute. Therefore, even if an undefined term has multiple meanings, we recognize and apply only the meanings that are consistent with the statutory scheme as a whole. We only resort to rules of construction or extrinsic aids when a statute’s words are ambiguous. Finally, in construing the TPIA, we are mindful of the legislative mandate that the TPIA be liberally construed in favor of granting a request for information-.69
Applying these principles here, the ordi- . nary meaning of “substantial” includes two connotations that could potentially have application in the context of Section 552.152 and the Cox standard. The first is “substantial” in the sense of “true” or “real,” as opposed to imaginary or speculative.70 “Truth” or “reality” in the context of our civil justice system is not absolute certainty, but is ordinarily a function of reasonable probability (i.e., it is more likely than not) that a fact exists or will occur.71 Assuming this meaning of “substantial” along with the ordinary meaning of “threat” (which in this context would denote a person or thing likely to cause damage or danger72), disclosure that “would create” or subject a person to “a substantial threat of physical harm” would refer to a greater-than-not likelihood that physical harm would occur upon disclosure.
*237The second potential meaning of “substantial” is a more qualitative or comparative sense of “[e]onsiderable in importance, value, degree, amount, or extent,”73 or that which is deemed “material” to the inquiry.74 Under this reading, disclosure that would create or subject a person to “a substantial threat of physical harm” would refer to that which does not necessarily rise to the level of probable harm, but is nonetheless of an amount or extent that is deemed by some measure to matter or merit consideration. An example in the context of threatened physical harm would be a threat that, while not rising to a probability of harm, is nevertheless of a nature or extent that would be deemed to warrant some sort of precautionary measures.
A close reading of Cox persuades us that the Texas Supreme Court intended the former meaning—“substantial threat of physical harm” in the sense of a probability of harm. Most critically, the Cox standard is intended to describe and effectuate the historically recognized common-law right to be free of physical harm, the same right on which the battery tort is founded.75 This right, importantly, is distinct from the right or interest, also long recognized in the common law, to be free of apprehension of physical harm—i.e., the interest underlying the tort of assault, as opposed to battery.76 Construing “substantial threat of physical harm” to mean probable harm gives effect to this important distinction, and the distinction would be eroded by a “substantial threat of physical harm” that need only be considered sufficient to warrant precautionary measures or worry.
Other features of Cox point to the same conclusion. In describing the nature of proof required under the standard, the Cox court indicates that the expert testimony of law-enforcement officials “about the probability of harm,” may be relevant and worthy of deference, then distinguishes from this testimony “about the probability of harm” mere “vague' assertions of risk.”77 Also telling, the supreme court terms its new standard “close, but not identical,” to two prior alternative standards that would each appear to require proof of a probability of harm—the Attorney General’s “special circumstances” test (i.e., disclosure that would place a person in an “imminent threat of physical danger”) and the, Sixth Circuit standard (“a substantial risk of serious bodily harm from a reasonably perceived likely *238threat”).78 And the Cox court’s treatment of the evidence before the trial court, previously summarized, is consistent with a probable-harm requirement—although the court indicated that “details about the number of officers assigned to protect the governor, their general location in relation to him, and their dates of travel” were potentially significant to the inquiry, it ultimately held that DPS had met its burden only “with respect to the number of guards protecting the governor.”79 We would also opt for this reading under the PIA’s liberal-construction rule, assuming it applies, as it is the more favorable to disclosure as between the two alternatives.
Cox similarly belies any notion that the standard might alternatively contemplate some sort of balancing analysis in which the relative threat of harm is weighed against perceived benefits of disclosure, as with certain other protections under the PIA80 The protection recognized in Cox is instead absolute. When disclosure infringes upon a person’s physical safety, the supreme court explained, that interest “supersedes” the right to public information,81 and the latter “must yield when disclosure of that information would substantially threaten physical harm.”82
In sum, the measure by which we ascertain the presence of any genuine issue of material fact in the summary-judgment evidence is whether disclosure of the identifying information at issue (i.e., making publicly available the identity of the pharmacy or pharmacist who supplied TDCJ with lethal-injection drugs) would make it probable (i.e., more likely than not) that the pharmacist, pharmacy employees, or others would be physically harmed. We turn to that evidence now.
Application
To establish the applicability of the Cox protection, TDCJ relies in part on expert testimony—specifically, that of Colonel Steven McCraw (the Director of DPS),83 Brad Livingston (then TDCJ’s Executive Director),84 and John Lawrence Cunningham (an expert retained by TDCJ).85 McCraw and Livingston testified regard-*239tag a “threat assessment” that Livingston had requested from MeCraw regarding the perceived risks posed to pharmacies if they are publicly identified as providing lethal-injection drugs to TDCJ. In response, MeCraw had transmitted a one-page document in which he concluded that “publicly linking a pharmacy or other drug supplier to the production of controlled substances to be used in executions presents a substantial threat of physical harm.” Cunningham came to the same conclusion based upon his own review of MeCraw’s threat assessment as well as his assessment of the “totality” of the circumstances. Among the circumstances Cunningham cited were the “volatility]” of the public debate surrounding the death penalty and other “right to life” issues, what he termed a “contagion” effect in which the volatility of these issues is said to be enhanced by publicity highlighting them, and the “established record of violence” against other businesses involved in similar “hot button” issues (i.e., abortion clinics and laboratories that use animals for experimental purposes).
Emphasizing Cox’s directive that “[a] certain amount of deference must be afforded DPS officers and other law enforcement experts about the probability of harm,”86 TDCJ insists that we must ascribe conclusive, controlling effect to its experts’ opinions that disclosure would create a “substantial threat of physical harm.” But while it is true that TDCJ’s experts repeatedly intone the phrase “substantial threat of physical harm,” these opinions count as evidence of such a threat only to the extent they are grounded in a correct understanding of the “substantial threat of physical harm” that Cox contemplates— disclosure that creates a reasonable probability (i.e., a more-likely-than-not risk) of physical harm.87 TDCJ has not demonstrated this grounding; on the contrary, the experts’ testimony presumes a “proactive” approach in which all threats are “taken seriously’ so as to “mitigate” risk.88 While such an approach may be prudent law-enforcement practice, it is grounded in a lower threshold of risk than the “substantial threat of physical harm” that Cox requires.
Beyond this, TDCJ relies on the factual information underlying its experts’ opinions. Much of this evidence is to the effect that the death penalty is a highly controversial public issue. For example, the record includes evidence regarding the experience of a different Texas compounding *240pharmacy that previously supplied TDCJ with lethal-injection drugs, the Woodlands Pharmacy, after that fact was made known through PIA disclosure in 2013. The revelation prompted what the owner decried as a “firestorm” of angry emails, protests, and media coverage that ultimately dissuaded the pharmacy from continuing to supply TDCJ with lethal-injection drugs. TDCJ also points to the fact that violence has occasionally accompanied “hot button” issues, as emphasized by Cunningham, including in the criminal justice arena; it notes the March 2013 assassination of the director of the Colorado Department of Corrections and that death threats were made around that same time against then-Director Livingston. To the extent this evidence is relevant to the existence of a threat of physical harm to the pharmacy here, it would demonstrate only the residual or general threat of physical harm that would accompany virtually any participation in governmental functions or controversial issues. This falls short of the “substantial threat of physical harm” that Cox envisions.
Somewhat closer to the mark are two writings that specifically referenced physical harm in the context of debate regarding pharmacies that supply lethal-injection drugs. An October 6, 2013 blog posting, titled “[t]he Pharmacist who approves the business of killing, but only under the veil of secrecy,” criticizes the chief pharmacist of the Woodlands Pharmacy for “sham[ing] his profession” and for being “far more concerned about his business being disrupted, by media calls and receiving messages than being involved in human killings in the first place!” The blog contains a graphic depicting an “exploding head,” although without any explicit linkage to physical violence as the cause. In addition, TDCJ relies upon a January 29, 2014 email to an Oklahoma pharmacy that supplied lethal-injection drugs to the Missouri Department of Corrections. The e-mail, authored by a “Prof. Humez,” states:
Seems to me that manufacturing a drug expressly to kill people flies in the face of one of those commandments Moses got from Jehovah on Sinai, but maybe I’m just being old-fashioned. Still, were I you I’d at least want to beef up my security now that you’ve been put in the spotlight as a likely supplier and failed to issue a flat denial. As the folks at the federal building can tell you, [it] only takes one fanatic with a truckload of fertilizer to make a real dent in business as usual. In your place, I’d either swear to the nation that my company didn’t make execution drugs of ANY sort, and then make dang sure that’s true, or else openly accept the burden of putting my employees and myself at unacceptable (and possibly uninsurable) risk. Just sayin’.
Assuming without deciding that either the blog posing or the “Professor Humez” email can, be read to represent an actual threat of physical harm, we cannot conclude that these isolated threats, without more, would support more than mere speculation that disclosure of the identity of another pharmacy, or of the particular Texas pharmacy or pharmacist in question here, would necessarily give rise to the substantial (i.e., more, likely than not) threat of physical harm that Cox requires.89
*241On this record, the district court did not err in granting summary judgment for ap-pellees. We overrule TDCJ’s issues on appeal. '
CONCLUSION
We affirm the district court’s judgment.
. Texas Dep't of Pub. Safety v. Cox Tex. Newspapers, L.P., 343 S.W.3d 112, 115-18 (Tex. 2011).
. See Tex. Gov’t Code § 552.301.
. See Tex. Att’y Gen. OR2014-09184, at 2-3; see also Tex. Gov’t Code § 552.306.
.See Tex. Gov’t Code § 552.321.
. Remaining for resolution, and now pending in the separate cause, are claims by appellees seeking the attorney’s fees and costs the PIA would potentially authorize for "a plaintiff who substantially prevails.” See id. § 552.323(a).
. Id. § 552.001(a).
. See id. § 552.002 (defining “public information”).
. See id. § 552.021; see also id. § 552.003(1) (defining "governmental body”).
. See id. § 552.006.
. Id. § 552.001(b).
. See, e.g., Texas Dep’t of Pub. Safety v. Abbott, 310 S.W.3d 670, 673-74 (Tex. App.— Austin 2010, no pet.) ("In light of the [PIA’s] strong policy favoring disclosure of public information, ... the governmental entity has the burden of proving in a judicial proceeding that an exception to disclosure applies.” (citing. Thomas v. Cornyn, 71 S.W.3d 473, 488 (Tex. App.—Austin 2002, no pet.))); Abbott v. North E. Indep. Sch. Dist., 212 S.W.3d 364, 367 (Tex. App.—Austin 2006, no pet.) ("To withhold information under the TPIA, a governmental body must establish that the requested information is not subject to the Act or that withholding the information is permitted by one of the TPIA’s enumerated exceptions to disclosure.” (citing City of Fort Worth v. Cornyn, 86 S.W.3d 320, 323 (Tex. App.— Austin 2002, no pet.))).
. Greater Houston P'ship v. Paxton, 468 S.W.3d 51, 67 (Tex. 2015).
. Cox, 343 S.W.3d at 114; see generally Tex. Gov’t Code ch. 552, subch. C.
. Tex. Gov’t Code § 552.101.
. See Industrial Found. of the S. v. Texas Indus. Accident Bd., 540 S.W.2d 668, 682-83 (Tex. 1976); see also Cox, 343 S.W.3d at 117 *228("We have characterized [the common-law right of] privacy as ‘the right of an individual to be left alone, to live a life of seclusion, to be free from unwarranted publicity.’ ” (quoting Billings v. Atkinson, 489 S.W.2d 858, 859 (Tex. 1973))).
. Industrial Found., 540 S.W.2d at 685.
. See Cox, 343 S.W.3d at 115-16, 118.
. See id. at 114; id. at 122 (Wainright, J., concurring),
. See Tex. Gov’t Code § 552.022. The PIA makes a similar distinction in prohibiting a governmental body from disclosing “confidential” information—indeed, criminalizes it—while generally permitting voluntary disclosure of information that is merely excepted from PIA disclosure but not made confidential. See id. §§ 552.007(a) (“This chapter does not prohibit a governmental body or its officer for public information from voluntarily making part or all of its information available to the public, unless the disclosure is expressly prohibited by law or the information is confidential under law.”), .352(a) (creating offense for distribution of "information considered confidential under the terms of this chapter”),
. Cox, 343 S.W.3d at 114 (citing In re City of Georgetown, 53 S.W.3d 328, 332 (Tex. 2001) (orig. proceeding)).
. Id. (quoting City of Georgetown, 53 S.W.3d at 334).
. See id. at 118 ("Our common law protects—and has always protected—that interest [in physical safety], making such information confidential.”); Industrial Found., 540 S.W.2d at 682-83 (holding that information implicating common-law privacy interest was "confidential” within the meaning of Section 552.101's predecessor).
. See Tex. Gov’t Code § 552.022(a)(3) (core public information includes "information in an account, voucher, or contract relating to the receipt or expenditure of public or other funds by a governmental body”). Like the supreme court in Cox, we need not decide "what ... information is ‘core’ and what is not.” 343 S.W.3d at 114 n.5.
. See, e.g., Valence Operating Co. v. Dorsett, 164 S.W.3d 656, 661 (Tex. 2005) (citing Provident Life & Accident Ins. Co. v. Knott, 128 S.W.3d 211, 215 (Tex. 2003)).
. Tex. R. Civ. P. 166a(c); Western Invs., Inc. v. Urena, 162 S.W.3d 547, 550 (Tex. 2005).
. See Urena, 162 S.W.3d at 550.
. Texas Workers' Comp. Comm'n v. Patient Advocates of Tex., 136 S.W.3d 643, 648 (Tex. 2004) (citing FM Props. Operating Co. v. City of Austin, 22 S.W.3d 868, 872 (Tex. 2000)).
. See Tex. R. Civ. P. 166a(c); Science Spectrum, Inc. v. Martinez, 941 S.W.2d 910, 911 (Tex. 1997).
. See Tex. R. Civ. P. 166a(c) (summary judgment proper if evidence shows “there is no genuine issue as to any material fact and the moving party is entitled to judgment as a matter of law” (emphasis added)).
. Cox, 343 S.W.3d at 118.
. Id. (quoting Ford Motor Co. v. Miles, 967 S.W.2d 377, 383 (Tex. 1998)).
. Id.; see Act of May 31, 2009, 81st Leg., R.S., ch. 283, § 4, 2009 Tex. Gen. Laws 742, 743 (previously codified at Tex. Gov’t Code § 552.151 and subsequently recodified at Tex. Gov’t Code § 552.152); see generally Texas Dep’t of Pub. Safety v. Cox Tex. Newspapers, L.P., 287 S.W.3d 390, 393-98 (Tex. App.—Austin 2009), rev’d, 343 S.W.3d 112.
. Tex. Gov’t Code § 552.152.
. Cox, 343 S.W.3d at 118 (emphasis added).
. See id. ("Here, our decision recognizes, for the first time, a common law physical safety exception to the PIA. And even though the interest protected under that exception is well-established in our law, we have never before addressed whether or how it applies to the PIA.”).
. Id.
. See id.
. Id.
. See Tex. Gov’t Code §§ 552.007(b), 223.
. See Cox, 343 S.W.3d at 120 ("[I]nformation does not exist in a vacuum. When disclosure carries with it a serious risk of bodily harm, we cannot ignore those consequences when deciding whether common law protections apply,” and citing "cf." to U.S. Dep’t of State v. Ray, 502 U.S. 164, 177, 112 S.Ct. 541, 116 L.Ed.2d 526 (1991), which had considered potential "retaliatory action” in analyzing whether certain information regarding Haitian refugees could be withheld under the Freedom of Information Act’s exception related to privacy). See also Texas Comptroller of Pub. Accounts v. Attorney Gen. of Tex., 354 S.W.3d 336, 343 (Tex. 2010) (similarly considering potential uses of information when determining whether state employee dates of birth must be disclosed under PIA Section 552.102; "[W]e do not doubt that the News *231[the requestor, who had sought state employees’ dates of birth] would put the information to beneficial use. But if the requested information is disclosed to the News, it must be disclosed to any applicant, including those who would employ it for illegitimate purposes.”).
. Tex. Gov't Code § 552.152.
. Tex. Att’y Gen. OR2007-11405, at 1-2.
. Id. at 2 (quoting Tex. Att’y Gen. ORD1977-169, at 6).
. See Kallstrom v. City of Columbus, 136 F.3d 1055, 1064 (6th Cir. 1998).
. The issues were tried to the bench. See Cox, 343 S.W.3d at 113. Appellees have included in their summary-judgment evidence excepts from the trial-court proceedings following remand in Cox, suggesting that the extent of proof DPS presented on remand highlights inadequacies in TDCJ’s summary-judgment evidence in this proceeding. The more pertinent basis for comparison, as it informs the meaning of the Cox standard, is the earlier evidentiary record that formed the context of the supreme court's pronouncements.
. See Cox, 343 S.W.3d at 118-19.
. See id.
. Id. at 119.
. Id. at 118-19.
. Id. at 119.
. Id.
. Id.
. Id. (citing Tex. Gov’t Code § 552.001(a)).
. Id. ("To the extent DPS can show, with detailed evidence or expert testimony, that revelation substantially threatens harm—as it has with respect to the number of guards protecting the governor....” (emphasis added)).
. Nor have any cases (unless one counts Cox) construed or applied the statutory provision from which Cox’s standard is derived. Similarly, while the Attorney General evidently has issued some letter rulings (as opposed to open records decisions) in which it has applied either Section 552.152 or the Cox standard, neither side has suggested that any of these would inform our analysis.
. City of Carrollton v. Paxton, 490 S.W.3d 187, 202-04 (Tex. App.—Austin 2016, pet. filed).
. See id. at 190-94.
. See id. at 203-04.
. See id. at 204.
. See id. ("Leaving aside whether this inference [that the requestor would inflict retribu-tory violence] is supported by 'detailed evidence’ versus ’vague assertions of risk’ within the contemplation of Cox Texas Newspapers _").
. See. id. at 204.
. See Cox, 343 S.W.3d at 115-16.
. See id. at 117 (''[T]he common law right to be free from physical harm is an interest in personal integrity, distinct from that covered by the privacy interest.” (citing W. Page Keeton, et al., The Law of Torts 40 (5th ed. 1984))); see also Greater Houston P’ship, 468 S.W.3d at 53 (in context of dispute concerning breadth of PIA's "governmental body" definition, observing that "[w]hen a private entity enters into a contract and receives government funds in exchange for its services, the entity's right to conduct its affairs confidentially may be in tension with the public’s right to know how government funds are spent,” but that interests in “[t]ransparency, openness, and accountability in the government ... cannot extinguish the privacy rights properly belonging to private business entities in Texas”). .
. See Cox, 343 S.W.3d at 117 (noting the additional example of trade secrets as matters the common law makes confidential as against PIA disclosure (citing Center for Econ. Justice v. American Ins. Ass’n, 39 S.W.3d 337, 348 (Tex. App.—Austin 2001, no pet.))).
. See Tex. Gov't Code § 552.1081; Tex. Code Crim. Pro. art. 43.14(b).
. 343 S.W.3d at 119 (quoting Tex. Gov’t Code § 552.001(a)).
. Id. at 118 (emphasis added).
. See id. at 118-19.
. Greater Houston P’ship, 468 S.W.3d at 58 (citations and quotation marks omitted).
. See The American Heritage Dictionary of the English Language 1738 (5th ed. 2011) (defining ''substantial” as, inter alia, "[t]rue or real; not imaginary”).
. See, e.g., Kramer v. Lewisville Mem. Hosp., 858 S.W.2d 397, 399-400, 405 (Tex. 1993).
. See The American Heritage Dictionary at 1813 (defining "threat" as, inter alia, “[a]n indication of impending danger of harm: a threat of frost in the air" and as “[o]ne that is regarded as a possible source of harm or danger: viewed the stranger as a threat to the community"); Webster’s Third New Int’l Dictionary of the English Language 2382 (unabridged ed. 2002) (defining “threat” as, inter alia, "an indication of something impending and usu[ually] undesirable or unpleasant <the air held a [threat] of rain>” and as "something that by its very nature or relation to another threatens the welfare of the latter <the crumbling cliff was a constant [threat] to the village below > < economic depressions constitute a major [threat] to party hegemony—C.A.M. Ewing>”).
. The American Heritage Dictionary at 1738 (defining "substantial” as, inter alia, "[c]on-siderable in importance, value, degree, amount, or extent: made a substantial improvement) won by a substantial margin”).
. Id.
. See Cox, 343 S.W.3d at 115-18.
. See Restatement (Second) of Torts § 21(1) (1965) (stating an actor is subject to liability for assault if "(a) he acts intending to cause a harmful or offensive contact with the person of the other or a third person, or an imminent apprehension of such a contact, and (b) the other is thereby put in such imminent apprehension") (emphasis added); cf. Restatement (Second) of Torts §§ 13, 18 (1965) (stating an actor is subject to liability for battery if “(a) he acts intending to cause a harmful or offensive contact with the person of the other or a third person, or an imminent apprehension of such a contact,” and (b) a harmful or offensive "contact with the person of the other directly or indirectly results") (emphasis added); Keeton, The Law of Torts 43 ("The interest in freedom from apprehension of a harmful or offensive contact with the person, as distinguished from the contact itself, is protected by an action for ... assault, No actual contact is necessary to it, and the plaintiff is protected against a purely mental disturbance of this distinctive kind.”).
. Cox, 343 S.W.3d at 119 (emphasis added).
. Id. at 118.
. See id. at 118-19.
. See Texas Comptroller of Pub. Accounts, 354 S.W.3d at 341-48 (under PIA Section 552.102, weighing privacy interests of state employees in withholding dates of birth versus public interest in disclosure).
. See Cox, 343 S.W.3d at 117-18.
. Id. at 119; see also Texas Comptroller of Pub. Accounts, 354 S.W.3d at 341-42 (observing that “we have held that a balancing test is not required under section 552.101” (citing Indus. Found., 540 S.W.2d at 681)).
. TDCJ offered McCraw as a non-party, non-retained expert in law enforcement. As of his deposition in July 2014, McCraw had served as the Director of DPS for approximately five years. Prior to DPS, McCraw served as the director of Homeland Security for Texas, and prior to that, as an assistant director with the FBI in the intelligence arena.
. TDCJ offered Livingston in this case as an "interested expert.” As of his deposition in July 2014, Livingston had served as TDCJ’s Executive Director for nearly ten years. He previously served as the CFO (for TDCJ) and in various roles in state government other than at TDCJ. Livingston does not consider himself an expert in law-enforcement investigations or in assessing terrorism threats.
. Cunningham served for twenty years in the United States Secret Service, including as the Agent in Charge of the Secret Service office located in San Jose, California. His work included supervising the security arrangements for visiting world leaders to the Silicon Valley and the San Francisco Bay Area. Since retiring from the Secret Service in 1994, Cunningham has worked as a security consultant, including conducting "risk assessments” for clients.
. Cox, 343 S.W.3d at 119.
. See, e.g., Birchfield v. Texarkana Mem'l Hosp., 747 S.W.2d 361, 365 (Tex. 1987) ("[A]n expert may state an opinion on a mixed question of law and fact as long as the opinion is confined to the relevant issues and is based on proper legal concepts.”); Methodist Hosp. v. German, 369 S.W.3d 333, 342-43 (Tex. App.—Houston [14th Dist.] 2011, pet. denied) (expert’s testimony suggesting higher standard of nursing care than that allowed by law "constituted no evidence of a higher standard of care” (citing Birchfield, 747 S.W.2d at 365; Schneiderv. Haws, 118 S.W.3d 886, 889-90 (Tex. App.—Amarillo 2003, no pet.))); Schneider, 118 S.W.3d at 889-90 ("[T]o the extent that [the expert] attempted to impose upon [a physician and the physician's employee] a standard of care greater than that compelled by law, his testimony constituted no evidence, as a matter of law, of the applicable standard of care.”).
. MeCraw described the goal of his “threat assessment” as the "proactive” “mitigat[ion]" of "risk” in a society where “every threat must be considered serious,” i.e., "if we can eliminate the threat altogether just by not providing this information, why would we not do so, is my point.” Similarly, Cunningham opined that threat assessments require a "proactive approach ... because threats are not necessarily local” and "oftentimes ... have tentacles and issues that go beyond the immediate threat.”
. See, e.g., Kingsaire, Inc. v. Melendez, 477 S.W.3d 309, 313 (Tex. 2015) (" ‘[A] jury may not reasonably infer an ultimate fact from meager circumstantial evidence which could give rise to any number of inferences, none more probable than another.’ ” (quoting Hancock v. Variyam, 400 S.W.3d 59, 70-71 (Tex. 2013))); City of Keller v. Wilson, 168 S.W.3d 802, 813 (Tex. 2005) ("In claims or defenses supported only by meager circumstantial evi*241dence, the evidence does not rise above a scintilla (and thus is legally insufficient) if jurors would have to guess whether a vital fact exists.” (citations omitted)).