  Differential privacy (DP) has the potential to enable privacy-preserving
analysis on sensitive data, but requires analysts to judiciously spend a
limited ``privacy loss budget'' $\epsilon$ across queries. Analysts conducting
exploratory analyses do not, however, know all queries in advance and seldom
have DP expertise. Thus, they are limited in their ability to specify
$\epsilon$ allotments across queries prior to an analysis. To support analysts
in spending $\epsilon$ efficiently, we propose a new interactive analysis
paradigm, Measure-Observe-Remeasure, where analysts ``measure'' the database
with a limited amount of $\epsilon$, observe estimates and their errors, and
remeasure with more $\epsilon$ as needed.
  We instantiate the paradigm in an interactive visualization interface which
allows analysts to spend increasing amounts of $\epsilon$ under a total budget.
To observe how analysts interact with the Measure-Observe-Remeasure paradigm
via the interface, we conduct a user study that compares the utility of
$\epsilon$ allocations and findings from sensitive data participants make to
the allocations and findings expected of a rational agent who faces the same
decision task. We find that participants are able to use the workflow
relatively successfully, including using budget allocation strategies that
maximize over half of the available utility stemming from $\epsilon$
allocation. Their loss in performance relative to a rational agent appears to
be driven more by their inability to access information and report it than to
allocate $\epsilon$.
