# Vercy AI instruction - YAML 1.2 (JSON-compatible) { "vercy": "1.0-draft", "publication": { "status": "research-draft", "adjudicationStatus": "reviewable-draft", "publishableCanonical": false, "generatedAt": "2026-08-23T01:22:19Z", "synthesisSha256": "b7e519210f7cc00c1972e23e420c89ba366d72260c08193d7b9f371da730cf9f", "providers": [ "Claude", "Grok" ] }, "metaModel": { "id": "WM-XCT-001", "registryId": "vr.wm-xct-001", "name": "Ownership / Stewardship", "version": "0.3.0-research.1", "previousVersions": [], "entryKind": "mixin", "family": "World Models", "category": "Cross-cutting context", "industry": [ "Cross-industry" ], "domain": [ "XCT.OWN" ], "tags": [ "ownership", "stewardship", "xct.own" ], "status": "research draft" }, "canonicalUrl": "https://ver.cy/models/wm-xct-001-ownership-stewardship/", "sourceUrl": "https://github.com/ver-cy/world-models/tree/feat/mega-model-registry/research/runs/wm-xct-001", "model": { "registry_id": "vr.wm-xct-001", "model_id": "WM-XCT-001", "name": "Ownership / Stewardship", "entry_kind": "mixin", "purpose": "Provide the reusable control facet that can be attached to any meta-object so that an agent can determine who holds it, who may lawfully act for the holder, under what basis and constraints, and how control moved or will move — independently of what the object itself is.", "scope_statement": "This model records assertions of control over a referenced meta-object: the binding of one or more parties to that object in a named control modality (legal title, beneficial interest, custody, administrative controllership, or de-facto technical control), the fractions and co-holding rules that partition it, the encumbrances and holder duties that qualify it, the stewardship and delegated-authority arrangements through which someone other than the holder may act, the substitute or supported decision-making arrangements used where a holder cannot act unaided, and the instruments and events by which control is created, suspended, transferred, succeeded, lapsed or extinguished. It also records the evidentiary basis, assurance and temporal validity of each such assertion, and the governance of the control register itself. It deliberately models control as a time-bounded, source-backed, contestable assertion rather than as a fact, because no register can guarantee that its record matches the underlying legal or physical position.", "in_scope": [ "Binding of holders/controllers to a referenced meta-object, including group and collective holders, in an explicit control modality", "Fractional, joint and several holding, share restructuring and co-holder decision rules", "Encumbrances, restrictions and holder responsibilities that qualify control without transferring it", "Steward, custodian and processor appointments where operation is separated from beneficial holding", "Scoped, revocable delegation of control powers, sub-delegation, and the representation-versus-impersonation distinction", "Capacity-related arrangements: supported decision-making, substitute decision-making and their mandatory safeguards and review", "Transfer instruments, exclusivity of control, conditions precedent, succession, lapse, abandonment and escheat", "Chain-of-title reconstruction, competing claims, dispute status and priority ordering", "Evidentiary sources, assurance level, staleness and validity intervals of every control assertion", "Authority, recording effect, access, audit, retention and interoperability of the control register itself" ], "out_of_scope": [ "Identity, attributes and lifecycle of the parties themselves (natural persons, organizations, agents) — held in the person and organization models", "Runtime authorization decisions, policy evaluation and enforcement — the access-contract model consumes control records but is not defined here", "Substantive intellectual-property rights, licence terms and usage permissions over content, which are rights-in-the-work rather than control-of-the-object", "Valuation, price, accounting treatment, tax position and payment settlement of transferred objects", "Adjudication procedure for disputed title — only the dispute status and the ingested outcome are held here", "Data lineage and derivation history of the object's content, which belong to the provenance model", "Physical or logical custody mechanics (storage location, replication, key management) beyond the fact of a custody appointment", "Determination of whether any given jurisdiction actually recognises a claimed right; this model records the claimed basis and its evidence, not its legal validity" ], "boundary_notes": [ { "neighbor": "Person / Organization models", "distinction": "This model holds only a reference and a role for each party (holder, steward, delegate, supported person, beneficial owner). Party identity, legal form, capacity determination and existence lifecycle are resolved externally; a control record must not restate them. LADM makes the same split between LA_Party and the RRR that binds it.", "source_refs": [ "SRC-013", "SRC-009" ] }, { "neighbor": "Access / authorization contract model", "distinction": "Control answers 'who may grant'; access answers 'who may do what, now'. An ODRL-style Policy names an assigner; this model is what makes an assigner's standing checkable. Permission evaluation, obligations discharge and enforcement stay in the access model.", "source_refs": [ "SRC-004", "SRC-001" ] }, { "neighbor": "Provenance / lineage model", "distinction": "PROV attribution and delegation describe responsibility for entities and activities. This model reuses that shape for who acts for whom, but its subject is a standing control relation with validity intervals, not a past activity trace. Where both exist, the control record is the assertion and the provenance record is its trace.", "source_refs": [ "SRC-003", "SRC-012" ] }, { "neighbor": "Rights and licensing (IPR) model", "distinction": "dcterms:rightsHolder conflates owning and managing rights over a resource. This model separates control of the meta-object from rights in the work it represents: a custodian may control a record without holding any IP right in its content, and a rights holder may hold no control record.", "source_refs": [ "SRC-012", "SRC-004" ] }, { "neighbor": "Audit / evidence log model", "distinction": "Every write to, and privileged read of, a control record is an auditable event, but the audit trail itself is a separate append-only model. This model declares what must be logged and by whom, not the log's own structure.", "source_refs": [ "SRC-009", "SRC-018" ] }, { "neighbor": "Identity credential / key management model", "distinction": "Cryptographic control (a verification method authorized for capabilityInvocation) is evidence of control, not the control record. Key rotation is not a transfer of ownership; conflating them makes an operator into an owner. The controlled-identifier document is an artifact this model cites, not one it owns.", "source_refs": [ "SRC-001", "SRC-002" ] }, { "neighbor": "Dispute resolution / courts model", "distinction": "This model carries a dispute flag, the competing claims and the ingested outcome reference. Procedure, evidence weighing and remedies belong to the dispute model; a control record must never encode an adjudication.", "source_refs": [ "SRC-010", "SRC-013" ] } ] }, "sources": [ { "id": "SRC-001", "title": "Controlled Identifiers v1.0", "organization": "World Wide Web Consortium (W3C)", "url": "https://www.w3.org/TR/cid-1.0/", "version_or_date": "W3C Recommendation, 15 May 2025", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Normative definition of 'controller' as the entity able to update the canonical document, plus verification relationships capabilityInvocation and capabilityDelegation. Supplies the de-facto/technical control modality and the delegation primitive." }, { "id": "SRC-002", "title": "Decentralized Identifiers (DIDs) v1.1", "organization": "World Wide Web Consortium (W3C)", "url": "https://www.w3.org/TR/did-1.1/", "version_or_date": "W3C Candidate Recommendation Snapshot, 05 March 2026", "source_type": "standard", "primary_source": true, "authority_tier": 2, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "DID controller, multiple controllers, DID delegate, and the statement that the process of authorizing a controller is method-defined. Candidate Recommendation, so treated as maturing rather than settled." }, { "id": "SRC-003", "title": "PROV-O: The PROV Ontology", "organization": "World Wide Web Consortium (W3C)", "url": "https://www.w3.org/TR/prov-o/", "version_or_date": "W3C Recommendation, 30 April 2013", "source_type": "ontology", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "prov:actedOnBehalfOf defines delegation as assignment of authority and responsibility while the delegating agent retains some responsibility; prov:Attribution, prov:Delegation and prov:hadRole give the qualified forms used for steward and delegate roles." }, { "id": "SRC-004", "title": "ODRL Information Model 2.2", "organization": "World Wide Web Consortium (W3C)", "url": "https://www.w3.org/TR/odrl-model/", "version_or_date": "W3C Recommendation, 15 February 2018", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Assigner/assignee role functions, Permission/Prohibition/Duty, Offer versus Agreement, and Constraint. Grounds the boundary between control standing and granted permission, and the duty shape used for holder responsibilities." }, { "id": "SRC-005", "title": "Verifiable Credentials Data Model v2.0", "organization": "World Wide Web Consortium (W3C)", "url": "https://www.w3.org/TR/vc-data-model-2.0/", "version_or_date": "W3C Recommendation, 15 May 2025", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "States that a holder is often but not always a subject, with parent/child and owner/pet examples. Directly supports separating possession of an evidencing artifact from the underlying control relation." }, { "id": "SRC-006", "title": "UNCITRAL Model Law on Electronic Transferable Records (MLETR)", "organization": "United Nations Commission on International Trade Law (UNCITRAL)", "url": "https://uncitral.un.org/en/texts/ecommerce/modellaw/electronic_transferable_records", "version_or_date": "Adopted 13 July 2017; UNGA resolution A/RES/72/114", "source_type": "legislation", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Control as the functional equivalent of possession: a reliable method must establish exclusive control by a person and identify that person as the person in control; change of control replaces physical delivery." }, { "id": "SRC-007", "title": "Regulation (EU) 2016/679 (General Data Protection Regulation)", "organization": "European Union", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679", "version_or_date": "OJ L 119, 4.5.2016", "source_type": "legislation", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Art. 4(7)-(10) controller/processor/recipient/third party, Art. 26 joint controllers, Art. 28 processor duties, Art. 20 portability. Supplies the administrative controllership modality and the steward/processor separation." }, { "id": "SRC-008", "title": "Regulation (EU) 2023/2854 (Data Act)", "organization": "European Union", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202302854", "version_or_date": "OJ 22.12.2023", "source_type": "legislation", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Data holder / user / data recipient roles, and the explicit recitals that the Regulation confers no new right on data holders. Key counterexample against modelling control over data as ownership." }, { "id": "SRC-009", "title": "Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation)", "organization": "European Union", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401624", "version_or_date": "OJ L, 19.6.2024", "source_type": "legislation", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Requires adequate, accurate and up-to-date beneficial ownership information, establishing the legal-versus-beneficial holder distinction and a currency/assurance obligation on the register." }, { "id": "SRC-010", "title": "Convention on the Rights of Persons with Disabilities, Article 12 — Equal recognition before the law", "organization": "United Nations", "url": "https://www.un.org/development/desa/disabilities/convention-on-the-rights-of-persons-with-disabilities/article-12-equal-recognition-before-the-law.html", "version_or_date": "Adopted 13 December 2006, in force 3 May 2008", "source_type": "legislation", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Legal capacity on an equal basis, support in exercising it, and mandatory safeguards: respect for will and preferences, freedom from conflict of interest, proportionality, shortest time possible, regular review by a competent independent body; plus equal property and inheritance rights." }, { "id": "SRC-011", "title": "RFC 8693: OAuth 2.0 Token Exchange", "organization": "Internet Engineering Task Force (IETF)", "url": "https://www.rfc-editor.org/rfc/rfc8693.html", "version_or_date": "Standards Track, January 2020", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Normative distinction between impersonation (A indistinguishable from B) and delegation (A retains its own identity while representing B), with the act and may_act claims. Grounds the acting-party attribution requirement." }, { "id": "SRC-012", "title": "DCMI Metadata Terms", "organization": "Dublin Core Metadata Initiative (DCMI)", "url": "https://www.dublincore.org/specifications/dublin-core/dcmi-terms/", "version_or_date": "DCMI Recommendation, 2020-01-20", "source_type": "schema", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "dcterms:provenance defines a statement of changes in ownership and custody significant for authenticity and integrity; dcterms:rightsHolder, mediator, accessRights and RightsStatement mark the rights/control boundary." }, { "id": "SRC-013", "title": "ISO 19152-1:2024 Geographic information — Land Administration Domain Model (LADM) — Part 1: Generic conceptual model", "organization": "International Organization for Standardization (ISO)", "url": "https://www.iso.org/standard/81263.html", "version_or_date": "Published 2024 (Edition 1); supersedes ISO 19152:2012", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Party / RRR (Right, Restriction, Responsibility) / basic administrative unit pattern, the generic conceptual model package (VersionedObject, LA_Source, Oid, Fraction) and the shift to 'georegulation'. Full clause text is paywalled; only catalogue-level and secondary-confirmed structure is relied on." }, { "id": "SRC-014", "title": "The CARE Principles for Indigenous Data Governance", "organization": "Global Indigenous Data Alliance / CODATA Data Science Journal (Carroll et al.)", "url": "https://datascience.codata.org/articles/10.5334/dsj-2020-043", "version_or_date": "Data Science Journal 19(1):43, 4 November 2020, DOI 10.5334/dsj-2020-043", "source_type": "scientific", "primary_source": true, "authority_tier": 2, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Collective Benefit, Authority to Control, Responsibility, Ethics; states that Indigenous data governance includes both stewardship and the processes needed to implement Indigenous control. Grounds collective and non-proprietary authority as a first-class control modality." }, { "id": "SRC-015", "title": "Voluntary Guidelines on the Responsible Governance of Tenure of Land, Fisheries and Forests in the Context of National Food Security (VGGT)", "organization": "Food and Agriculture Organization of the United Nations / Committee on World Food Security", "url": "https://www.fao.org/tenure/voluntary-guidelines/en/", "version_or_date": "Endorsed by the Committee on World Food Security, 11 May 2012", "source_type": "public-authority", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Requires recognition of all forms of tenure — public, private, communal, indigenous, customary and informal — establishing that an unregistered or customary holding is a legitimate control state rather than an absence of control." }, { "id": "SRC-016", "title": "NIST Computer Security Resource Center Glossary — information owner", "organization": "National Institute of Standards and Technology (NIST)", "url": "https://csrc.nist.gov/glossary/term/information_owner", "version_or_date": "Sources: FIPS 200, NIST SP 800-37 Rev. 2, SP 800-53 Rev. 5, CNSSI 4009-2015", "source_type": "registry", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Defines an information owner as an official with statutory or operational authority and responsibility for establishing controls across generation, collection, processing, dissemination and disposal — an accountability-based rather than proprietary control modality, with 'information steward' as a related term." }, { "id": "SRC-017", "title": "ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls", "organization": "International Organization for Standardization / International Electrotechnical Commission", "url": "https://www.iso.org/standard/75652.html", "version_or_date": "Published February 2022 (Edition 3)", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Control 5.9 requires an inventory of information and other associated assets including owners, and timely (re)assignment of ownership on creation, transfer and role change. Clause text is paywalled; wording corroborated by SRC-020." }, { "id": "SRC-018", "title": "Judgment in Joined Cases C-37/20 and C-601/20, WM and Sovim SA v Luxembourg Business Registers", "organization": "Court of Justice of the European Union", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62020CJ0037", "version_or_date": "22 November 2022, ECLI:EU:C:2022:807", "source_type": "public-authority", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Invalidated general-public access to beneficial ownership registers as a disproportionate interference with Charter Articles 7 and 8. Decisive counterexample against defaulting ownership registers to open access." }, { "id": "SRC-019", "title": "2022 Amendments to the Uniform Commercial Code (new Article 12, Controllable Electronic Records)", "organization": "Uniform Law Commission / American Law Institute", "url": "https://www.uniformlaws.org/committees/community-home?CommunityKey=1457c422-ddb7-40b0-8c76-39a1991651ac", "version_or_date": "Approved 2022; state enactments ongoing", "source_type": "legislation", "primary_source": true, "authority_tier": 2, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Control of a controllable electronic record as power to obtain substantially all benefit, exclusive power to prevent others, exclusive power to transfer control, and self-identification. Detailed elements were verified through commentary rather than the enacted text itself." }, { "id": "SRC-020", "title": "ISO 27002 Control 5.9 — Inventory of Information and Other Associated Assets", "organization": "ISMS.online", "url": "https://www.isms.online/iso-27002/control-5-9-inventory-of-information-and-other-associated-assets/", "version_or_date": "Accessed August 2026", "source_type": "secondary", "primary_source": false, "authority_tier": 4, "accessed_at": "2026-08-23T09:12:00Z", "relevance": "Secondary corroboration of the wording of ISO/IEC 27002:2022 control 5.9 on assigning and reassigning asset ownership, used only because the normative clause is paywalled." }, { "id": "SRC-021", "title": "The first five parts of LADM Edition II have been published — ISO 19152-1:2024 Geographic information — Land Administration Domain Model (LADM) — Part 1: Generic conceptual model", "organization": "FIG / ISO TC 211 (LADM Edition II overview by standard co-editors)", "url": "https://ojs.sites.ufsc.br/index.php/fig/article/download/8753/7293/33065", "version_or_date": "2025-08-18", "source_type": "standard", "primary_source": true, "authority_tier": 2, "accessed_at": "2026-08-23T12:00:00Z", "relevance": "Describes ISO 19152-1:2024 Party package (LA_Party), Administrative package (LA_RRR specialisations LA_Right, LA_Restriction, LA_Responsibility, and LA_BAUnit), sources and versioned objects. Full ISO text is paywalled; this node is grounded in the published Edition II package description, not a claim of ISO-text transcription." }, { "id": "SRC-022", "title": "ODRL Information Model 2.2", "organization": "W3C", "url": "https://www.w3.org/TR/2018/REC-odrl-model-20180215/", "version_or_date": "2018-02-15", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T12:00:00Z", "relevance": "W3C Recommendation. Defines Policy, Party function assigner/assignee, Asset, Permission/Prohibition/Duty, Constraint, uid as IRI, and top-level Action transfer as actions that involve the transfer of ownership to third parties." }, { "id": "SRC-023", "title": "UNCITRAL Model Law on Electronic Transferable Records (MLETR)", "organization": "United Nations Commission on International Trade Law", "url": "https://uncitral.un.org/sites/uncitral.un.org/files/media-documents/uncitral/en/mletr_ebook_e.pdf", "version_or_date": "2017", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T12:00:00Z", "relevance": "Official e-book text. Article 10: identify the record, keep it capable of control from creation until it ceases to have effect, retain integrity. Article 11 Control: exclusive control by a person and identification of that person; transfer of possession is met by transfer of control. Control is not defined because it is the functional equivalent of possession, which varies by jurisdiction. Substantive rights of the person in control remain other law." }, { "id": "SRC-024", "title": "Guidance on Beneficial Ownership of Legal Persons (Recommendation 24)", "organization": "Financial Action Task Force", "url": "https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/Guidance-Beneficial-Ownership-Legal-Persons.pdf", "version_or_date": "2023-03", "source_type": "public-authority", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T12:00:00Z", "relevance": "FATF, Paris, March 2023. Distinguishes legal ownership and beneficial ownership; ownership interests versus control/other means beyond a threshold; nominee shareholders and directors; bearer shares; adequate, accurate and up-to-date information; discrepancy reporting; access by competent authorities. Companion R.25 guidance on legal arrangements (trusts) published 11 March 2024 is in-scope as related FATF work." }, { "id": "SRC-025", "title": "Voluntary Guidelines on the Responsible Governance of Tenure of Land, Fisheries and Forests in the Context of National Food Security — At a glance", "organization": "Food and Agriculture Organization of the United Nations", "url": "https://www.fao.org/3/a-i3016e.pdf", "version_or_date": "2012-07", "source_type": "public-authority", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T12:00:00Z", "relevance": "Rome, 2012, ISBN 978-92-5-107305-6. Parent Guidelines endorsed by the Committee on World Food Security on 11 May 2012. Tenure: who can use which resources, for how long, under what conditions, via formal law or informal arrangements. Forms: public, private, communal, indigenous, customary and informal. States should recognise and respect all legitimate tenure rights, including informal; transfers and other changes (including expropriation) are a distinct part of the Guidelines." }, { "id": "SRC-026", "title": "Convention of 1 July 1985 on the Law Applicable to Trusts and on their Recognition", "organization": "Hague Conference on Private International Law (HCCH)", "url": "https://www.hcch.net/en/instruments/conventions/full-text/?cid=59", "version_or_date": "1985-07-01", "source_type": "legislation", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T12:00:00Z", "relevance": "Entry into force 1 January 1992. Article 2: settlor places assets under control of a trustee for a beneficiary or purpose; separate fund; title in the trustee; trustee has power and duty to manage, employ or dispose and is accountable. Articles 6–8 applicable law, including appointment, removal, delegation, security interests, duration, variation, termination, distribution and duty to account. Article 11 recognition and insolvency/death ring-fence. Article 15 mandatory other law: minors and incapable parties, marriage, succession, transfer of title and security interests, insolvency creditors, good-faith third parties." }, { "id": "SRC-027", "title": "Convention on the Rights of Persons with Disabilities, Article 12 — Equal recognition before the law", "organization": "United Nations / OHCHR", "url": "https://www.ohchr.org/en/instruments-mechanisms/instruments/convention-rights-persons-disabilities", "version_or_date": "2006-12-13", "source_type": "legislation", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T12:00:00Z", "relevance": "Adopted 13 December 2006, 2515 U.N.T.S. 3. Article 12: legal capacity on an equal basis in all aspects of life; States shall provide access to the support persons may require in exercising legal capacity; measures relating to the exercise of legal capacity shall provide appropriate and effective safeguards against abuse. This is the primary international-law counterweight to plenary substituted guardianship." }, { "id": "SRC-028", "title": "ISO 19115-1 CI_RoleCode — function performed by the responsible party", "organization": "ISO/TC 211 Implementation Schemas", "url": "https://schemas.isotc211.org/resources/codelists/ISO19115-1.1.cit.CI-RoleCode/", "version_or_date": "2014 (ISO 19115-1:2014 codelist; TC 211 schema catalogue live)", "source_type": "classifier", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-08-23T12:00:00Z", "relevance": "Defined values include owner (party that owns the resource), custodian (party that accepts accountability and responsibility for the resource and ensures appropriate care), rightsHolder (party owning or managing rights over the resource), mediator, originator, publisher, stakeholder. There is no code steward in this official 20-value list; stewardship in this mixin therefore aligns to custodian plus rightsHolder, not to a missing ISO role." } ], "structure": { "bundles": [ { "id": "control-anchor", "name": "Controllability and Anchoring", "description": "What makes a meta-object subject to a control record at all, how that record is identified and versioned, which modality of control is asserted, and on what basis.", "rationale": "Every downstream statement — share, delegation, transfer — presupposes a determinate object, a determinate control modality and a stated basis. LADM anchors rights to a basic administrative unit and every class to a versioned object and a source; MLETR and UCC Art. 12 both require that the record be susceptible to control and that the person in control be identifiable. Without this bundle the mix-in would attach ownership language to objects that cannot bear it.", "source_refs": [ "SRC-013", "SRC-006", "SRC-019", "SRC-001" ], "layers": [ { "id": "object-binding", "name": "Object Binding and Record Identity", "description": "The reference from a control assertion to the meta-object it governs, the controllability of that object, and the identity and version discipline of the assertion itself.", "source_refs": [ "SRC-013", "SRC-006", "SRC-001" ], "findings": [ { "id": "controllable-object-anchor", "name": "Controllable object anchor", "description": "A control record binds to exactly one referenced meta-object. The reference must resolve, and the object must be of a kind that can bear control: MLETR and UCC Article 12 both gate control on the record being susceptible to exclusive control, and CID makes control turn on the ability to update a canonical resource. Objects that are pure abstractions, aggregates without a canonical instance, or copies without a single authoritative instance are not controllable and must be flagged rather than silently given an owner.", "source_refs": [ "SRC-006", "SRC-019", "SRC-001", "SRC-013" ], "questions": [ { "id": "q-anchor-target", "text": "Which single meta-object does this control assertion govern, and does that reference resolve to a canonical instance rather than a copy or a class?", "kind": "identity", "answer_data": [ "object reference (identifier of the governed meta-object)", "object kind / classifier", "canonical-instance flag", "resolution status of the reference" ] }, { "id": "q-anchor-controllable", "text": "Is the object susceptible to exclusive control, or does it exist as indefinitely reproducible copies with no authoritative instance?", "kind": "classification", "answer_data": [ "controllability class (exclusively-controllable | jointly-controllable | non-exclusive | non-controllable)", "authoritative-instance mechanism", "justification text" ] }, { "id": "q-anchor-scope", "text": "Does control extend to the whole object or only to a defined part, aspect or bundle of it?", "kind": "composition", "answer_data": [ "control extent (whole | part | aspect)", "part descriptor or aspect qualifier", "excluded aspects" ] }, { "id": "q-anchor-aggregate", "text": "If the object is an aggregate, is control asserted over the aggregate, over each member, or over both with different holders?", "kind": "relationship", "answer_data": [ "aggregation handling rule", "member control records referenced", "conflict-with-member flag" ] } ], "data_elements": [ { "id": "de-object-ref", "name": "Governed object reference", "description": "Resolvable identifier of the meta-object to which this control assertion attaches.", "value_kind": "reference", "cardinality": "1", "required": true, "source_refs": [ "SRC-013", "SRC-001" ] }, { "id": "de-controllability-class", "name": "Controllability class", "description": "Whether and how the object can be exclusively controlled, drawn from the MLETR/UCC-12 exclusivity test.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-006", "SRC-019" ] }, { "id": "de-control-extent", "name": "Control extent", "description": "Whether the assertion covers the whole object, a named part, or a named aspect only.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-013" ] } ], "artifacts": [ { "id": "art-control-anchor-record", "name": "Control anchor record", "description": "The register entry that makes a meta-object controllable: object reference, controllability class, extent and the registration basis that admitted it.", "media_or_form": [ "structured register entry", "signed data document", "register extract for third parties" ], "serial": false, "identity_strategy": "Authoritative master-register entry identifier where a governing register exists; otherwise a governed IRI minted by the adopting Dimension; otherwise a UUIDv4/ULID. Never the registration date.", "source_refs": [ "SRC-013", "SRC-006" ] } ], "inline_only_rationale": null }, { "id": "control-record-identity-versioning", "name": "Control record identity and versioning", "description": "Identity and version discipline for the assertion itself. LADM derives its core classes from a versioned object with an object identifier, so that a superseded holding remains addressable rather than being overwritten. A control record must therefore be immutably identified, carry a version lineage, and never be identified by the date on which it took effect.", "source_refs": [ "SRC-013", "SRC-001", "SRC-012" ], "questions": [ { "id": "q-identity-priority", "text": "Which identifier authority governs this control record: an authoritative master register, a governed global IRI, or a locally minted UUID/ULID?", "kind": "identity", "answer_data": [ "record identifier", "identifier scheme and issuing authority", "identity tier (master | governed-global | local-surrogate)" ] }, { "id": "q-version-lineage", "text": "Which prior version does this record supersede, and is the superseded version still resolvable?", "kind": "provenance", "answer_data": [ "supersedes reference", "version number or sequence", "superseded-record retrievability flag" ] }, { "id": "q-correction-vs-change", "text": "Does this new version correct an error in the prior record or record a real-world change of control?", "kind": "classification", "answer_data": [ "revision type (correction | real-world-change | reclassification)", "correction reason code", "corrected fields" ] } ], "data_elements": [ { "id": "de-record-id", "name": "Control record identifier", "description": "Immutable identifier of this control assertion, assigned by the highest available identity tier.", "value_kind": "identifier", "cardinality": "1", "required": true, "source_refs": [ "SRC-013", "SRC-001" ] }, { "id": "de-supersedes", "name": "Supersedes", "description": "Reference to the immediately prior version of this control assertion.", "value_kind": "reference", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-013" ] }, { "id": "de-revision-type", "name": "Revision type", "description": "Whether a new version is a correction of the record or a change in the world.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-012" ] } ], "artifacts": [], "inline_only_rationale": "Identity and version lineage are intrinsic fields of the control record itself; they produce no separable document. The register extract that exposes them is already covered by art-control-anchor-record and art-chain-of-title-extract." } ] }, { "id": "control-nature", "name": "Modality and Basis of Control", "description": "Which kind of control is being asserted and what makes the assertion admissible.", "source_refs": [ "SRC-007", "SRC-016", "SRC-006", "SRC-008" ], "findings": [ { "id": "control-modality-classification", "name": "Control modality classification", "description": "'Ownership' is not a single relation. The sources support at least five distinguishable modalities: legal title or tenure right (LADM LA_Right), beneficial interest (AMLR beneficial owner), custody or possession-equivalent control (MLETR, UCC-12), administrative controllership and accountability (GDPR controller; NIST information owner; ISO/IEC 27002 asset owner), and de-facto technical control (CID controller). These have different transfer rules, different evidence and different consequences; the EU Data Act explicitly refuses to convert a data holder's position into a new right. The modality must therefore be an explicit, non-defaulted field.", "source_refs": [ "SRC-007", "SRC-016", "SRC-006", "SRC-008", "SRC-001", "SRC-013", "SRC-017" ], "questions": [ { "id": "q-modality-which", "text": "Which control modality does this record assert — legal title, beneficial interest, custody, administrative controllership, or de-facto technical control?", "kind": "classification", "answer_data": [ "control modality code", "modality definition source reference", "modality-specific qualifiers" ] }, { "id": "q-modality-stack", "text": "Do several modalities over this object coexist with different parties, and are they recorded as separate assertions rather than merged?", "kind": "relationship", "answer_data": [ "coexisting control record references", "modality per record", "separation-maintained flag" ] }, { "id": "q-modality-implications", "text": "Does the asserted modality carry a transferable right, or only accountability without any proprietary claim?", "kind": "authority", "answer_data": [ "transferability (transferable | non-transferable | transferable-with-consent)", "confers-proprietary-right boolean", "basis for the non-proprietary reading" ] }, { "id": "q-modality-defaulting", "text": "If the modality is unknown, is the record held as unclassified rather than defaulted to legal title?", "kind": "exception", "answer_data": [ "modality-unknown flag", "provisional handling rule", "escalation route" ] } ], "data_elements": [ { "id": "de-control-modality", "name": "Control modality", "description": "The kind of control asserted, chosen from an explicit controlled vocabulary that never defaults to legal title.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-007", "SRC-006", "SRC-016" ] }, { "id": "de-confers-proprietary-right", "name": "Confers proprietary right", "description": "Whether the asserted modality is claimed to carry a proprietary right, expressly false for regulatory-accountability and data-holder positions.", "value_kind": "boolean", "cardinality": "1", "required": true, "source_refs": [ "SRC-008", "SRC-016" ] }, { "id": "de-transferability", "name": "Transferability", "description": "Whether the asserted control can be transferred, and under what consent condition.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-006", "SRC-019" ] } ], "artifacts": [ { "id": "art-modality-vocabulary", "name": "Control modality vocabulary", "description": "The governed code list of control modalities with definitions, source alignment and transfer semantics for each.", "media_or_form": [ "controlled vocabulary / code list", "SKOS-style concept scheme", "published alignment table" ], "serial": true, "identity_strategy": "Namespaced concept IRI per modality under the adopting Dimension's vocabulary namespace, versioned; serial name pattern MODALITY-VOCAB-..", "source_refs": [ "SRC-007", "SRC-016", "SRC-006" ] } ], "inline_only_rationale": null }, { "id": "basis-of-control", "name": "Basis and admissibility of control", "description": "Every control assertion must name the ground that created it and the source document evidencing that ground — LADM binds each class to a source, and MLETR conditions control on a reliable method being used. The basis distinguishes a first registration from a derivative acquisition, and records whether the recording itself is constitutive of the right or merely declaratory of it, which changes what an agent may infer from a silent register.", "source_refs": [ "SRC-013", "SRC-006", "SRC-015", "SRC-012" ], "questions": [ { "id": "q-basis-ground", "text": "What legal, contractual, customary or administrative ground creates this control, and is it original or derivative?", "kind": "provenance", "answer_data": [ "basis code (statute | contract | customary | administrative act | first appropriation | court order | technical control)", "acquisition type (original | derivative)", "citation of the instrument or rule" ] }, { "id": "q-basis-evidence", "text": "Which source documents evidence the basis, and what is their type and reliability?", "kind": "evidence", "answer_data": [ "source document references", "source type (administrative | private instrument | attestation | observation)", "reliability assessment" ] }, { "id": "q-basis-recording-effect", "text": "Is recording in this register constitutive of the control, or merely declaratory of a control that exists independently?", "kind": "authority", "answer_data": [ "recording effect (constitutive | declaratory | evidentiary-only)", "governing register reference", "consequence of non-recording" ] }, { "id": "q-basis-informal", "text": "If the basis is customary, communal or informal, is it recorded as legitimate rather than as an absence of tenure?", "kind": "exception", "answer_data": [ "tenure form (public | private | communal | indigenous | customary | informal)", "recognition status in the operating jurisdiction", "VGGT-alignment note" ] } ], "data_elements": [ { "id": "de-basis-code", "name": "Basis of control", "description": "The ground on which control is claimed to arise.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-013", "SRC-015" ] }, { "id": "de-basis-source", "name": "Basis source reference", "description": "Reference to the evidencing source document, modelled on LADM's source association.", "value_kind": "reference", "cardinality": "1..n", "required": true, "source_refs": [ "SRC-013", "SRC-012" ] }, { "id": "de-recording-effect", "name": "Recording effect", "description": "Whether registration creates the control, declares it, or merely evidences it.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-013", "SRC-006" ] }, { "id": "de-tenure-form", "name": "Tenure form", "description": "Public, private, communal, indigenous, customary or informal, per VGGT's requirement to respect all forms of tenure.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-015" ] } ], "artifacts": [ { "id": "art-basis-source-dossier", "name": "Basis source dossier", "description": "The set of instruments, attestations or administrative acts cited as the ground of a control assertion, with type, issuer and integrity data for each.", "media_or_form": [ "document set with per-item metadata", "verifiable credential set", "scanned instrument with fixity digest" ], "serial": false, "identity_strategy": "Prefer the issuing authority's instrument number; else a content-addressed digest plus issuer identifier; else a locally minted ULID. Digest alone is not an identity where the same instrument may be reissued.", "source_refs": [ "SRC-013", "SRC-005", "SRC-012" ] } ], "inline_only_rationale": null }, { "id": "governing-law-and-situs", "name": "Applicable law and situs", "description": "HCCH Articles 6–8: a trust is governed by the law chosen by the settlor or, failing that, the law of closest connection, ascertained especially from place of administration, situs of assets, residence of the trustee, and objects of the trust. Article 9 allows a severable aspect, particularly administration, to be governed by a different law. Article 15 lists mandatory forum rules that cannot be derogated from by voluntary act. DCMI coverage and Jurisdiction describe spatial applicability or the jurisdiction under which a resource is relevant. FAO VGGT is implemented through national strategies and legislation; it is not self-executing title. Lex rei sitae for tangible objects, lex societatis for legal persons, and chosen trust law may therefore diverge for one meta-object; the mixin records each pointer rather than picking a single world law.", "source_refs": [ "SRC-026", "SRC-012", "SRC-025" ], "questions": [ { "id": "governing-law-and-situs-q01", "text": "Which law governs this holding or trust, was it chosen or selected by closest connection, and what is the situs of the assets or administration?", "kind": "authority", "answer_data": [ "governing-law: law", "choice-mode: mode", "situs: situs" ] }, { "id": "governing-law-and-situs-q02", "text": "Are administration or other severable aspects governed by a different law, and which mappings apply?", "kind": "composition", "answer_data": [ "severable-aspects: aspect-law pairs" ] }, { "id": "governing-law-and-situs-q03", "text": "Which HCCH Article 15 mandatory categories (minors, marriage, succession, security interests, insolvency, good faith) override the chosen law for this object?", "kind": "exception", "answer_data": [ "mandatory-forum-rules: categories hit", "effect: how recognition or transfer is constrained" ] }, { "id": "governing-law-and-situs-q04", "text": "Through which national policy or statute, if any, are VGGT tenure principles applied to this object?", "kind": "interoperability", "answer_data": [ "national-instrument: instrument or none", "jurisdiction-of-relevance: jurisdiction" ] } ], "data_elements": [ { "id": "governing-law-and-situs-data01", "name": "governing-law", "description": "Primary governing law identifier.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-026" ] }, { "id": "governing-law-and-situs-data02", "name": "choice-mode", "description": "express, implied, closest-connection, lex-rei-sitae, lex-societatis, forum-mandatory.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-026" ] }, { "id": "governing-law-and-situs-data03", "name": "situs", "description": "Situs of assets or administration.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-026" ] }, { "id": "governing-law-and-situs-data04", "name": "severable-aspects", "description": "Aspect to law mappings (Article 9).", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-026" ] }, { "id": "governing-law-and-situs-data05", "name": "mandatory-forum-rules", "description": "Article 15 categories that apply.", "value_kind": "code", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-026" ] }, { "id": "governing-law-and-situs-data06", "name": "jurisdiction-of-relevance", "description": "DCMI coverage/jurisdiction.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-012" ] } ], "artifacts": [ { "id": "governing-law-and-situs-artifact01", "name": "Governing law record", "description": "Record of chosen or closest-connection law, situs, severable aspects and mandatory forum rules affecting a holding or trust.", "media_or_form": [ "record" ], "serial": false, "identity_strategy": "Identified by the holding or trust it qualifies, plus the instrument that made the choice of law; never a date alone.", "source_refs": [ "SRC-012", "SRC-026" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "holding", "name": "Holding, Shares and Encumbrances", "description": "Who holds the object, in what proportions and under which co-holder decision rules, what encumbers the holding, and what duties the holding carries.", "rationale": "LADM's party / RRR / basic-administrative-unit pattern with an explicit Fraction class, together with the AMLR legal-versus-beneficial distinction and CARE's collective Authority to Control, establish that the holder side is not a single party field but a structured set of parties, proportions, restrictions and responsibilities.", "source_refs": [ "SRC-013", "SRC-009", "SRC-014", "SRC-004" ], "layers": [ { "id": "holder-identification", "name": "Holder Identification", "description": "Binding parties to the object in holder roles, including group and collective holders, and separating the party of record from the party who actually benefits.", "source_refs": [ "SRC-013", "SRC-009", "SRC-014" ], "findings": [ { "id": "holder-party-binding", "name": "Holder party binding", "description": "The holder side is a set of party references with declared roles, resolved against the person and organization models. LADM distinguishes an individual party from a group party with members, which is what allows a community, a household, a partnership or an unincorporated body to hold without being forced into a legal-person shape. The binding carries a role and a validity interval, not the party's attributes.", "source_refs": [ "SRC-013", "SRC-014", "SRC-015", "SRC-003" ], "questions": [ { "id": "q-holder-who", "text": "Which parties are bound as holders of this object, and in which role does each stand?", "kind": "ownership", "answer_data": [ "party references", "holder role per party (sole | co-holder | nominee | trustee | representative)", "validity interval per binding" ] }, { "id": "q-holder-group", "text": "Is the holder an individual party or a group party, and if a group, is its membership enumerated or defined by rule?", "kind": "composition", "answer_data": [ "party form (individual | group | collective | unincorporated body)", "membership enumeration or membership rule", "membership-as-of timestamp" ] }, { "id": "q-holder-resolution", "text": "Does every party reference resolve in the person or organization model, and what happens when one does not?", "kind": "validation", "answer_data": [ "resolution status per reference", "unresolved-party handling rule", "provisional-party placeholder identifier" ] }, { "id": "q-holder-unknown", "text": "If no holder can currently be identified, is the object recorded as holder-unknown with a search obligation rather than left with a stale holder?", "kind": "exception", "answer_data": [ "holder-unknown flag", "diligent-search status and date", "interim custodian reference" ] } ], "data_elements": [ { "id": "de-holder-party-ref", "name": "Holder party reference", "description": "Reference to a party in the person or organization model bound as a holder.", "value_kind": "reference", "cardinality": "1..n", "required": true, "source_refs": [ "SRC-013", "SRC-003" ] }, { "id": "de-holder-role", "name": "Holder role", "description": "The function the party performs in the holding, following PROV's qualified role pattern.", "value_kind": "code", "cardinality": "1..n", "required": true, "source_refs": [ "SRC-003", "SRC-004" ] }, { "id": "de-party-form", "name": "Party form", "description": "Individual, group or collective holder shape, per LADM's group-party pattern and VGGT's communal tenure.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-013", "SRC-015" ] }, { "id": "de-holder-unknown", "name": "Holder unknown", "description": "Flag indicating no identifiable holder, requiring a documented diligent search rather than a default assignment.", "value_kind": "boolean", "cardinality": "1", "required": true, "source_refs": [ "SRC-015", "SRC-013" ] } ], "artifacts": [ { "id": "art-title-extract", "name": "Current holder extract", "description": "A minimal third-party-readable statement of the present holder(s) of a named object, deliberately omitting history, shares, mandates and capacity arrangements.", "media_or_form": [ "register extract document", "signed assertion / verifiable credential", "API projection payload" ], "serial": true, "identity_strategy": "Extract identifier composed of the control record identifier plus an issuance sequence; each issuance is separately identified and timestamped in RFC 3339 because an extract asserts state as of an instant.", "source_refs": [ "SRC-013", "SRC-005" ] } ], "inline_only_rationale": null }, { "id": "legal-versus-beneficial-holder", "name": "Legal versus beneficial holder", "description": "The party of record is not always the party who benefits. AMLR requires adequate, accurate and up-to-date beneficial ownership information precisely because nominee, trustee and layered structures separate the two. Modelling only the record holder makes the register systematically misleading; modelling only the beneficiary makes it unusable for transfer. Both must be recordable, separately sourced and separately access-controlled.", "source_refs": [ "SRC-009", "SRC-018", "SRC-005", "SRC-013" ], "questions": [ { "id": "q-beneficial-who", "text": "Who ultimately benefits from or controls this object behind the party of record, and through which intermediate chain?", "kind": "ownership", "answer_data": [ "beneficial holder references", "control chain (ordered intermediate parties)", "means of control (ownership interest | control by other means)" ] }, { "id": "q-beneficial-nominee", "text": "Is any party of record acting as a nominee, trustee or custodian for another, and is that fact disclosed on the record?", "kind": "relationship", "answer_data": [ "nominee flag per party", "principal reference", "instrument creating the nominee relation" ] }, { "id": "q-beneficial-currency", "text": "How recently was the beneficial-holder information verified, and by what method?", "kind": "quality", "answer_data": [ "last verification timestamp", "verification method", "adequacy/accuracy/currency assessment" ] }, { "id": "q-beneficial-access", "text": "Who may see the beneficial-holder layer, given that general public access to such data has been held disproportionate?", "kind": "access", "answer_data": [ "disclosure tier per audience", "legitimate-interest test outcome", "redaction rules for the public projection" ] } ], "data_elements": [ { "id": "de-beneficial-holder", "name": "Beneficial holder reference", "description": "Party who ultimately owns or controls the object behind the party of record.", "value_kind": "reference", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-009" ] }, { "id": "de-control-chain", "name": "Control chain", "description": "Ordered sequence of intermediate parties between the party of record and the beneficial holder.", "value_kind": "collection", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-009" ] }, { "id": "de-bo-verified-at", "name": "Beneficial ownership verified at", "description": "RFC 3339 timestamp of the last verification of the beneficial-ownership layer, supporting the up-to-date requirement.", "value_kind": "timestamp", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-009" ] }, { "id": "de-bo-disclosure-tier", "name": "Beneficial ownership disclosure tier", "description": "Audience classes permitted to read the beneficial layer, defaulting to restricted rather than public.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-018" ] } ], "artifacts": [ { "id": "art-beneficial-ownership-statement", "name": "Beneficial ownership statement", "description": "A restricted-disclosure statement of the beneficial holders behind a control record, with the control chain, means of control and verification metadata.", "media_or_form": [ "restricted register entry", "regulator-facing filing", "verifiable credential with selective disclosure" ], "serial": true, "identity_strategy": "Filing reference issued by the competent authority where one exists; otherwise control record identifier plus filing sequence. Each restatement is a new serial artifact, never an in-place edit.", "source_refs": [ "SRC-009", "SRC-018", "SRC-005" ] } ], "inline_only_rationale": null } ] }, { "id": "shares-and-coholding", "name": "Shares and Co-Holding", "description": "How a single holding is partitioned among co-holders and how co-holders decide.", "source_refs": [ "SRC-013", "SRC-007" ], "findings": [ { "id": "fractional-and-joint-holding", "name": "Fractional and joint holding", "description": "LADM's generic conceptual model provides an explicit Fraction class precisely because shares must be exact and must sum correctly. Beyond the arithmetic, co-holding needs a decision rule: whether a disposal requires unanimity, a majority by share, or any single holder acting alone. GDPR's joint-controller arrangement shows the same need — joint responsibility is meaningless unless the allocation between the parties is determined and transparent.", "source_refs": [ "SRC-013", "SRC-007" ], "questions": [ { "id": "q-share-fraction", "text": "What exact fraction does each co-holder hold, and do the fractions sum to unity for the recorded extent?", "kind": "measurement", "answer_data": [ "fraction numerator and denominator per holder", "sum validation result", "unallocated residue if any" ] }, { "id": "q-share-form", "text": "Is the co-holding joint (undivided, with survivorship) or several (divided into distinct shares)?", "kind": "classification", "answer_data": [ "co-holding form (joint | several | joint-and-several | in-common)", "survivorship rule", "severability conditions" ] }, { "id": "q-share-decision", "text": "What threshold of co-holders is required to dispose of, encumber or delegate the object?", "kind": "constraint", "answer_data": [ "decision rule per act type", "threshold expression", "deadlock resolution route" ] }, { "id": "q-share-allocation", "text": "Where responsibility rather than value is shared, how is it allocated between the parties and where is that allocation published?", "kind": "authority", "answer_data": [ "responsibility allocation statement reference", "allocated duties per party", "point of contact for affected parties" ] } ], "data_elements": [ { "id": "de-share-fraction", "name": "Holding fraction", "description": "Exact rational fraction of the holding attributed to one co-holder, expressed as numerator and denominator rather than a rounded decimal.", "value_kind": "quantity", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-013" ] }, { "id": "de-coholding-form", "name": "Co-holding form", "description": "Joint, several, joint-and-several or in-common, determining survivorship and severability.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-013" ] }, { "id": "de-disposal-decision-rule", "name": "Disposal decision rule", "description": "Threshold of co-holder agreement required for each class of act over the object.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-007", "SRC-004" ] } ], "artifacts": [ { "id": "art-share-schedule", "name": "Share schedule", "description": "A dated schedule of co-holders, exact fractions, co-holding form and decision thresholds, superseded as a whole on each restructuring.", "media_or_form": [ "tabular schedule attached to the control record", "structured document", "register annexe" ], "serial": true, "identity_strategy": "Control record identifier plus a monotonically increasing schedule sequence; each restructuring mints a new schedule rather than mutating fractions in place, so historical shares remain reconstructable.", "source_refs": [ "SRC-013" ] } ], "inline_only_rationale": null } ] }, { "id": "qualifications", "name": "Encumbrances and Holder Duties", "description": "Restrictions and responsibilities that qualify a holding without moving it.", "source_refs": [ "SRC-013", "SRC-004", "SRC-016", "SRC-019" ], "findings": [ { "id": "restrictions-and-encumbrances", "name": "Restrictions and encumbrances", "description": "LADM treats restrictions as first-class alongside rights, and UCC Article 12 lets a secured party perfect an interest by taking control of a controllable electronic record — meaning an encumbrance can itself be a control position held by someone other than the holder. Encumbrances must therefore be recorded with their beneficiary, their priority rank and their effect on transferability, not as free text.", "source_refs": [ "SRC-013", "SRC-019", "SRC-004" ], "questions": [ { "id": "q-encumbrance-what", "text": "What restrictions, security interests or charges currently qualify this holding, and who benefits from each?", "kind": "constraint", "answer_data": [ "encumbrance type", "beneficiary party reference", "secured amount or scope", "instrument reference" ] }, { "id": "q-encumbrance-priority", "text": "In what priority order do competing encumbrances rank, and on what basis is that rank determined?", "kind": "relationship", "answer_data": [ "priority rank", "priority basis (registration order | control | statutory)", "subordination agreements" ] }, { "id": "q-encumbrance-effect", "text": "Does this encumbrance block, condition or merely notify a transfer of control?", "kind": "constraint", "answer_data": [ "transfer effect (blocking | consent-required | notice-only)", "consenting party reference", "release condition" ] }, { "id": "q-encumbrance-release", "text": "What event releases the encumbrance, and is release recorded as a separate assertion?", "kind": "lifecycle", "answer_data": [ "release trigger", "release instrument reference", "release timestamp" ] } ], "data_elements": [ { "id": "de-encumbrance", "name": "Encumbrance", "description": "A restriction, charge or security interest qualifying the holding, with beneficiary, scope and instrument.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-013", "SRC-019" ] }, { "id": "de-encumbrance-priority", "name": "Encumbrance priority rank", "description": "Ordinal rank of an encumbrance against competing interests, with the basis for that rank.", "value_kind": "number", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-019" ] }, { "id": "de-transfer-effect", "name": "Transfer effect", "description": "Whether the encumbrance blocks a transfer, requires a consent, or requires only notice.", "value_kind": "code", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-019", "SRC-013" ] } ], "artifacts": [ { "id": "art-encumbrance-certificate", "name": "Encumbrance certificate", "description": "A point-in-time statement of all subsisting encumbrances on an object with priority ranks, issued to counterparties before a transfer.", "media_or_form": [ "certificate document", "signed structured statement", "API projection" ], "serial": true, "identity_strategy": "Issuing register's certificate number where available; otherwise control record identifier plus issuance sequence and an RFC 3339 as-of timestamp, since the certificate's value is entirely time-bound.", "source_refs": [ "SRC-019", "SRC-013" ] } ], "inline_only_rationale": null }, { "id": "holder-responsibilities", "name": "Holder responsibilities", "description": "Control carries obligations, not only powers. LADM places responsibilities beside rights and restrictions; NIST defines the information owner by responsibility for controls across the whole information lifecycle; ISO/IEC 27002 control 5.9 requires a named owner accountable for the asset and timely reassignment on transfer or role change; ODRL models the same shape as a Duty. Recording duties makes an unattended or orphaned object detectable.", "source_refs": [ "SRC-013", "SRC-016", "SRC-017", "SRC-004", "SRC-020" ], "questions": [ { "id": "q-duty-what", "text": "What responsibilities attach to holding this object, and are they duties of the holder, of a steward, or of both?", "kind": "requirement", "answer_data": [ "duty descriptions", "duty bearer role", "duty source (statute | policy | contract | control framework)" ] }, { "id": "q-duty-discharge", "text": "How is discharge of each responsibility evidenced, and what is the consequence of non-discharge?", "kind": "evidence", "answer_data": [ "discharge evidence reference", "last discharge timestamp", "non-discharge consequence" ] }, { "id": "q-duty-reassignment", "text": "When the named owner leaves a role or the object is transferred, what triggers timely reassignment of the responsibility?", "kind": "process", "answer_data": [ "reassignment trigger event", "target time to reassign", "current assignment status" ] }, { "id": "q-duty-unassigned", "text": "Which objects currently carry responsibilities with no assigned bearer?", "kind": "quality", "answer_data": [ "unassigned-duty count per object", "age of the gap", "escalation owner" ] } ], "data_elements": [ { "id": "de-holder-duty", "name": "Holder responsibility", "description": "An obligation attaching to the control position, following LADM's responsibility class and ODRL's Duty.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-013", "SRC-004" ] }, { "id": "de-accountable-role", "name": "Accountable role", "description": "The named individual or role formally accountable for the object, as required by asset-inventory practice.", "value_kind": "reference", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-017", "SRC-016", "SRC-020" ] }, { "id": "de-reassignment-due", "name": "Reassignment due", "description": "RFC 3339 timestamp by which accountability must be reassigned following a trigger event.", "value_kind": "timestamp", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-017", "SRC-020" ] } ], "artifacts": [ { "id": "art-accountability-register", "name": "Accountability register", "description": "The cross-object inventory of controlled objects with their accountable owner or steward, duty set and reassignment status.", "media_or_form": [ "inventory register", "periodic attestation report", "dashboard projection" ], "serial": true, "identity_strategy": "Register identifier plus reporting-period key in RFC 3339 interval form; each period is a distinct immutable snapshot, since the register's purpose is showing accountability over time.", "source_refs": [ "SRC-017", "SRC-016", "SRC-020" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "stewardship-delegation", "name": "Stewardship, Delegation and Capacity", "description": "Control exercised by someone who is not the holder: appointed stewards and custodians, scoped delegated authority, and arrangements where the holder cannot act unaided.", "rationale": "PROV defines delegation as assignment of authority and responsibility while the delegating agent retains some responsibility; CID provides capabilityDelegation; RFC 8693 separates representation from impersonation; GDPR separates controller from processor; CRPD Article 12 imposes hard safeguards on any substitute arrangement. These are distinct mechanisms with distinct failure modes and cannot be collapsed into one 'agent' field.", "source_refs": [ "SRC-003", "SRC-001", "SRC-011", "SRC-007", "SRC-010" ], "layers": [ { "id": "steward-appointment", "name": "Steward and Custodian Appointment", "description": "Appointment of a party to operate or safeguard an object on the holder's behalf without beneficial holding.", "source_refs": [ "SRC-007", "SRC-016", "SRC-012", "SRC-014" ], "findings": [ { "id": "steward-custodian-appointment", "name": "Steward and custodian appointment", "description": "A steward operates an object under the holder's instruction and gains no beneficial position, as GDPR's processor acts only on behalf of the controller and dcterms:provenance treats custody changes as significant to authenticity in their own right. The appointment must carry its instruction limits, duty set, term and accountability route, so that a steward acting beyond instruction is detectable and can be reclassified as an independent controller.", "source_refs": [ "SRC-007", "SRC-016", "SRC-012", "SRC-003" ], "questions": [ { "id": "q-steward-who", "text": "Which party is appointed steward or custodian, over which extent of the object, and by whose authority?", "kind": "authority", "answer_data": [ "steward party reference", "appointing party reference", "appointment instrument reference", "covered extent" ] }, { "id": "q-steward-limits", "text": "What may the steward do only on instruction, and what may it decide independently?", "kind": "constraint", "answer_data": [ "instructed acts", "discretionary acts", "prohibited acts" ] }, { "id": "q-steward-excess", "text": "What happens if a steward determines purposes and means of its own, rather than acting on instruction?", "kind": "exception", "answer_data": [ "role reclassification rule", "detection signal", "notification obligations" ] }, { "id": "q-steward-term", "text": "For what term does the appointment run, and what must the steward do on termination — return, transfer or destroy?", "kind": "lifecycle", "answer_data": [ "term start and end (RFC 3339)", "termination trigger", "end-of-term disposition obligation" ] } ], "data_elements": [ { "id": "de-steward-ref", "name": "Steward party reference", "description": "Party appointed to operate or safeguard the object without beneficial holding.", "value_kind": "reference", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-007", "SRC-016" ] }, { "id": "de-instruction-limits", "name": "Instruction limits", "description": "The acts the steward may perform only on instruction versus at its own discretion.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-007" ] }, { "id": "de-end-of-term-disposition", "name": "End-of-term disposition", "description": "Required action on termination: return, onward transfer, or destruction with evidence.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-007", "SRC-012" ] } ], "artifacts": [ { "id": "art-steward-appointment-instrument", "name": "Steward appointment instrument", "description": "The instrument appointing a steward or custodian, stating duties, instruction limits, term, sub-contracting rules and end-of-term disposition.", "media_or_form": [ "executed agreement", "administrative appointment order", "signed structured document" ], "serial": false, "identity_strategy": "Instrument reference assigned by the appointing authority or contract register; otherwise a governed IRI. Amendments are recorded as new versions linked to the original instrument identifier.", "source_refs": [ "SRC-007", "SRC-016" ] } ], "inline_only_rationale": null }, { "id": "trust-arrangement-and-separate-fund", "name": "Trust parties and separate fund", "description": "HCCH Trusts Convention Article 2 defines a trust as a relationship created inter vivos or on death by a settlor when assets are placed under the control of a trustee for a beneficiary or a specified purpose. Characteristics: the assets are a separate fund and not part of the trustee's own estate; title stands in the trustee or another on the trustee's behalf; the trustee has the power and the duty, in respect of which the trustee is accountable, to manage, employ or dispose of the assets. Reservation of settlor powers, and the trustee also being a beneficiary, are not necessarily inconsistent with a trust. Article 11 requires that personal creditors of the trustee have no recourse against trust assets and that those assets do not fall into the trustee's insolvency, matrimonial property or death estate. The Convention applies only to voluntarily created trusts evidenced in writing (Article 3) and does not bind States to recognise trusts whose significant elements connect to non-trust States (Article 13).", "source_refs": [ "SRC-026", "SRC-024" ], "questions": [ { "id": "trust-arrangement-and-separate-fund-q01", "text": "Who is the settlor, who are the trustees, who are the beneficiaries or what is the purpose, and is the trustee also a beneficiary?", "kind": "relationship", "answer_data": [ "settlor-party-id: settlor", "trustee-party-ids: trustees", "beneficiary-party-ids: beneficiaries", "purpose: purpose if any", "trustee-is-beneficiary: overlap flag" ] }, { "id": "trust-arrangement-and-separate-fund-q02", "text": "Do the assets constitute a separate fund that is excluded from the trustee's personal, insolvency, matrimonial and death estates, and where is that ring-fence recorded?", "kind": "constraint", "answer_data": [ "separate-fund-flag: segregation", "ring-fence-status: how Article 11 effects are recorded", "asset-title-standing: in trustee name or nominee for trustee" ] }, { "id": "trust-arrangement-and-separate-fund-q03", "text": "Which law governs the trust, was it chosen by the settlor or selected by closest connection, and is recognition refused under Article 13?", "kind": "authority", "answer_data": [ "governing-law: law identifier", "choice-mode: express, implied, closest-connection", "recognition-status: recognition outcome" ] }, { "id": "trust-arrangement-and-separate-fund-q04", "text": "What powers and duties does the trustee have to manage, employ or dispose, to delegate, to create security interests, and to account, and how is the trustee removed?", "kind": "requirement", "answer_data": [ "power-list: Article 8 powers in force", "account-route: duty to account", "removal-rule: appointment and removal rule" ] } ], "data_elements": [ { "id": "trust-arrangement-and-separate-fund-data01", "name": "trust-id", "description": "Trust arrangement identifier.", "value_kind": "identifier", "cardinality": "1", "required": true, "source_refs": [ "SRC-026" ] }, { "id": "trust-arrangement-and-separate-fund-data02", "name": "settlor-party-id", "description": "Settlor.", "value_kind": "reference", "cardinality": "1", "required": true, "source_refs": [ "SRC-026" ] }, { "id": "trust-arrangement-and-separate-fund-data03", "name": "trustee-party-ids", "description": "Trustees of record.", "value_kind": "reference", "cardinality": "1..n", "required": true, "source_refs": [ "SRC-026" ] }, { "id": "trust-arrangement-and-separate-fund-data04", "name": "beneficiary-party-ids", "description": "Beneficiaries, or empty if purpose trust.", "value_kind": "reference", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-026" ] }, { "id": "trust-arrangement-and-separate-fund-data05", "name": "purpose", "description": "Specified purpose if not a beneficiary trust.", "value_kind": "text", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-026" ] }, { "id": "trust-arrangement-and-separate-fund-data06", "name": "governing-law", "description": "Law chosen by settlor or closest-connection law (Arts 6–7).", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-026" ] }, { "id": "trust-arrangement-and-separate-fund-data07", "name": "written-evidence-id", "description": "Writing evidencing the trust.", "value_kind": "reference", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-026" ] }, { "id": "trust-arrangement-and-separate-fund-data08", "name": "separate-fund-flag", "description": "Assets segregated from trustee estate.", "value_kind": "boolean", "cardinality": "1", "required": true, "source_refs": [ "SRC-026" ] }, { "id": "trust-arrangement-and-separate-fund-data09", "name": "created-mode", "description": "inter-vivos or on-death.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-026" ] }, { "id": "trust-arrangement-and-separate-fund-data10", "name": "recognition-status", "description": "recognised, not-recognised-art13, pending.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-026" ] } ], "artifacts": [ { "id": "trust-arrangement-and-separate-fund-artifact01", "name": "Trust instrument", "description": "Written instrument creating or evidencing the trust, including chosen law and trustee powers.", "media_or_form": [ "instrument" ], "serial": true, "identity_strategy": "Master-system identifier of the instrument register, else governed IRI, else Dimension-assigned UUID or ULID; variations are new serials.", "source_refs": [ "SRC-026" ] } ], "inline_only_rationale": null } ] }, { "id": "delegated-authority", "name": "Delegated Authority", "description": "Scoped, revocable grants of specific control powers, their verification, and the attribution of acts performed under them.", "source_refs": [ "SRC-001", "SRC-011", "SRC-003", "SRC-004" ], "findings": [ { "id": "delegation-mandate-scope", "name": "Delegation mandate scope", "description": "A mandate grants named powers, never more than the granting position holds. CID's capabilityDelegation and DID's notion of a delegate express the mechanism; ODRL's assigner/assignee and constraint model express the scoping; PROV records that the delegating agent retains some responsibility. Sub-delegation must be explicit, because silent sub-delegation is the main way scope escapes its origin.", "source_refs": [ "SRC-001", "SRC-002", "SRC-004", "SRC-003" ], "questions": [ { "id": "q-mandate-powers", "text": "Which specific powers are delegated, over which object extent, and under what constraints of time, place, purpose or value?", "kind": "authority", "answer_data": [ "delegated power list", "object extent", "constraint expressions (temporal, purpose, monetary, spatial)" ] }, { "id": "q-mandate-source", "text": "From which control position does the mandate flow, and is every delegated power contained within that position?", "kind": "relationship", "answer_data": [ "issuing control record reference", "containment check result", "excess-power findings" ] }, { "id": "q-mandate-subdelegation", "text": "May the delegate sub-delegate, to whom, and does the chain depth have a hard limit?", "kind": "composition", "answer_data": [ "sub-delegation permitted flag", "permitted sub-delegate classes", "maximum chain depth", "current chain" ] }, { "id": "q-mandate-attribution", "text": "When the delegate acts, is the act attributed to the delegate representing the holder, or does the delegate become indistinguishable from the holder?", "kind": "provenance", "answer_data": [ "attribution mode (representation | impersonation)", "acting party identifier", "on-behalf-of party identifier" ] } ], "data_elements": [ { "id": "de-delegated-power", "name": "Delegated power", "description": "One named power granted to a delegate, bounded by the issuing control position.", "value_kind": "code", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-004" ] }, { "id": "de-mandate-constraint", "name": "Mandate constraint", "description": "A boolean condition refining the delegated power, in the ODRL constraint shape.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-004" ] }, { "id": "de-attribution-mode", "name": "Attribution mode", "description": "Representation (acting party retains its own identity) versus impersonation (acting party is indistinguishable from the principal).", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-011" ] }, { "id": "de-subdelegation-depth", "name": "Sub-delegation depth", "description": "Current and maximum permitted depth of the delegation chain.", "value_kind": "number", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-001", "SRC-011" ] } ], "artifacts": [ { "id": "art-delegation-mandate", "name": "Delegation mandate", "description": "The machine-verifiable grant of scoped control powers from a holder to a delegate, including constraints, expiry, sub-delegation rule and revocation endpoint.", "media_or_form": [ "verifiable credential / capability document", "signed policy expression", "register entry" ], "serial": false, "identity_strategy": "Governed IRI minted by the issuing control record's namespace, bound cryptographically to the issuer's verification method. A mandate identifier must remain resolvable after revocation so that past acts stay checkable.", "source_refs": [ "SRC-001", "SRC-005", "SRC-004" ] } ], "inline_only_rationale": null }, { "id": "mandate-verification-revocation", "name": "Mandate verification and revocation", "description": "A mandate is only useful if a counterparty can check, at the moment of reliance, that it exists, is in scope and is unrevoked. Revocation is never instantaneous in a distributed setting, so the model must record the revocation timestamp, the publication timestamp and the reliance rule that governs acts falling in the gap. RFC 8693's may_act shows the same pattern: authorization to become an actor is a checkable statement, not an ambient property.", "source_refs": [ "SRC-011", "SRC-001", "SRC-005", "SRC-004" ], "questions": [ { "id": "q-verify-live", "text": "At the moment of reliance, what evidence shows the mandate was live, in scope and unrevoked?", "kind": "validation", "answer_data": [ "verification timestamp (RFC 3339)", "status source consulted", "scope match result", "verifier identity" ] }, { "id": "q-revoke-when", "text": "When was the mandate revoked, when was that revocation published, and how large was the gap?", "kind": "temporal", "answer_data": [ "revocation effective timestamp", "revocation publication timestamp", "propagation gap duration" ] }, { "id": "q-revoke-gap", "text": "Are acts performed in good faith during the revocation propagation gap treated as valid, void, or voidable?", "kind": "exception", "answer_data": [ "reliance rule", "good-faith test criteria", "remediation route for affected counterparties" ] }, { "id": "q-verify-offline", "text": "How can a mandate be verified when the issuing register is unreachable, and what assurance is lost?", "kind": "interoperability", "answer_data": [ "offline verification method", "maximum acceptable staleness", "degraded-assurance marker" ] } ], "data_elements": [ { "id": "de-mandate-status", "name": "Mandate status", "description": "Live, suspended, expired or revoked, with the status source that was consulted.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-001", "SRC-005" ] }, { "id": "de-revocation-effective-at", "name": "Revocation effective at", "description": "RFC 3339 timestamp at which revocation took effect, distinct from when it was published.", "value_kind": "timestamp", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-011" ] }, { "id": "de-revocation-published-at", "name": "Revocation published at", "description": "RFC 3339 timestamp at which the revocation became observable to relying parties.", "value_kind": "timestamp", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-005" ] }, { "id": "de-reliance-rule", "name": "Reliance rule", "description": "How acts performed during the revocation propagation gap are treated.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-011", "SRC-019" ] } ], "artifacts": [ { "id": "art-mandate-verification-record", "name": "Mandate verification record", "description": "The evidence a relying party retains showing what it checked, when, against which status source, and with what outcome.", "media_or_form": [ "append-only verification log entry", "signed verification receipt", "audit event" ], "serial": true, "identity_strategy": "Verifier-scoped ULID ordered by verification instant, paired with the mandate identifier; the record must be immutable because it is the counterparty's defence for having relied.", "source_refs": [ "SRC-011", "SRC-005" ] } ], "inline_only_rationale": null } ] }, { "id": "capacity-and-collective", "name": "Capacity and Collective Authority", "description": "Arrangements where the holder cannot act unaided, and holdings whose authority is collective rather than individual.", "source_refs": [ "SRC-010", "SRC-014", "SRC-015" ], "findings": [ { "id": "capacity-support-arrangements", "name": "Capacity and decision-support arrangements", "description": "CRPD Article 12 recognises legal capacity on an equal basis and requires access to support in exercising it; where any measure relating to legal capacity is used it must respect the person's rights, will and preferences, be free of conflict of interest and undue influence, be proportional and tailored, apply for the shortest time possible, and be subject to regular review by a competent, independent and impartial authority. A control model must therefore default to supported decision-making and treat full substitution as a bounded, reviewable exception carrying an expiry — not as a permanent 'guardian' field.", "source_refs": [ "SRC-010", "SRC-005" ], "questions": [ { "id": "q-capacity-mode", "text": "Is this arrangement supported decision-making, partially substituted, or fully substituted, and why was the least restrictive option not sufficient?", "kind": "classification", "answer_data": [ "arrangement mode", "least-restrictive-alternative justification", "scope of substituted acts" ] }, { "id": "q-capacity-safeguards", "text": "Which safeguards are recorded: conflict-of-interest screening, proportionality, tailoring, and the shortest-time limit?", "kind": "requirement", "answer_data": [ "conflict-of-interest declaration", "proportionality assessment", "arrangement end date (RFC 3339)", "tailoring notes" ] }, { "id": "q-capacity-review", "text": "Which competent, independent and impartial authority reviews the arrangement, and when is the next review due?", "kind": "authority", "answer_data": [ "reviewing authority reference", "last review date", "next review due date", "review outcome" ] }, { "id": "q-capacity-will", "text": "How are the person's own will and preferences recorded and given effect within the arrangement?", "kind": "requirement", "answer_data": [ "expressed will and preference record reference", "communication support used", "deviation justification where preferences were not followed" ] } ], "data_elements": [ { "id": "de-capacity-mode", "name": "Capacity arrangement mode", "description": "Supported, partially substituted or fully substituted decision-making over the holding.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-010" ] }, { "id": "de-arrangement-expiry", "name": "Arrangement expiry", "description": "Mandatory end date implementing the shortest-time-possible requirement; an arrangement without an expiry is invalid.", "value_kind": "date", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-010" ] }, { "id": "de-review-authority", "name": "Review authority reference", "description": "The competent, independent and impartial authority responsible for periodic review.", "value_kind": "reference", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-010" ] }, { "id": "de-conflict-declaration", "name": "Conflict of interest declaration", "description": "Recorded screening of the supporter or substitute decision-maker for conflict of interest and undue influence.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-010" ] } ], "artifacts": [ { "id": "art-capacity-arrangement-record", "name": "Capacity arrangement record", "description": "The record of a support or substitution arrangement over a holding, with mode, scope, safeguards, expiry, review authority and review history. Highly sensitive; disclosed only to parties with a demonstrated need.", "media_or_form": [ "restricted register entry", "court or tribunal order reference", "sealed structured document" ], "serial": true, "identity_strategy": "Order or determination reference issued by the competent authority; otherwise a governed IRI. Each review outcome creates a new serial version so that the shortest-time and review obligations are auditable.", "source_refs": [ "SRC-010" ] } ], "inline_only_rationale": null }, { "id": "collective-authority-to-control", "name": "Collective and community authority to control", "description": "Some holdings vest in a people, community or governing body rather than in an individual or a corporate person. CARE asserts that Indigenous Peoples' rights and interests in Indigenous data must be recognised and their authority to control empowered, and that Indigenous data governance comprises both stewardship and the processes implementing that control. VGGT requires respect for communal, indigenous, customary and informal tenure. This is a distinct authority shape: consent is given by a governance process, is often non-transferable, and may persist even where a third party physically holds the object.", "source_refs": [ "SRC-014", "SRC-015", "SRC-013" ], "questions": [ { "id": "q-collective-body", "text": "Which community or governing body holds authority to control, and by what internal process is a decision reached?", "kind": "authority", "answer_data": [ "governing body reference", "decision process description", "quorum or consent standard", "authorised representative(s)" ] }, { "id": "q-collective-vs-custody", "text": "Where a third party physically holds the object, does collective authority persist independently of that custody?", "kind": "relationship", "answer_data": [ "persisting-authority flag", "custodian reference", "obligations of the custodian to the authority holder" ] }, { "id": "q-collective-transfer", "text": "Is the collective authority alienable at all, and if not, how is that non-transferability enforced against downstream recipients?", "kind": "constraint", "answer_data": [ "alienability code", "downstream binding mechanism", "attached use conditions" ] }, { "id": "q-collective-benefit", "text": "What return or benefit flows back to the community from uses of the object, and how is it reported?", "kind": "requirement", "answer_data": [ "benefit-sharing terms", "reporting obligation and cadence", "responsible party" ] } ], "data_elements": [ { "id": "de-collective-authority", "name": "Collective authority holder", "description": "Reference to the community, people or governing body holding authority to control.", "value_kind": "reference", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-014", "SRC-015" ] }, { "id": "de-consent-process", "name": "Collective consent process", "description": "The governance process, quorum or consent standard by which the collective decides.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-014" ] }, { "id": "de-alienability", "name": "Alienability", "description": "Whether the collective authority may be transferred, and any downstream binding conditions if it may not.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-014", "SRC-015" ] } ], "artifacts": [ { "id": "art-collective-authority-statement", "name": "Collective authority statement", "description": "A community-issued statement of who holds authority to control an object, the consent process, attached use conditions and benefit-sharing terms, travelling with the object downstream.", "media_or_form": [ "community-issued notice or label", "machine-readable use condition attached to the object", "governance agreement" ], "serial": false, "identity_strategy": "Identifier minted by the community's own governance registry where one exists — this is itself an expression of authority to control; a Dimension-minted surrogate is used only with the community's agreement and must record that fact.", "source_refs": [ "SRC-014", "SRC-015" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "transfer", "name": "Transfer, Succession and Exclusivity", "description": "How control originates, moves, lapses and ends, and what prevents two parties from claiming it at once.", "rationale": "MLETR conditions transfer on a reliable method establishing exclusive control and identifying the person in control; UCC Article 12 makes exclusive power to transfer an element of control and attaches take-free rules to qualifying purchasers. Both make transfer the point of maximum risk in any control model, and both require the register to prevent double disposition rather than merely record it.", "source_refs": [ "SRC-006", "SRC-019", "SRC-013" ], "layers": [ { "id": "conveyance", "name": "Conveyance", "description": "Voluntary transfer of control between parties, its instrument, its exclusivity guarantee and its validity.", "source_refs": [ "SRC-006", "SRC-019", "SRC-013" ], "findings": [ { "id": "transfer-instrument-execution", "name": "Transfer instrument and execution", "description": "A transfer is an event with an instrument, named parties, conditions precedent and at least three distinct times: when the instrument was executed, when the transfer took legal or operational effect, and when the register recorded it. Conflating them makes backdating undetectable and makes it impossible to answer who held the object at a past instant.", "source_refs": [ "SRC-006", "SRC-013", "SRC-019" ], "questions": [ { "id": "q-transfer-parties", "text": "Which parties transfer and receive control, in which modality, and over which extent of the object?", "kind": "event", "answer_data": [ "transferor references", "transferee references", "transferred modality", "transferred extent or fraction" ] }, { "id": "q-transfer-times", "text": "When was the instrument executed, when did the transfer take effect, and when was it recorded?", "kind": "temporal", "answer_data": [ "execution timestamp (RFC 3339)", "effective timestamp (RFC 3339)", "recorded timestamp (RFC 3339)", "backdating flag" ] }, { "id": "q-transfer-conditions", "text": "What conditions precedent must be satisfied before the transfer takes effect, and which remain outstanding?", "kind": "constraint", "answer_data": [ "condition list with satisfaction status", "consent requirements (encumbrance holders, co-holders, authorities)", "outstanding condition count" ] }, { "id": "q-transfer-consideration", "text": "Is the transfer for consideration, gratuitous, or an administrative reassignment, and is that fact relevant to its reversibility?", "kind": "classification", "answer_data": [ "transfer character (for-consideration | gratuitous | administrative | involuntary)", "reversibility rule", "reference to the settlement record held elsewhere" ] } ], "data_elements": [ { "id": "de-transfer-effective-at", "name": "Transfer effective at", "description": "RFC 3339 instant at which control actually moved, independent of when it was recorded.", "value_kind": "timestamp", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-006", "SRC-013" ] }, { "id": "de-transfer-recorded-at", "name": "Transfer recorded at", "description": "RFC 3339 instant of ingestion into the register, always recorded separately from the effective instant.", "value_kind": "timestamp", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-013", "SRC-012" ] }, { "id": "de-condition-precedent", "name": "Condition precedent", "description": "A condition that must be satisfied before the transfer becomes effective, with its satisfaction status.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-019", "SRC-013" ] }, { "id": "de-transfer-character", "name": "Transfer character", "description": "Whether the transfer is for consideration, gratuitous, administrative or involuntary.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-013", "SRC-019" ] } ], "artifacts": [ { "id": "art-transfer-instrument", "name": "Transfer instrument", "description": "The executed instrument conveying control, naming parties, modality, extent, conditions precedent and execution particulars.", "media_or_form": [ "executed deed or agreement", "electronic transferable record", "administrative transfer order" ], "serial": false, "identity_strategy": "Instrument number issued by the competent register or notary; otherwise a governed IRI plus a content digest. Where the instrument is itself an electronic transferable record, its own control identifier governs and must not be duplicated.", "source_refs": [ "SRC-006", "SRC-019", "SRC-013" ] } ], "inline_only_rationale": null }, { "id": "exclusivity-and-double-transfer", "name": "Exclusivity and double-transfer prevention", "description": "MLETR requires a reliable method establishing exclusive control by a single person and identifying that person; UCC Article 12 defines control as including the exclusive power to prevent others from availing themselves of the benefit and the exclusive power to transfer. Operationally this means the register must guarantee a single authoritative position per object-and-modality at every instant, detect and reject concurrent dispositions, and be able to prove which of two competing transfers came first.", "source_refs": [ "SRC-006", "SRC-019" ], "questions": [ { "id": "q-exclusivity-method", "text": "What reliable method establishes that exactly one party is in control of this object in this modality at this instant?", "kind": "validation", "answer_data": [ "exclusivity mechanism description", "single-authoritative-instance guarantee", "reliability assessment and its assessor" ] }, { "id": "q-exclusivity-concurrent", "text": "How are two concurrent transfer attempts on the same object detected, ordered and resolved?", "kind": "process", "answer_data": [ "concurrency control mechanism", "ordering key and its source of truth", "rejection response and notification" ] }, { "id": "q-exclusivity-fork", "text": "If the register forks or is replicated, which replica is authoritative and how is a divergent branch reconciled?", "kind": "exception", "answer_data": [ "authoritative replica designation", "divergence detection signal", "reconciliation procedure and its authority" ] }, { "id": "q-exclusivity-copies", "text": "How is a non-authoritative copy of the object or its instrument marked so it cannot be presented as the controlled instance?", "kind": "security", "answer_data": [ "copy marking method", "authoritative-instance indicator", "verification instruction for counterparties" ] } ], "data_elements": [ { "id": "de-exclusivity-mechanism", "name": "Exclusivity mechanism", "description": "The reliable method by which exclusive control is established and the controller identified.", "value_kind": "text", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-006", "SRC-019" ] }, { "id": "de-ordering-key", "name": "Disposition ordering key", "description": "The monotonic key that establishes which of two competing dispositions is first, with its source of truth.", "value_kind": "identifier", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-006" ] }, { "id": "de-authoritative-instance", "name": "Authoritative instance indicator", "description": "Marker distinguishing the controlled instance from non-authoritative copies.", "value_kind": "boolean", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-006", "SRC-019" ] } ], "artifacts": [], "inline_only_rationale": "Exclusivity is a property of the register's operation rather than a document. It is evidenced through the ordering key and rejection events already captured in the audit model and in art-chain-of-title-extract; minting a separate 'exclusivity certificate' would assert a guarantee no source supports as a standalone artifact." }, { "id": "transfer-validity-and-acquisition", "name": "Transfer validity and good-faith acquisition", "description": "Not every executed transfer is a valid one. UCC Article 12's qualifying-purchaser rules show that a system may protect a good-faith acquirer even against a defect upstream, which means a control record must be able to represent a transfer that is void, voidable, or valid-but-defective, and must record whether downstream acquirers are protected. Silently deleting a bad transfer destroys the very evidence needed to resolve the consequences.", "source_refs": [ "SRC-019", "SRC-006", "SRC-013" ], "questions": [ { "id": "q-validity-status", "text": "Is this transfer valid, void, voidable or subject to a pending challenge, and on what ground?", "kind": "state", "answer_data": [ "validity status", "defect ground", "challenging party reference", "challenge status" ] }, { "id": "q-validity-downstream", "text": "If a transfer is set aside, which downstream transfers and encumbrances are affected, and which acquirers are protected?", "kind": "relationship", "answer_data": [ "affected downstream record references", "protection rule applied", "protected acquirer determinations" ] }, { "id": "q-validity-remedy", "text": "How is an invalid transfer corrected — by reversal entry, annulment or restitution — and is the original entry preserved?", "kind": "process", "answer_data": [ "correction mechanism", "reversal record reference", "original-entry preservation flag" ] } ], "data_elements": [ { "id": "de-transfer-validity", "name": "Transfer validity status", "description": "Valid, void, voidable, or under challenge, with the defect ground where applicable.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-019", "SRC-013" ] }, { "id": "de-acquirer-protection", "name": "Acquirer protection determination", "description": "Whether a downstream acquirer is protected against an upstream defect, and under which rule.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-019" ] }, { "id": "de-reversal-ref", "name": "Reversal record reference", "description": "Reference to the compensating entry that reverses an invalid transfer without deleting it.", "value_kind": "reference", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-013", "SRC-012" ] } ], "artifacts": [ { "id": "art-annulment-or-reversal-entry", "name": "Annulment or reversal entry", "description": "A compensating register entry recording that a prior transfer is void, voided or reversed, citing the authority for that determination and preserving the original entry.", "media_or_form": [ "append-only register entry", "court or authority order reference", "signed structured correction" ], "serial": true, "identity_strategy": "Own record identifier in the register's identity scheme, linked to the annulled record identifier. Never reuses or overwrites the annulled entry's identifier.", "source_refs": [ "SRC-019", "SRC-013" ] } ], "inline_only_rationale": null } ] }, { "id": "succession-and-lapse", "name": "Succession, Lapse and Chain of Title", "description": "Involuntary movement of control on death, dissolution, abandonment or lapse, and the reconstruction of the full history of a holding.", "source_refs": [ "SRC-013", "SRC-010", "SRC-012", "SRC-015" ], "findings": [ { "id": "succession-dissolution-lapse", "name": "Succession, dissolution and lapse", "description": "Control can move without any act of the holder: on death, on dissolution of a legal person, on expiry of a term, on abandonment, or by operation of law to the state. CRPD Article 12(5) requires equal rights to own and inherit property and protection against arbitrary deprivation, which constrains how a lapse may be declared. An interim state — estate in administration, holder deceased but successor undetermined — must be representable, because forcing an immediate successor invents a fact.", "source_refs": [ "SRC-010", "SRC-013", "SRC-015" ], "questions": [ { "id": "q-succession-trigger", "text": "What event opened the succession or lapse — death, dissolution, term expiry, abandonment or operation of law?", "kind": "event", "answer_data": [ "trigger event type", "trigger event timestamp (RFC 3339)", "evidencing source reference" ] }, { "id": "q-succession-interim", "text": "Who, if anyone, controls the object between the trigger event and the vesting of a successor?", "kind": "state", "answer_data": [ "interim state code (in-administration | vacant | held-by-administrator)", "administrator or personal representative reference", "interim powers and limits" ] }, { "id": "q-succession-vesting", "text": "By what rule does control vest in the successor, and when does vesting take effect relative to the trigger?", "kind": "process", "answer_data": [ "vesting rule (testamentary | intestate | contractual | statutory | escheat)", "vesting effective timestamp", "retroactivity treatment" ] }, { "id": "q-succession-abandonment", "text": "Before declaring abandonment or lapse, what diligent search was performed and over what period?", "kind": "evidence", "answer_data": [ "search steps performed", "search period start and end", "search outcome", "declaring authority" ] } ], "data_elements": [ { "id": "de-succession-trigger", "name": "Succession trigger", "description": "The event that opened a succession, lapse or escheat.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-013", "SRC-010" ] }, { "id": "de-interim-state", "name": "Interim control state", "description": "The representable state between trigger and vesting, so that no successor is invented.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-013" ] }, { "id": "de-diligent-search", "name": "Diligent search record", "description": "Steps, period and outcome of the search for a holder before any abandonment or lapse declaration.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-010", "SRC-015" ] } ], "artifacts": [ { "id": "art-succession-notice", "name": "Succession notice", "description": "The record opening a succession or lapse, naming the trigger event, the interim controller and the vesting rule to be applied.", "media_or_form": [ "register notice", "administrator's grant or appointment reference", "structured event record" ], "serial": false, "identity_strategy": "Grant or administrative order reference from the competent authority; otherwise a governed IRI tied to the control record. The deceased holder's identifier is never reused for the successor.", "source_refs": [ "SRC-013", "SRC-010" ] } ], "inline_only_rationale": null }, { "id": "chain-of-title-reconstruction", "name": "Chain of title reconstruction", "description": "dcterms:provenance defines exactly this: a statement of changes in ownership and custody significant for authenticity, integrity and interpretation. An agent must be able to reconstruct, for any past instant, who held the object and under what basis, and to detect where the chain has a gap, an overlap or an unevidenced link — because a chain that silently interpolates is worse than one that admits a hole.", "source_refs": [ "SRC-012", "SRC-013", "SRC-003" ], "questions": [ { "id": "q-chain-asof", "text": "Who held this object in a given modality at a specified past instant, and on what basis?", "kind": "temporal", "answer_data": [ "as-of timestamp (RFC 3339)", "holder set at that instant", "basis and source at that instant", "reconstruction confidence" ] }, { "id": "q-chain-gaps", "text": "Where does the chain have gaps, overlaps or links with no evidencing source?", "kind": "quality", "answer_data": [ "gap intervals", "overlap intervals", "unevidenced link references", "completeness score" ] }, { "id": "q-chain-root", "text": "What is the earliest recorded control position, and is it a genuine origin or merely the register's own start date?", "kind": "provenance", "answer_data": [ "root record reference", "root type (original acquisition | register inception | migrated-in)", "pre-register evidence if any" ] }, { "id": "q-chain-migration", "text": "For links inherited from a predecessor register or migration, what mapping and loss occurred?", "kind": "interoperability", "answer_data": [ "source system reference", "migration mapping notes", "fields lost or approximated", "migration timestamp" ] } ], "data_elements": [ { "id": "de-chain-completeness", "name": "Chain completeness", "description": "Assessment of gaps, overlaps and unevidenced links in the reconstructed chain of control.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-012", "SRC-013" ] }, { "id": "de-root-record-type", "name": "Root record type", "description": "Whether the earliest link is an original acquisition, the register's inception, or a migrated record.", "value_kind": "code", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-012", "SRC-013" ] }, { "id": "de-migration-provenance", "name": "Migration provenance", "description": "Source system, mapping and known loss for records inherited from a predecessor register.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-012", "SRC-003" ] } ], "artifacts": [ { "id": "art-chain-of-title-extract", "name": "Chain of title extract", "description": "The ordered transfer history of one object with bases, effective and recorded times, and explicit gap and overlap markers; omits the parties' unrelated holdings.", "media_or_form": [ "ordered register extract", "signed history document", "graph projection" ], "serial": true, "identity_strategy": "Control record identifier plus issuance sequence and an RFC 3339 as-of timestamp, because the extract is an assertion about state at an instant and will differ if reissued after a correction.", "source_refs": [ "SRC-012", "SRC-013" ] } ], "inline_only_rationale": null }, { "id": "involuntary-deprivation-and-lapse-events", "name": "Involuntary and abandonment events", "description": "FAO VGGT requires States to safeguard legitimate tenure rights against arbitrary loss including forced evictions, and treats expropriation among transfers and other changes. HCCH Article 11 ring-fences trust assets from the trustee's insolvency; Article 15(e)–(f) preserves insolvency-creditor protection and good-faith third-party rules, which may defeat a trust or a transfer. FATF notes misuse of corporate vehicles for sanctions evasion; a freeze or confiscation is an exceptional restriction or transfer effect. Abandonment, bona vacantia, escheat and adverse possession are widely attested in domestic law but lack a single global primary instrument in this source set; they are recorded only as jurisdiction-tagged exceptional events, not as universal classes. Dispute procedure itself belongs to the courts model; this finding stores the resulting effect.", "source_refs": [ "SRC-025", "SRC-026", "SRC-024" ], "questions": [ { "id": "involuntary-deprivation-and-lapse-events-q01", "text": "What exceptional event affected which holdings, what is the effect on title, and which authority ordered it?", "kind": "event", "answer_data": [ "event-class: class", "affected-ownership-record-ids: holdings", "effect: effect", "authority-id: authority" ] }, { "id": "involuntary-deprivation-and-lapse-events-q02", "text": "In which jurisdiction is this event class recognised, and is it a universal mixin class or a tagged local doctrine?", "kind": "exception", "answer_data": [ "jurisdiction: jurisdiction", "universal-class-flag: universality" ] }, { "id": "involuntary-deprivation-and-lapse-events-q03", "text": "Does a good-faith third-party or insolvency-creditor rule under HCCH Article 15 defeat or qualify this holding or this trust?", "kind": "constraint", "answer_data": [ "art15-hit: whether Art 15(e) or (f) applies", "qualification: how title is qualified" ] } ], "data_elements": [ { "id": "involuntary-deprivation-and-lapse-events-data01", "name": "event-id", "description": "Exceptional event identifier.", "value_kind": "identifier", "cardinality": "1", "required": true, "source_refs": [ "SRC-025" ] }, { "id": "involuntary-deprivation-and-lapse-events-data02", "name": "event-class", "description": "expropriation, eviction, insolvency-ring-fence, freeze, confiscation, abandonment, bona-vacantia, adverse-possession, good-faith-acquisition, other-tagged.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-025", "SRC-026" ] }, { "id": "involuntary-deprivation-and-lapse-events-data03", "name": "jurisdiction", "description": "Jurisdiction tag; required for non-universal classes.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-025" ] }, { "id": "involuntary-deprivation-and-lapse-events-data04", "name": "authority-id", "description": "Ordering authority if any.", "value_kind": "reference", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-025" ] }, { "id": "involuntary-deprivation-and-lapse-events-data05", "name": "affected-ownership-record-ids", "description": "Holdings affected.", "value_kind": "reference", "cardinality": "1..n", "required": true, "source_refs": [ "SRC-026" ] }, { "id": "involuntary-deprivation-and-lapse-events-data06", "name": "effect", "description": "title-rewritten, restriction-imposed, ring-fenced, claim-opened.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-026" ] }, { "id": "involuntary-deprivation-and-lapse-events-data07", "name": "event-time", "description": "When the effect occurred.", "value_kind": "timestamp", "cardinality": "1", "required": true, "source_refs": [ "SRC-026" ] }, { "id": "involuntary-deprivation-and-lapse-events-data08", "name": "universal-class-flag", "description": "False if recorded only as a tagged gap class.", "value_kind": "boolean", "cardinality": "1", "required": true, "source_refs": [ "SRC-025" ] } ], "artifacts": [ { "id": "involuntary-deprivation-and-lapse-events-artifact01", "name": "Exceptional effect record", "description": "Jurisdiction-tagged record of an involuntary or abandonment effect on title, pointing at the ordering instrument without storing court procedure.", "media_or_form": [ "record" ], "serial": true, "identity_strategy": "Master-system identifier of the ordering authority's file, else governed IRI, else Dimension-assigned UUID or ULID.", "source_refs": [ "SRC-025", "SRC-026" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "assurance", "name": "State, Time, Evidence and Contestation", "description": "The lifecycle states of a control assertion, its temporal semantics, the evidence and assurance behind it, and the handling of competing claims.", "rationale": "LADM derives its classes from a versioned object and binds each to a source; AMLR imposes an adequate/accurate/up-to-date standard; VGGT recognises legitimate but unrecorded tenure. Together these establish that a control record is a dated, sourced, fallible assertion whose confidence and contestation status must be explicit rather than assumed.", "source_refs": [ "SRC-013", "SRC-009", "SRC-015", "SRC-012" ], "layers": [ { "id": "state-and-time", "name": "State and Temporal Semantics", "description": "Lifecycle states of a control assertion and the separation of event, effective, observation and record time.", "source_refs": [ "SRC-013", "SRC-012", "SRC-006" ], "findings": [ { "id": "control-record-lifecycle-states", "name": "Control record lifecycle states", "description": "A control assertion moves through determinate states — proposed, pending conditions, effective, suspended, disputed, superseded, terminated — with defined transitions and defined authorities for each transition. LADM's versioned-object foundation means a superseded state remains addressable rather than being erased. The state must be explicit so that an agent never treats a pending or disputed assertion as an operative one.", "source_refs": [ "SRC-013", "SRC-006", "SRC-019" ], "questions": [ { "id": "q-state-current", "text": "What is the current state of this control assertion, and which transition produced it?", "kind": "state", "answer_data": [ "state code", "transition event reference", "transition timestamp (RFC 3339)", "transitioning authority" ] }, { "id": "q-state-transitions", "text": "Which transitions are permitted from the current state, and who is authorised to make each?", "kind": "lifecycle", "answer_data": [ "permitted transition list", "authorised role per transition", "required preconditions per transition" ] }, { "id": "q-state-operative", "text": "Which states are operative for reliance purposes, and which must a relying agent refuse to act on?", "kind": "decision", "answer_data": [ "operative state set", "non-operative state set", "handling instruction for non-operative states" ] }, { "id": "q-state-suspension", "text": "What suspends a control assertion without terminating it, and what restores it?", "kind": "exception", "answer_data": [ "suspension trigger", "suspension authority", "restoration condition", "effect on subsisting mandates" ] } ], "data_elements": [ { "id": "de-record-state", "name": "Control record state", "description": "Current lifecycle state of the control assertion.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-013" ] }, { "id": "de-state-transition", "name": "State transition", "description": "The event, timestamp and authority that produced the current state.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-013", "SRC-003" ] }, { "id": "de-operative-flag", "name": "Operative for reliance", "description": "Whether a relying agent may act on this assertion in its current state.", "value_kind": "boolean", "cardinality": "1", "required": true, "source_refs": [ "SRC-006", "SRC-019" ] } ], "artifacts": [ { "id": "art-state-transition-log", "name": "State transition log", "description": "The append-only sequence of state transitions for a control assertion, each with timestamp, actor, authority and reason.", "media_or_form": [ "append-only event log", "register history section", "event stream projection" ], "serial": true, "identity_strategy": "Control record identifier plus a monotonic sequence number; each entry additionally carries an RFC 3339 timestamp with explicit offset. Entries are never rewritten, only compensated.", "source_refs": [ "SRC-013", "SRC-012" ] } ], "inline_only_rationale": null }, { "id": "temporal-semantics", "name": "Temporal semantics of control", "description": "Four times matter and must not be merged: when the underlying event occurred, from when the control is effective, when the register observed or ingested it, and when the record was written. LADM's versioned objects carry lifespan bounds for exactly this reason. All are RFC 3339 with seconds and an explicit offset or Z, because a local time without offset makes cross-jurisdiction ordering of competing dispositions undecidable.", "source_refs": [ "SRC-013", "SRC-006", "SRC-012" ], "questions": [ { "id": "q-time-interval", "text": "Over what interval is this control assertion effective, and is the end open or determinate?", "kind": "temporal", "answer_data": [ "effective from (RFC 3339)", "effective to (RFC 3339 or open)", "interval boundary inclusivity" ] }, { "id": "q-time-observation", "text": "When was this fact observed or ingested, and how far did it lag the event it records?", "kind": "temporal", "answer_data": [ "observation/ingestion timestamp (RFC 3339)", "event timestamp (RFC 3339)", "lag duration" ] }, { "id": "q-time-offset", "text": "Does every recorded timestamp carry seconds and an explicit UTC offset or Z, and what is the local civil-time context where it matters?", "kind": "validation", "answer_data": [ "offset presence check result", "originating time zone identifier", "civil-date interpretation note" ] }, { "id": "q-time-retroactive", "text": "Does this record change the past, and if so what was believed true before the retroactive change?", "kind": "provenance", "answer_data": [ "retroactivity flag", "prior belief snapshot reference", "reason for retroactive change" ] } ], "data_elements": [ { "id": "de-effective-from", "name": "Effective from", "description": "RFC 3339 instant from which the control assertion is effective, with seconds and explicit offset or Z.", "value_kind": "timestamp", "cardinality": "1", "required": true, "source_refs": [ "SRC-013" ] }, { "id": "de-effective-to", "name": "Effective to", "description": "RFC 3339 instant at which the assertion ceases to be effective; open where the holding continues.", "value_kind": "timestamp", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-013" ] }, { "id": "de-observed-at", "name": "Observed or ingested at", "description": "RFC 3339 instant at which the register observed or ingested the fact, always recorded separately from the event time.", "value_kind": "timestamp", "cardinality": "1", "required": true, "source_refs": [ "SRC-012", "SRC-013" ] }, { "id": "de-retroactive-flag", "name": "Retroactive change flag", "description": "Whether this version alters the previously recorded past state of control.", "value_kind": "boolean", "cardinality": "1", "required": true, "source_refs": [ "SRC-012" ] } ], "artifacts": [], "inline_only_rationale": "Temporal fields are intrinsic attributes of every other record and artifact in this model rather than a separable document. Emitting a standalone 'time record' would duplicate the state transition log and the chain-of-title extract without adding evidentiary value." } ] }, { "id": "evidence-and-assurance", "name": "Evidence and Assurance", "description": "What backs a control assertion and how much weight an agent may place on it.", "source_refs": [ "SRC-005", "SRC-009", "SRC-013", "SRC-012" ], "findings": [ { "id": "evidentiary-sources-and-attestation", "name": "Evidentiary sources and attestation", "description": "LADM binds every core class to a source; verifiable credentials give a machine-checkable attestation shape and make explicit that the party presenting an attestation is often not its subject. A control record must therefore distinguish the issuer of an attestation, the subject it concerns, the party presenting it, and the integrity data that lets a verifier check it was not altered.", "source_refs": [ "SRC-013", "SRC-005", "SRC-012" ], "questions": [ { "id": "q-evidence-issuer", "text": "Who issued each evidencing attestation, about which subject, and who presented it to the register?", "kind": "evidence", "answer_data": [ "issuer reference", "subject reference", "presenter reference", "issuer-subject-presenter divergence note" ] }, { "id": "q-evidence-integrity", "text": "What integrity data proves the evidencing source has not been altered since issuance?", "kind": "security", "answer_data": [ "digest algorithm and value", "signature or proof reference", "verification result and timestamp" ] }, { "id": "q-evidence-independence", "text": "Is the evidence independent of the party it benefits, or self-asserted?", "kind": "quality", "answer_data": [ "evidence independence class (authority-issued | third-party | counter-signed | self-asserted)", "corroborating sources", "weight assigned" ] }, { "id": "q-evidence-expiry", "text": "Does the evidencing source itself expire or require renewal, and what happens to the control record when it does?", "kind": "lifecycle", "answer_data": [ "source validity period", "renewal obligation", "downgrade rule on expiry" ] } ], "data_elements": [ { "id": "de-evidence-issuer", "name": "Evidence issuer", "description": "Party that issued an evidencing attestation, distinct from its subject and from the presenting party.", "value_kind": "reference", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-005", "SRC-013" ] }, { "id": "de-evidence-integrity", "name": "Evidence integrity data", "description": "Digest, signature or proof allowing a verifier to confirm the source is unaltered.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-005", "SRC-012" ] }, { "id": "de-evidence-independence", "name": "Evidence independence class", "description": "Whether the evidence is authority-issued, third-party, counter-signed or self-asserted.", "value_kind": "code", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-005", "SRC-013" ] } ], "artifacts": [ { "id": "art-attestation-of-control", "name": "Attestation of control", "description": "A verifiable, independently checkable statement by an authorised issuer that a named party holds control of a named object in a named modality over a stated interval.", "media_or_form": [ "verifiable credential", "notarised certificate", "authority-signed structured statement" ], "serial": false, "identity_strategy": "Issuer-scoped credential identifier as a governed IRI, bound to the issuer's verification method; re-issuance after a change mints a new identifier and links the superseded one rather than reusing it.", "source_refs": [ "SRC-005", "SRC-001", "SRC-013" ] } ], "inline_only_rationale": null }, { "id": "assurance-and-currency", "name": "Assurance level and currency", "description": "AMLR's requirement that beneficial ownership information be adequate, accurate and up to date generalises: every control assertion needs a stated assurance level, a last-verified time, and a staleness policy. VGGT's recognition of informal and customary tenure means low assurance must be an honest recorded value, not grounds for treating a holding as non-existent.", "source_refs": [ "SRC-009", "SRC-015", "SRC-005" ], "questions": [ { "id": "q-assurance-level", "text": "What assurance level does this control assertion carry, and what evidence and verification method produced it?", "kind": "quality", "answer_data": [ "assurance level code", "verification method used", "verifying party", "assurance rationale" ] }, { "id": "q-assurance-staleness", "text": "When was the assertion last verified, and by what date does it become stale for reliance purposes?", "kind": "temporal", "answer_data": [ "last verified timestamp (RFC 3339)", "staleness threshold", "current staleness status" ] }, { "id": "q-assurance-lowconfidence", "text": "For informal, customary or unregistered holdings, how is low assurance recorded without implying the holding is invalid?", "kind": "exception", "answer_data": [ "informal-holding marker", "recognition status", "explicit non-invalidity statement" ] } ], "data_elements": [ { "id": "de-assurance-level", "name": "Assurance level", "description": "Stated confidence in the control assertion, with the verification method that produced it.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-009", "SRC-005" ] }, { "id": "de-last-verified-at", "name": "Last verified at", "description": "RFC 3339 timestamp of the most recent verification of the assertion.", "value_kind": "timestamp", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-009" ] }, { "id": "de-staleness-threshold", "name": "Staleness threshold", "description": "Maximum age after which the assertion must be re-verified before reliance.", "value_kind": "duration", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-009" ] } ], "artifacts": [ { "id": "art-assurance-review-report", "name": "Assurance review report", "description": "The periodic report over a population of control records showing assurance levels, staleness distribution, unverified assertions and remediation actions.", "media_or_form": [ "periodic report", "structured quality dataset", "dashboard projection" ], "serial": true, "identity_strategy": "Register identifier plus reporting-period key expressed as an RFC 3339 interval; reports are immutable once issued so that improvement or decay over time is provable.", "source_refs": [ "SRC-009", "SRC-017" ] } ], "inline_only_rationale": null } ] }, { "id": "contestation", "name": "Contestation", "description": "Competing claims over the same object and their resolution status.", "source_refs": [ "SRC-013", "SRC-015", "SRC-019" ], "findings": [ { "id": "competing-claims-and-dispute-status", "name": "Competing claims and dispute status", "description": "Because a register records assertions rather than facts, two irreconcilable claims can coexist. VGGT's recognition of overlapping customary and formal tenure makes this normal rather than exceptional. The model must hold both claims, mark the object as contested, apply a stated priority rule where one exists, and ingest an outcome reference from the dispute model without itself adjudicating.", "source_refs": [ "SRC-015", "SRC-013", "SRC-019" ], "questions": [ { "id": "q-claims-competing", "text": "Which claims over this object are irreconcilable, and in what respect do they conflict?", "kind": "relationship", "answer_data": [ "competing claim references", "conflict dimension (holder | modality | extent | share | priority)", "overlap description" ] }, { "id": "q-claims-priority", "text": "Is there a stated priority rule between the competing claims, and what does it yield?", "kind": "constraint", "answer_data": [ "priority rule reference", "rule outcome", "provisional preferred claim", "rule-absent flag" ] }, { "id": "q-claims-effect", "text": "While contested, which operations on the object are frozen, permitted or permitted only with notice?", "kind": "constraint", "answer_data": [ "frozen operation set", "permitted operation set", "notice obligations to counterparties" ] }, { "id": "q-claims-outcome", "text": "How is a resolution ingested from the dispute forum, and what does it change in the control record?", "kind": "process", "answer_data": [ "outcome reference and forum", "resulting record changes", "effective date of the outcome", "residual appeal status" ] } ], "data_elements": [ { "id": "de-contested-flag", "name": "Contested", "description": "Whether the object's control is currently subject to irreconcilable competing claims.", "value_kind": "boolean", "cardinality": "1", "required": true, "source_refs": [ "SRC-015", "SRC-013" ] }, { "id": "de-competing-claim", "name": "Competing claim", "description": "A claim over the object that cannot be reconciled with the recorded assertion, with its claimant, basis and conflict dimension.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-015", "SRC-013" ] }, { "id": "de-dispute-outcome-ref", "name": "Dispute outcome reference", "description": "Reference to the adjudicated outcome ingested from the dispute resolution model.", "value_kind": "reference", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-013" ] }, { "id": "de-frozen-operations", "name": "Frozen operations", "description": "Operations suspended while the object is contested.", "value_kind": "collection", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-019", "SRC-006" ] } ], "artifacts": [ { "id": "art-contested-claim-notice", "name": "Contested claim notice", "description": "A public or counterparty-facing notice that control of a named object is contested, stating what is frozen and where the dispute is pending, without stating who is right.", "media_or_form": [ "register caveat or notice", "counterparty alert message", "structured status flag on extracts" ], "serial": true, "identity_strategy": "Register-issued notice number where available; otherwise control record identifier plus notice sequence. Withdrawal of a notice is a new serial entry, never a deletion.", "source_refs": [ "SRC-013", "SRC-015" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "register-governance", "name": "Governance of the Control Register", "description": "The authority that maintains control records, who may read them, what must be retained or erased, and how the model aligns to external standards.", "rationale": "A control register is itself a controlled object with an authority, an access regime and a retention regime. The CJEU's invalidation of general public access to beneficial ownership data, GDPR's portability right, and ISO/IEC 27002's ownership reassignment requirement all constrain how such a register may operate; these constraints are normative, not implementation detail.", "source_refs": [ "SRC-018", "SRC-007", "SRC-017", "SRC-013" ], "layers": [ { "id": "register-authority", "name": "Register Authority and Access", "description": "Who maintains the register, what its recording confers, and who may see what.", "source_refs": [ "SRC-013", "SRC-018", "SRC-007", "SRC-016" ], "findings": [ { "id": "register-authority-and-competence", "name": "Register authority and competence", "description": "A control register has a maintaining authority whose competence is bounded by object class, jurisdiction and modality. NIST's information owner is defined by statutory or operational authority; LADM presumes a land administration authority. Where an object falls outside the register's competence, its records are at best evidentiary, and the register must say so rather than presenting them as authoritative.", "source_refs": [ "SRC-016", "SRC-013", "SRC-006" ], "questions": [ { "id": "q-authority-who", "text": "Which authority maintains this register, over which object classes, modalities and territory?", "kind": "authority", "answer_data": [ "maintaining authority reference", "competence scope (object classes, modalities, territory)", "instrument conferring competence" ] }, { "id": "q-authority-effect", "text": "What does an entry in this register confer — constitutive effect, a rebuttable presumption, or evidence only?", "kind": "authority", "answer_data": [ "register effect code", "rebuttal procedure", "reliance guidance for third parties" ] }, { "id": "q-authority-outside", "text": "How are records outside the register's competence marked, and what may an agent infer from them?", "kind": "exception", "answer_data": [ "out-of-competence marker", "inference limitation statement", "authoritative register pointer where known" ] }, { "id": "q-authority-overlap", "text": "Where two registers claim competence over the same object, which prevails and how is the conflict surfaced?", "kind": "interoperability", "answer_data": [ "overlapping register references", "precedence rule or absence thereof", "conflict disclosure on extracts" ] } ], "data_elements": [ { "id": "de-maintaining-authority", "name": "Maintaining authority", "description": "The body responsible for the register, with the instrument conferring its competence.", "value_kind": "reference", "cardinality": "1", "required": true, "source_refs": [ "SRC-016", "SRC-013" ] }, { "id": "de-register-effect", "name": "Register effect", "description": "Whether an entry is constitutive, presumptive or evidentiary only.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-013", "SRC-006" ] }, { "id": "de-competence-scope", "name": "Competence scope", "description": "Object classes, modalities and territory within which the register is authoritative.", "value_kind": "object", "cardinality": "1", "required": true, "source_refs": [ "SRC-016", "SRC-013" ] } ], "artifacts": [ { "id": "art-register-charter", "name": "Register charter", "description": "The constitutional statement of the register: maintaining authority, competence scope, recording effect, correction procedure and appeal route.", "media_or_form": [ "charter or governing instrument", "published register policy", "AGENTS.md-referenced specification document" ], "serial": true, "identity_strategy": "Governed IRI under the maintaining authority's namespace with an explicit semantic version; each amendment is a new version with an RFC 3339 effective date, since the charter determines how prior entries must be read.", "source_refs": [ "SRC-016", "SRC-013" ] } ], "inline_only_rationale": null }, { "id": "control-data-access-and-disclosure", "name": "Control data access and disclosure", "description": "Ownership data is not inherently public. The CJEU held that giving the general public access to beneficial ownership information is a serious and disproportionate interference with Charter Articles 7 and 8, since a legitimate-interest regime achieves comparable results. The register must therefore default to restricted access, define disclosure tiers, apply a legitimate-interest test, and log privileged reads — while still supporting the minimal current-holder extract a counterparty genuinely needs.", "source_refs": [ "SRC-018", "SRC-007", "SRC-012", "SRC-009" ], "questions": [ { "id": "q-access-tier", "text": "Which audience tiers may read which layers of the control record, and what is the default for an unclassified requester?", "kind": "access", "answer_data": [ "audience tier definitions", "readable layers per tier", "default deny statement" ] }, { "id": "q-access-interest", "text": "How is a requester's legitimate interest established and recorded before privileged disclosure?", "kind": "privacy", "answer_data": [ "legitimate interest test criteria", "requester declaration", "assessment outcome and assessor" ] }, { "id": "q-access-minimisation", "text": "What is the minimum disclosure that satisfies a given purpose — current holder only, or the full record?", "kind": "privacy", "answer_data": [ "purpose code", "minimal projection for that purpose", "fields withheld" ] }, { "id": "q-access-logging", "text": "Which reads are logged, with what detail, and for how long is the read log kept?", "kind": "security", "answer_data": [ "logged read categories", "log fields", "log retention period", "log access rules" ] } ], "data_elements": [ { "id": "de-disclosure-tier", "name": "Disclosure tier", "description": "Audience class permitted to read a given layer of the control record; defaults to the most restricted tier.", "value_kind": "code", "cardinality": "1..n", "required": true, "source_refs": [ "SRC-018", "SRC-007" ] }, { "id": "de-legitimate-interest-record", "name": "Legitimate interest record", "description": "The declared purpose, assessment and outcome permitting a privileged disclosure.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-018" ] }, { "id": "de-read-log-entry", "name": "Read log entry", "description": "Record of a privileged read: requester, purpose, fields returned and RFC 3339 timestamp.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-007", "SRC-018" ] } ], "artifacts": [ { "id": "art-disclosure-policy", "name": "Disclosure policy", "description": "The published mapping from audience tier and purpose to permitted projection over control records, including the legitimate-interest test and the redaction rules for public projections.", "media_or_form": [ "published policy document", "machine-readable policy expression", "projection specification" ], "serial": true, "identity_strategy": "Governed IRI with semantic version and an RFC 3339 effective date; disclosures must cite the policy version in force at the moment of disclosure, so versions are immutable once effective.", "source_refs": [ "SRC-018", "SRC-004", "SRC-007" ] } ], "inline_only_rationale": null } ] }, { "id": "continuity", "name": "Retention, Deletion and Interoperability", "description": "How long control history is kept against erasure and portability rights, and how the model maps onto external standards without overclaiming conformance.", "source_refs": [ "SRC-007", "SRC-012", "SRC-013", "SRC-004" ], "findings": [ { "id": "retention-archival-and-deletion", "name": "Retention, archival and deletion", "description": "Control history and personal-data rights pull in opposite directions. dcterms:provenance treats the ownership and custody chain as essential to authenticity, and a chain with holes cannot support reliance; GDPR nonetheless grants rectification and, in defined circumstances, erasure. The resolution is explicit: define which elements are permanent register content, which are erasable identifying attributes held by reference in the party model, and use tombstoning rather than physical deletion of links.", "source_refs": [ "SRC-012", "SRC-007", "SRC-013" ], "questions": [ { "id": "q-retention-period", "text": "How long is each class of control record retained, and what legal or operational basis sets that period?", "kind": "retention", "answer_data": [ "record class", "retention period", "basis for the period", "disposition action at end of period" ] }, { "id": "q-retention-erasure", "text": "When a party exercises an erasure or rectification right, which elements can be removed and which must survive as an anonymised or tombstoned link?", "kind": "retention", "answer_data": [ "erasable element set", "non-erasable element set with justification", "tombstone representation", "residual linkage risk" ] }, { "id": "q-retention-integrity", "text": "How is chain integrity preserved when an intermediate record is redacted or tombstoned?", "kind": "quality", "answer_data": [ "integrity preservation method", "gap marker semantics", "effect on reconstruction confidence" ] }, { "id": "q-retention-archive", "text": "On decommissioning of the register, who takes custody of the historical control records and under what terms?", "kind": "lifecycle", "answer_data": [ "successor custodian reference", "custody transfer instrument", "continued access terms", "transfer timestamp" ] } ], "data_elements": [ { "id": "de-retention-period", "name": "Retention period", "description": "Duration for which a class of control record is retained, with the basis for that duration.", "value_kind": "duration", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-007", "SRC-012" ] }, { "id": "de-tombstone", "name": "Tombstone marker", "description": "Representation of a redacted or erased element that preserves chain continuity without retaining the erased content.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-007", "SRC-012" ] }, { "id": "de-successor-custodian", "name": "Successor custodian", "description": "Party taking custody of historical control records on decommissioning of the register.", "value_kind": "reference", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-012", "SRC-007" ] } ], "artifacts": [ { "id": "art-retention-schedule", "name": "Retention and disposition schedule", "description": "The schedule mapping each control record class to its retention period, basis, permitted redactions and end-of-life disposition.", "media_or_form": [ "retention schedule document", "machine-readable disposition rules", "register policy annexe" ], "serial": true, "identity_strategy": "Governed IRI with semantic version and RFC 3339 effective date; disposition actions must cite the schedule version under which they were taken.", "source_refs": [ "SRC-007", "SRC-012" ] } ], "inline_only_rationale": null }, { "id": "interoperability-and-alignment", "name": "Interoperability and standards alignment", "description": "The model aligns with, rather than conforms to, external standards: LADM's party/RRR/administrative-unit pattern, PROV's attribution and delegation, ODRL's assigner/assignee and duty, CID's controller and capability relationships, and dcterms' rightsHolder and provenance. Each alignment is partial and each has a known conflict; claiming conformance without a tested profile and evidence would be false. Portability under GDPR Article 20 also requires an export shape that a receiving system can actually ingest.", "source_refs": [ "SRC-013", "SRC-003", "SRC-004", "SRC-001", "SRC-012", "SRC-007" ], "questions": [ { "id": "q-interop-mapping", "text": "For each external standard, which elements of this model map, which map only partially, and which have no counterpart?", "kind": "interoperability", "answer_data": [ "target standard and version", "mapped element pairs", "partial mappings with loss notes", "unmapped elements" ] }, { "id": "q-interop-conflict", "text": "Where does an external standard's semantics conflict with this model's, and which prevails in an export?", "kind": "interoperability", "answer_data": [ "conflict description", "resolution rule", "warning emitted on export" ] }, { "id": "q-interop-conformance", "text": "Is a conformance claim to any external standard being made, and what test evidence supports it?", "kind": "validation", "answer_data": [ "conformance claim status (alignment-only | profiled | tested-conformant)", "test suite and results reference", "date of last test" ] }, { "id": "q-interop-portability", "text": "What export shape lets a holder move their control records to another system in a structured, machine-readable form?", "kind": "interoperability", "answer_data": [ "export format and schema reference", "included and excluded elements", "receiving-system requirements" ] } ], "data_elements": [ { "id": "de-alignment-target", "name": "Alignment target", "description": "External standard and version to which an element of this model is aligned, with the alignment strength.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-013", "SRC-003", "SRC-004", "SRC-001" ] }, { "id": "de-conformance-claim", "name": "Conformance claim status", "description": "Whether only alignment is asserted, a profile exists, or tested conformance is claimed with evidence.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-004", "SRC-001" ] }, { "id": "de-export-shape", "name": "Export shape reference", "description": "Reference to the structured, machine-readable export schema used for portability.", "value_kind": "reference", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-007" ] } ], "artifacts": [ { "id": "art-alignment-crosswalk", "name": "Alignment crosswalk", "description": "Element-by-element mapping table between this model and LADM, PROV-O, ODRL, CID/DID, VC and DCMI terms, with strength, loss and conflict annotations per pair.", "media_or_form": [ "crosswalk table", "machine-readable mapping set", "published alignment report" ], "serial": true, "identity_strategy": "Governed IRI plus semantic version and the pinned versions of every target standard; a crosswalk is only meaningful against specific standard versions, so target versions form part of the artifact's identity.", "source_refs": [ "SRC-013", "SRC-003", "SRC-004", "SRC-001", "SRC-012" ] } ], "inline_only_rationale": null } ] } ] } ] }, "functions": [ { "id": "anchor-controllable-object", "name": "Anchor a controllable object", "description": "Admit a meta-object into the control register by recording its reference, controllability class, extent and registration basis, making it capable of bearing control assertions.", "inputs": [ "object reference", "object kind", "proposed controllability class", "registration basis and source", "requesting party" ], "outputs": [ "control anchor record", "assigned control record identifier", "controllability determination" ], "preconditions": [ "object reference resolves to a canonical instance", "register competence covers the object class and territory", "requesting party is authorised to lodge an anchor" ], "effects": [ "object becomes addressable by subsequent control assertions", "objectAnchored event emitted with RFC 3339 event and ingestion timestamps", "non-controllable determination recorded as a refusal with reasons rather than a silent drop" ], "source_refs": [ "SRC-013", "SRC-006", "SRC-019", "SRC-001" ] }, { "id": "assert-control-position", "name": "Assert a control position", "description": "Record that one or more parties hold a referenced object in a stated modality, with basis, shares, encumbrances, validity interval and assurance level.", "inputs": [ "control anchor reference", "holder party references and roles", "control modality", "basis and evidencing sources", "share schedule where co-held", "effective interval" ], "outputs": [ "control record", "assurance level determination", "validation report" ], "preconditions": [ "anchor exists and is operative", "modality is present in the governed modality vocabulary", "shares sum correctly for the stated extent", "asserting party has standing under the register charter" ], "effects": [ "control record created in state effective or pending-conditions", "prior overlapping assertion superseded and retained as addressable", "controlAsserted event emitted" ], "source_refs": [ "SRC-013", "SRC-007", "SRC-009", "SRC-016" ] }, { "id": "resolve-current-controller", "name": "Resolve the current controller", "description": "Return the operative holder or controller of a named object in a named modality at a given instant, with the minimum disclosure the requester's purpose requires.", "inputs": [ "object reference", "control modality", "as-of timestamp", "requester identity and declared purpose" ], "outputs": [ "current holder extract", "assurance and staleness indicators", "contested-status flag" ], "preconditions": [ "requester passes the disclosure test for the requested projection", "as-of timestamp carries an explicit offset or Z" ], "effects": [ "read logged where the projection is privileged", "no mutation of the control record", "extract issued as a serial artifact with its own as-of timestamp" ], "source_refs": [ "SRC-013", "SRC-018", "SRC-012" ] }, { "id": "verify-delegated-authority", "name": "Verify delegated authority", "description": "Determine whether a claimed delegate holds live, in-scope, unrevoked authority to perform a specific act over a specific object, and record the verification as counterparty evidence.", "inputs": [ "mandate reference or presented capability", "proposed act and object extent", "verification instant", "verifier identity" ], "outputs": [ "verification outcome", "scope match detail", "mandate verification record", "attribution mode determination" ], "preconditions": [ "mandate resolves and its issuing control position is operative", "status source is reachable, or a declared offline method with a stated staleness bound is used" ], "effects": [ "verification record persisted immutably", "chain containment checked against the issuing position", "excess-scope attempts recorded as refusals with reasons" ], "source_refs": [ "SRC-001", "SRC-011", "SRC-004", "SRC-005" ] }, { "id": "execute-transfer-of-control", "name": "Execute a transfer of control", "description": "Move control of an object from transferor to transferee under an instrument, enforcing exclusivity, conditions precedent and required consents.", "inputs": [ "transfer instrument", "transferor and transferee references", "transferred modality and extent", "consents from encumbrance holders and co-holders", "execution and intended effective timestamps" ], "outputs": [ "new control record for the transferee", "superseded record for the transferor", "transfer event", "updated chain of title" ], "preconditions": [ "transferor's position is operative and not frozen by a contested-claim notice", "all conditions precedent are satisfied or explicitly deferred", "exclusivity check confirms no concurrent disposition holds the ordering key", "transferred extent does not exceed the transferor's position" ], "effects": [ "exactly one operative position exists per object-and-modality after commit", "execution, effective and recorded times persisted separately", "counterparties with notice-only encumbrances notified", "subsisting mandates re-evaluated against the new position" ], "source_refs": [ "SRC-006", "SRC-019", "SRC-013" ] }, { "id": "restructure-holding-shares", "name": "Restructure holding shares", "description": "Change the co-holders, fractions or co-holding form of a single holding, subject to the recorded decision rule.", "inputs": [ "control record reference", "proposed share schedule", "co-holder consents", "effective timestamp" ], "outputs": [ "new share schedule artifact", "superseded schedule reference", "shareRestructured event" ], "preconditions": [ "proposed fractions sum correctly for the recorded extent", "decision threshold for disposal or restructuring is met", "no encumbrance blocks the restructuring" ], "effects": [ "prior schedule retained and addressable", "downstream mandates scoped to a changed share are re-evaluated", "co-holder set changes propagated to the disclosure tiering" ], "source_refs": [ "SRC-013", "SRC-007" ] }, { "id": "manage-capacity-arrangement", "name": "Establish or review a capacity arrangement", "description": "Create, review, vary or terminate a support or substitute decision-making arrangement over a holding, enforcing the mandatory safeguards.", "inputs": [ "holder reference", "proposed arrangement mode and scope", "least-restrictive-alternative justification", "conflict of interest screening", "reviewing authority reference", "proposed expiry" ], "outputs": [ "capacity arrangement record", "review schedule", "safeguard compliance determination" ], "preconditions": [ "a competent, independent and impartial review authority is named", "an expiry date is present", "conflict of interest screening is recorded", "the person's expressed will and preferences are on record or their absence is justified" ], "effects": [ "arrangement created with a mandatory next-review date", "arrangement without an expiry or reviewer is rejected", "review outcomes create new serial versions rather than editing in place", "expiry without review moves the arrangement to lapsed, not to silently continuing" ], "source_refs": [ "SRC-010" ] }, { "id": "open-succession-or-lapse", "name": "Open a succession or lapse", "description": "Record the trigger event that removes a holder without an act of transfer, place the holding in an interim state, and apply the vesting rule when a successor is determined.", "inputs": [ "trigger event type and timestamp", "evidencing source", "administrator or interim controller where appointed", "diligent search record for abandonment cases" ], "outputs": [ "succession notice", "interim control state", "vesting record when determined" ], "preconditions": [ "trigger event is evidenced by an admissible source", "for abandonment or lapse, a documented diligent search over a defined period exists" ], "effects": [ "holding enters an explicit interim state rather than acquiring an invented successor", "successionOpened event emitted", "the former holder's identifier is never reassigned to the successor" ], "source_refs": [ "SRC-013", "SRC-010", "SRC-015" ] }, { "id": "record-competing-claim", "name": "Record and resolve a competing claim", "description": "Register an irreconcilable claim over an object, freeze the operations the register's rules require, and ingest an outcome from the dispute forum without adjudicating.", "inputs": [ "claimant reference", "claimed position and basis", "conflict dimension", "dispute forum reference where proceedings exist" ], "outputs": [ "contested claim notice", "frozen operation set", "ingested outcome record" ], "preconditions": [ "the claim states a basis and identifies the conflict dimension", "the register has competence over the object" ], "effects": [ "object flagged contested and the notice surfaced on all extracts", "declared operations frozen until resolution or withdrawal", "ingested outcomes create new records; no prior record is deleted" ], "source_refs": [ "SRC-015", "SRC-013", "SRC-019" ] }, { "id": "evaluate-control-assurance", "name": "Evaluate control assurance", "description": "Assess a control record or a population of records for adequacy, accuracy, currency and chain completeness, and schedule remediation.", "inputs": [ "control record or population selector", "assurance policy and staleness thresholds", "evaluation instant" ], "outputs": [ "assurance review report", "staleness and gap findings", "remediation task list" ], "preconditions": [ "assurance policy with explicit thresholds is in force", "evaluation instant carries an explicit offset or Z" ], "effects": [ "assurance levels and last-verified timestamps updated", "records exceeding the staleness threshold marked non-operative for reliance", "unverified and unevidenced links reported rather than inferred" ], "source_refs": [ "SRC-009", "SRC-013", "SRC-017" ] }, { "id": "export-aligned-projection", "name": "Export an aligned projection", "description": "Emit control records in an external standard's shape for portability or interchange, carrying explicit loss and conflict warnings and no unwarranted conformance claim.", "inputs": [ "record selection", "target standard and version", "requester identity and purpose", "disclosure tier" ], "outputs": [ "aligned export payload", "loss and conflict report", "alignment crosswalk version reference" ], "preconditions": [ "a crosswalk exists for the pinned target standard version", "requester is entitled to the elements included at the applied disclosure tier" ], "effects": [ "export emitted with alignment-only labelling unless tested conformance evidence exists", "unmapped and lossy elements enumerated in the report", "export event logged with the crosswalk and disclosure policy versions in force" ], "source_refs": [ "SRC-013", "SRC-003", "SRC-004", "SRC-007", "SRC-001" ] }, { "id": "appoint-steward-or-custodian", "name": "Appoint steward", "description": "Appoint a custodian or trustee-like operator with duties, term and accountability route, without conferring beneficial ownership.", "inputs": [ "Appointing title or trust instrument", "Steward party, duty list, term and accountability route" ], "outputs": [ "Steward appointment instrument" ], "preconditions": [ "An appointment basis exists (contract, statute, court order or trust instrument)" ], "effects": [ "Custody and care are conferred while beneficial ownership is expressly not transferred" ], "source_refs": [ "SRC-026", "SRC-028" ] }, { "id": "grant-or-revoke-delegation-mandate", "name": "Grant or revoke mandate", "description": "Issue, constrain, sub-delegate, expire or revoke a scoped grant of control powers that must not exceed the live parent title.", "inputs": [ "Parent ownership record", "Assignee, power list, constraints, term and sub-delegation flag" ], "outputs": [ "Mandate instrument with lifecycle status" ], "preconditions": [ "Granted powers do not exceed the live parent title" ], "effects": [ "Mandate becomes offered, agreed, suspended, expired or revoked", "Powers shrink automatically when the parent title is transferred, restricted, annulled or ceases" ], "source_refs": [ "SRC-022", "SRC-026" ] }, { "id": "reconstruct-chain-of-control", "name": "Reconstruct chain of title", "description": "Return the ordered transfer and provenance history of one object, omitting unrelated holdings of the parties.", "inputs": [ "Object reference" ], "outputs": [ "Ordered transfer and provenance history with supporting sources" ], "preconditions": [ "Requester already has a legitimate interest in that object" ], "effects": [ "Unrelated holdings of the parties are omitted", "History is read from append-only records, not from mutated current state" ], "source_refs": [ "SRC-021", "SRC-012" ] }, { "id": "record-or-release-encumbrance", "name": "Record restriction", "description": "Attach a restriction, responsibility, prohibition or duty to a title, with interval and an optional pointer to a secured-transactions sibling.", "inputs": [ "Ownership record", "Restriction class, imposing party, action or duty, constraints and interval" ], "outputs": [ "Restriction notice bound to the title" ], "preconditions": [ "The imposing party and legal basis are identified" ], "effects": [ "The title is qualified without transfer", "Priority and enforcement remain in the secured-transactions sibling behind a pointer" ], "source_refs": [ "SRC-021", "SRC-022" ] }, { "id": "resolve-beneficial-holders", "name": "Resolve beneficial owners", "description": "Return the natural persons who ultimately own or control, the control pathway, currency timestamp and any open discrepancy, distinct from legal owners.", "inputs": [ "Object or holding-vehicle reference", "Access class of the requester" ], "outputs": [ "Natural-person beneficial owners with control pathway, currency timestamp and discrepancy status" ], "preconditions": [ "Requester falls within a FATF access class implemented by the Dimension" ], "effects": [ "The read is audited", "Stale beneficial-ownership records are returned marked discrepant or unknown, never as current" ], "source_refs": [ "SRC-024" ] } ], "composition": [ { "target": "Every meta-object in the catalogue (the control facet)", "relation": "MIX-IN", "purpose": "Attach the control facet — holder, modality, basis, validity, assurance — to any meta-object without embedding domain semantics into it, so that control can be asked of anything the catalogue registers.", "required": true, "source_refs": [ "SRC-013", "SRC-001", "SRC-016" ] }, { "target": "Meta-object core identity primitive", "relation": "EXTEND", "purpose": "Every control assertion anchors to the core object identity; this model extends that primitive with a control facet rather than minting a parallel identity for the object.", "required": true, "source_refs": [ "SRC-013", "SRC-001" ] }, { "target": "Person model (natural persons)", "relation": "REFERENCE", "purpose": "Holders, beneficial holders, delegates, stewards and supported persons are natural persons resolved in the person model; this model holds only references and roles.", "required": true, "source_refs": [ "SRC-013", "SRC-010" ] }, { "target": "Organization model (legal persons and bodies)", "relation": "REFERENCE", "purpose": "Organizations, communities and public bodies appear as holders, stewards, register authorities and review authorities; their identity, legal form and existence lifecycle live in their own model.", "required": true, "source_refs": [ "SRC-013", "SRC-009" ] }, { "target": "Access / authorization contract model", "relation": "REFERENCE", "purpose": "Every access grant must resolve its grantor against a live control record here; this model supplies grantor standing, the access model supplies permissions, prohibitions and duties.", "required": true, "source_refs": [ "SRC-004", "SRC-001" ] }, { "target": "Access and change audit model", "relation": "REFERENCE", "purpose": "Privileged reads of control data and all register mutations are logged in the audit model; this model declares what must be logged, not the log's structure.", "required": true, "source_refs": [ "SRC-018", "SRC-007" ] }, { "target": "Provenance and lineage model", "relation": "ALIGN", "purpose": "Control transitions are emitted as provenance-compatible attribution and delegation statements, so that responsibility for an object's control history is queryable alongside its content lineage.", "required": false, "source_refs": [ "SRC-003", "SRC-012" ] }, { "target": "Rights, licensing and IPR model", "relation": "REFERENCE", "purpose": "Rights in the work are distinguished from control of the object; a rights holder is referenced here but rights terms, licences and permitted uses are defined there.", "required": false, "source_refs": [ "SRC-012", "SRC-004" ] }, { "target": "Dispute resolution and adjudication model", "relation": "REFERENCE", "purpose": "Contested claims are flagged here and adjudicated there; outcomes flow back as ingested transfer, annulment or confirmation records.", "required": false, "source_refs": [ "SRC-013", "SRC-015" ] }, { "target": "Identity credential and key management model", "relation": "REFERENCE", "purpose": "Cryptographic verification methods evidence control but do not constitute it; key rotation must not be interpretable as a transfer of ownership.", "required": false, "source_refs": [ "SRC-001", "SRC-002" ] }, { "target": "ISO 19152-1:2024 LADM generic conceptual model", "relation": "ALIGN", "purpose": "Adopt the party / right-restriction-responsibility / administrative-unit pattern, the fraction and versioned-object primitives, and the source association; alignment only, since this model covers non-spatial meta-objects LADM does not address.", "required": false, "source_refs": [ "SRC-013" ] }, { "target": "W3C ODRL Information Model 2.2", "relation": "ALIGN", "purpose": "Reuse the assigner/assignee role functions, constraint shape and Duty class for mandates and holder responsibilities, without adopting ODRL as the control record's own encoding.", "required": false, "source_refs": [ "SRC-004" ] }, { "target": "W3C Controlled Identifiers v1.0 and DID v1.1", "relation": "ALIGN", "purpose": "Map the de-facto technical control modality and the delegation primitive onto controller, capabilityInvocation and capabilityDelegation; DID v1.1 is a Candidate Recommendation, so the alignment is provisional.", "required": false, "source_refs": [ "SRC-001", "SRC-002" ] }, { "target": "W3C PROV-O", "relation": "ALIGN", "purpose": "Express acting-for relations as qualified delegation with roles, preserving the principle that the delegating agent retains some responsibility.", "required": false, "source_refs": [ "SRC-003" ] }, { "target": "W3C Verifiable Credentials Data Model 2.0", "relation": "ALIGN", "purpose": "Use the credential shape for attestations of control and for delegation mandates, keeping issuer, subject and presenting holder distinct.", "required": false, "source_refs": [ "SRC-005" ] }, { "target": "DCMI Metadata Terms", "relation": "ALIGN", "purpose": "Map the chain of title to dcterms:provenance and rights-holder references to dcterms:rightsHolder, recording that rightsHolder conflates owning and managing and therefore cannot be a lossless target.", "required": false, "source_refs": [ "SRC-012" ] } ], "serviceLayers": { "dimension": { "owner_package_requirements": [ "The adopting Dimension must publish a register charter naming the maintaining authority, its competence scope by object class, modality and territory, and the recording effect of an entry (constitutive, presumptive or evidentiary only).", "The Dimension must publish and version the control modality vocabulary and the basis-of-control code list before any control record is created; an unclassified modality must be representable and must never silently default to legal title.", "The Dimension must declare, per object class, the applicable retention periods, the erasable versus permanent elements, and the tombstoning representation used when an element is erased.", "The Dimension must nominate a capacity-arrangement review authority that is competent, independent and impartial, or declare that it will not host capacity arrangements at all.", "The Dimension must publish its disclosure policy with audience tiers and the legitimate-interest test before exposing any beneficial-holder or capacity-arrangement data." ], "namespace_guidance": "Allocate a stable namespace per Dimension of the form /ownership/, with sub-namespaces for records (/record/), mandates (/mandate/), instruments (/instrument/), vocabularies (/vocab/) and crosswalks (/crosswalk/). Vocabulary and crosswalk IRIs carry an explicit version segment because their meaning is version-dependent; record IRIs do not, since versioning is expressed through supersession links. Never mint an identifier that embeds a date, a holder name or a jurisdiction code that may change.", "registry_links": [ "Registry entry vr.wm-xct-001 (WM-XCT-001) is the canonical index record for this model; nav path NAV.XCT.OWN, domain tag XCT.OWN.", "Legacy alias S1 and the previous specification at models/security-ownership-access/S1-meta-object-ownership-and-stewardship.md are superseded material and must be resolved to this entry rather than cited directly.", "Sibling registry entries for the person, organization, access-contract, audit, provenance, rights and dispute models must be linked before this model is marked operational, since seven composition links are declared against them." ] }, "canon_and_patch": { "canonicalization_rules": [ "Timestamps are canonicalised to RFC 3339 with seconds and an explicit numeric offset or Z; a value without an offset is rejected, not coerced to UTC.", "Fractions are canonicalised as reduced integer numerator and denominator pairs; decimal approximations are rejected because rounding changes who owns what.", "Party, object and instrument references are canonicalised to the highest available identity tier — master-system identifier, then governed IRI, then Dimension-assigned UUID/ULID — and the tier used is recorded alongside the value.", "Code values are canonicalised against the version of the governed vocabulary in force at the record's effective time, not at read time.", "Ordering of collections that carry legal meaning (encumbrance priority, delegation chain, chain of title) is significant and preserved; all other collections are canonicalised to sorted order for digest stability." ], "patch_rules": [ "Control records are append-only: a change produces a new version linked by supersession, and the superseded version remains resolvable.", "Every patch declares its revision type — correction of the record versus change in the world — because the two have different effects on the chain of title and on downstream reliance.", "A patch that alters a past state sets the retroactive flag and captures the prior belief snapshot, so that a party who relied on the earlier state can be identified.", "Erasure is performed by tombstoning the element and preserving the link structure; physical deletion of a chain link is prohibited.", "Reversal of an invalid transfer is a compensating entry citing the annulled record identifier; identifiers are never reused or reassigned." ], "compatibility_rules": [ "Adding a new control modality, basis code or lifecycle state is a minor change; removing or redefining one is breaking and requires a new vocabulary version with a documented migration.", "Tightening a cardinality from optional to required, or narrowing an enumeration, is breaking; widening is minor.", "Crosswalks pin the exact version of every target standard; a target standard's new version invalidates the crosswalk until re-tested, and exports must fall back to alignment-only labelling in the interim.", "Consumers must ignore unknown optional fields and must fail closed on unknown values in fields marked decision-critical (modality, record state, operative flag, validity status)." ] }, "artifact_rules": { "identity_priority": [ "Authoritative master-system identifier issued by the competent register, court, notary or issuing authority (instrument number, grant reference, filing reference).", "Governed global identifier or IRI minted in the adopting Dimension's ownership namespace and resolvable through the Dimension's registry.", "UUID (v4 or v7) or ULID assigned by the adopting Dimension, recorded together with the fact that no higher tier was available.", "A content digest may accompany but never replace an identifier, because the same instrument may be validly reissued with identical content; a date is never an identifier." ], "timestamp_rule": "All time values are RFC 3339 with seconds and an explicit numeric UTC offset or Z. Event time (when control changed), effective time (from when the assertion holds), observation or ingestion time (when the register learned it) and record write time are recorded as separate fields and never collapsed. Where civil-date semantics matter, the originating IANA time zone identifier is recorded alongside the instant.", "serial_naming_rule": "Serial artifacts (extracts, schedules, certificates, notices, reports, policies, crosswalks) are named --[-], where sequence is monotonic per subject and as-of is an RFC 3339 instant for any artifact asserting state at a point in time. Versioned governance artifacts (charter, disclosure policy, retention schedule, vocabulary, crosswalk) use semantic versioning plus an RFC 3339 effective date, and versions are immutable once effective.", "integrity_rule": "Every artifact carries a digest over its canonical form and, where it evidences control, a verifiable proof from an authorised issuer verification method. Verification results are stored with the verifier identity and the RFC 3339 verification instant, never as a bare boolean. An artifact whose proof cannot be verified is retained and marked unverified rather than discarded, because its existence is itself evidence." }, "policies": [ "Default deny on disclosure: no layer of a control record is public by default. Beneficial-holder and capacity-arrangement layers require a recorded legitimate-interest determination, following the CJEU's holding that unrestricted public access to beneficial ownership data is disproportionate.", "No silent defaulting of control modality, holder or basis. An unknown value is recorded as unknown with an escalation route; inventing a holder or a modality is treated as a data-integrity incident.", "Substitute decision-making is an exception, not a configuration. Any arrangement affecting a person's exercise of legal capacity must record a least-restrictive-alternative justification, a conflict-of-interest screening, a proportionality assessment, an expiry and a named independent review authority; an arrangement missing any of these is invalid.", "Append-only history: control records, transfers and mandates are never deleted or overwritten; corrections and reversals are compensating entries that preserve the prior state as resolvable.", "Alignment is not conformance. No conformance claim to LADM, ODRL, PROV-O, CID/DID, VC or DCMI may be published without a pinned target version, a tested profile and retained test evidence.", "Exclusivity is enforced at write time, not reported at read time: the register must reject a second concurrent disposition of the same object-and-modality rather than record both and reconcile later.", "No access grant, disclosure shape or attestation is treated as issued by a grantor of record unless that party holds or lawfully exercises control under a live ownership record, mandate, stewardship charge or capacity arrangement in this mixin.", "Delegated and fiduciary powers expire or shrink automatically when the parent title is transferred, restricted, annulled or ceases; counterparties must verify mandates against current title, not against the mandate instrument alone.", "Legal and beneficial holders, custodians, exclusive controllers and DID controllers are recorded separately; collapsing them into a single owner field is a validation failure.", "Chain of title is append-only. Current holder, current shares and current mandates are projections. Observation time is never used as event time.", "Supported decision-making is the default classification when a CRPD-implementing basis is cited; plenary guardianship requires an explicit substitute mode, legal basis, scope, safeguards and review date.", "Beneficial-ownership data is adequate, accurate and up to date, or it is marked discrepant or unknown; a stale BO record MUST NOT be presented as current." ], "crud": { "read": [ "Resolve the operative holder of an object in a modality at an instant, returning the minimal projection for the requester's declared purpose.", "Retrieve a chain of title with explicit gap, overlap and unevidenced-link markers rather than an interpolated history.", "Verify a delegation mandate's liveness, scope and revocation status at a stated instant and receive a retainable verification record.", "Query a party's portfolio of holdings and lawfully exercisable positions, excluding all other parties' holdings.", "Read the register charter, modality vocabulary, disclosure policy, retention schedule and crosswalks without restriction, since these govern how every other read must be interpreted." ], "create": [ "Anchor a controllable object and obtain a control record identifier at the highest available identity tier.", "Assert a control position with holders, modality, basis, shares, validity interval and evidencing sources.", "Issue a delegation mandate, steward appointment or capacity arrangement bounded by the issuing control position and its safeguards.", "Lodge a transfer instrument, a competing claim notice, an encumbrance or a succession notice." ], "update": [ "Supersede a control position by creating a new version linked to the prior one; in-place mutation of an effective record is prohibited.", "Transition record state (suspend, restore, mark contested, terminate) through an authorised transition that records actor, authority, reason and RFC 3339 instant.", "Restructure shares by issuing a new share schedule that retains and links the superseded schedule.", "Revoke or vary a mandate, recording revocation effective time and publication time separately, and re-evaluating dependent sub-delegations.", "Refresh assurance level and last-verified timestamp after a verification, without altering the underlying assertion." ], "delete": [ "Physical deletion of a control record, transfer or chain link is prohibited; termination is a state transition, not a removal.", "Erasure of personal identifying elements is performed by tombstoning, preserving link structure and recording the erasure basis, requester and instant.", "Annulment of an invalid transfer is a compensating entry citing the annulled identifier; the annulled entry remains resolvable.", "Bulk purge is permitted only under a published retention schedule version, executed as a recorded disposition action with a manifest of what was disposed and under which schedule version.", "On decommissioning, records are transferred to a named successor custodian under a recorded custody transfer instrument rather than destroyed." ] }, "roles": [ { "name": "Register authority (root registrar)", "responsibilities": [ "Maintain the register charter, competence scope and recording effect, and publish amendments with effective dates.", "Enforce exclusivity at write time and adjudicate ordering of concurrent dispositions.", "Approve and version the control modality vocabulary and basis code lists.", "Refuse and record entries outside the register's competence rather than accepting them silently." ] }, { "name": "Control record steward", "responsibilities": [ "Operate assertion, transfer, share restructuring and succession functions within the charter.", "Maintain assurance levels, re-verification cadence and remediation of stale or unevidenced records.", "Ensure every record carries a basis, an evidencing source and separated effective and ingestion timestamps.", "Escalate holder-unknown, unassigned-duty and chain-gap findings rather than filling them by inference." ] }, { "name": "Disclosure controller", "responsibilities": [ "Apply the disclosure policy, run and record legitimate-interest determinations, and maintain the minimal projections per purpose.", "Ensure beneficial-holder and capacity layers are never exposed in public projections.", "Ensure privileged reads are logged with requester, purpose, fields returned and RFC 3339 instant.", "Review redaction rules whenever a new projection or export shape is introduced." ] }, { "name": "Safeguards reviewer", "responsibilities": [ "Verify that every capacity arrangement records a least-restrictive-alternative justification, conflict screening, proportionality assessment, expiry and independent review authority.", "Track next-review dates and move lapsed arrangements out of effect rather than allowing silent continuation.", "Ensure the person's expressed will and preferences are recorded, and that deviations are justified.", "Reject arrangements that lack an expiry or a competent independent reviewer." ] }, { "name": "Interoperability custodian", "responsibilities": [ "Maintain crosswalks against pinned versions of LADM, ODRL, PROV-O, CID/DID, VC and DCMI, with loss and conflict annotations.", "Block conformance claims unsupported by retained test evidence and label exports alignment-only by default.", "Re-test crosswalks when a target standard publishes a new version and mark affected exports degraded until re-tested.", "Maintain the portability export shape and its documented exclusions." ] }, { "name": "Dispute liaison", "responsibilities": [ "Register competing claims, apply the frozen-operation set and surface contested notices on all extracts.", "Ingest adjudicated outcomes as new records without deleting prior entries.", "Track residual appeal status and keep contested flags accurate.", "Ensure the register never records an adjudication of its own." ] } ], "access": { "default_rule": "Deny by default at every scope. Read access is granted only for a declared purpose, at the narrowest projection satisfying that purpose, to a requester whose entitlement or legitimate interest is recorded. Write access is granted only to a role named in the register charter for the specific transition being attempted.", "scopes": [ "bundle", "layer", "finding", "artifact" ], "exceptions": [ "The register charter, control modality vocabulary, disclosure policy, retention schedule and alignment crosswalks are readable without restriction, because they govern how every other disclosure must be interpreted.", "A minimal current-holder extract may be released to a counterparty with a declared transactional purpose without full-record access, since MLETR-style reliance requires identifying the person in control.", "Competent authorities and obliged entities may access the beneficial-holder layer under their own legal basis, without that basis extending to the general public.", "A holder may always read the complete control record concerning their own holding, including the read log of who accessed it, and may obtain a structured machine-readable export of it.", "A supported person retains read access to arrangements affecting their own legal capacity; a substitute decision-maker's access does not displace it.", "In a declared emergency (imminent loss or destruction of the object), an interim custodian may be granted time-boxed operational access, which expires automatically and is reviewed after the fact.", "Competent-authority access to basic and beneficial-ownership information as implemented from FATF Recommendations 24 and 25, always audited.", "Counterparty mandate verification that returns only pass, fail or indeterminate plus the powers actually claimed, not the holder's full portfolio.", "Court or dispute-resolution outcome ingestion that writes transfer, restriction or annulment events without opening investigative files in this mixin.", "Public current-holder extract where a Dimension policy, VGGT transparency measure or land-register law requires publicity of legal owners; beneficial owners remain exception-gated unless local law says otherwise." ], "audit_requirements": [ "Every privileged read is logged with requester identity, declared purpose, disclosure policy version applied, fields returned and an RFC 3339 instant with explicit offset.", "Every write, state transition, revocation and disposition action is logged with actor, authority relied on, reason code, prior and new state references, and both effective and ingestion timestamps.", "Every mandate verification performed by a relying party is retained immutably as that party's evidence of having checked.", "Refusals are logged as fully as successes — out-of-competence lodgements, excess-scope delegation attempts, rejected concurrent dispositions and failed disclosure tests — because absence of these records makes exclusivity and default-deny unfalsifiable.", "Audit records are held in the separate audit model, are append-only, and their own retention period is at least that of the longest-retained control record class they describe.", "Log every read of BO data, every title extract, every mandate verification, and every create, supersede, revoke or cessation event with actor, object, purpose, event time and observation time.", "Forward those logs to the access-audit sibling; do not keep a second ungoverned log store as the system of record.", "Retain audit records at least as long as the chain of title they explain, subject to person-model erasure duties which then require a tombstone rather than a silent gap." ] }, "agents_bootstrap": { "filename": "AGENTS.md", "required_fields": [ "Name", "Type", "Specification URL", "Storage type URL", "Interface URL", "Processes URL", "Registry ID", "Model ID", "Register authority and competence scope", "Recording effect (constitutive | presumptive | evidentiary-only)", "Control modality vocabulary URL and version", "Disclosure policy URL and version", "Retention schedule URL and version", "Alignment crosswalk URL with pinned target standard versions", "Identity tier policy", "Timestamp policy (RFC 3339, explicit offset or Z, separated event and ingestion times)" ], "read_order": [ "AGENTS.md — establish Name, Type and the four URLs before any other access; treat the file as the only entry point.", "Specification URL — read the model scope, boundaries and the control modality vocabulary, so that no modality is inferred from field names.", "Register charter and recording effect — determine what an entry in this register actually confers before relying on any record.", "Disclosure policy — determine the applicable audience tier and minimal projection before issuing any read.", "Storage type URL — learn the concrete projection (document store, graph, ledger, filesystem) and its consistency and ordering guarantees, which bear directly on exclusivity.", "Interface URL — bind to the operations exposed for the CRUD and function surface, including the exclusivity and verification endpoints.", "Processes URL — read the transfer, revocation, capacity-review, dispute and disposition procedures before attempting any state transition.", "Alignment crosswalk — consult only when exporting or ingesting, and honour its alignment-only labelling unless tested conformance evidence is present." ] } }, "coverage": { "claim": "Merged plan covers the control facet of an arbitrary meta-object on Claude's six-bundle spine — object anchoring and record identity, control modality and basis, holders, shares, encumbrances and holder duties, stewardship, scoped delegation, capacity and collective authority, transfer, succession, exclusivity, state and time, evidence and assurance, contestation, and register governance — extended with three Grok findings (trust/separate-fund, governing law and situs, involuntary deprivation and lapse) and five Grok functions that fill operational holes. Coverage is jurisdiction-bounded and evidence-bounded: paywalled ISO normative text was not read, valuation and settlement have no registered sibling, trust and conflict-of-law material is imported at page level rather than clause level, and no claim of universal or metaphysical completeness is made.", "confidence": "medium", "checklist": [ { "dimension": "identity", "status": "covered", "notes": "Three-tier identity priority (master-system, governed IRI, UUID/ULID) is stated in artifact_rules and applied per artifact. Date-as-identifier is explicitly prohibited; content digests are explicitly non-identifying. Grounded in LADM's Oid primitive and CID's identifier discipline (SRC-013, SRC-001)." }, { "dimension": "lifecycle", "status": "covered", "notes": "Explicit state set with transitions, authorities and an operative-for-reliance flag; supersession preserves prior versions per LADM's versioned-object pattern. Steward, mandate and capacity arrangements each carry their own term and end-of-term disposition (SRC-013, SRC-007, SRC-010)." }, { "dimension": "relationships", "status": "covered", "notes": "Holder-to-object, co-holder-to-share, encumbrance-to-beneficiary, delegate-to-issuing-position, beneficial-holder control chains, and competing-claim relations are all modelled with cardinalities. Sixteen composition links declared, each source-cited." }, { "dimension": "temporal", "status": "covered", "notes": "Four times separated (event, effective, observation/ingestion, record write); RFC 3339 with seconds and explicit offset or Z is mandatory and non-coercible; retroactive changes flagged with prior-belief snapshots; revocation effective and publication times separated to expose the propagation gap (SRC-013, SRC-011, SRC-012)." }, { "dimension": "provenance", "status": "covered", "notes": "Every assertion binds to an evidencing source with issuer, subject and presenter distinguished; dcterms:provenance is the direct anchor for the ownership-and-custody chain, and PROV-O supplies qualified attribution and delegation (SRC-012, SRC-003, SRC-005, SRC-013)." }, { "dimension": "ownership", "status": "covered", "notes": "Five distinguishable control modalities with an explicit no-defaulting rule, legal versus beneficial separation, collective authority, and the Data Act counterexample that a data holder's position confers no new right (SRC-007, SRC-008, SRC-009, SRC-014, SRC-016)." }, { "dimension": "validation", "status": "covered", "notes": "Share sums, scope containment for delegation, exclusivity at write time, condition-precedent satisfaction, offset presence, and conformance-claim gating are all expressed as preconditions or questions with answer data." }, { "dimension": "access", "status": "covered", "notes": "Default deny at all four scopes with six enumerated exceptions and five audit requirements, anchored in the CJEU's invalidation of general public access to beneficial ownership data (SRC-018) and GDPR (SRC-007)." }, { "dimension": "retention and deletion", "status": "covered", "notes": "Append-only history with tombstoning rather than physical deletion, per-class retention periods, erasable-versus-permanent element split, chain-integrity preservation on redaction, and successor custody on decommissioning (SRC-007, SRC-012)." }, { "dimension": "interoperability", "status": "covered", "notes": "Six alignment targets with pinned versions, explicit loss and conflict annotation, alignment-only labelling by default, and a GDPR Article 20 portability export shape. Conformance is gated on retained test evidence (SRC-013, SRC-003, SRC-004, SRC-001, SRC-005, SRC-012, SRC-007)." }, { "dimension": "authority and competence", "status": "covered", "notes": "Register competence scope, recording effect (constitutive, presumptive, evidentiary-only), out-of-competence marking and overlapping-register conflicts are modelled; NIST's statutory-or-operational-authority definition anchors it (SRC-016, SRC-013)." }, { "dimension": "capacity and safeguards", "status": "covered", "notes": "CRPD Article 12 safeguards are encoded as validity conditions rather than advice: mandatory expiry, conflict screening, proportionality, tailoring, and named independent reviewer; an arrangement missing any is invalid (SRC-010)." }, { "dimension": "exclusivity and double-disposition", "status": "covered", "notes": "MLETR's exclusive-control requirement and UCC Article 12's exclusive-power-to-transfer element are enforced at write time with an ordering key, fork reconciliation and copy marking (SRC-006, SRC-019)." }, { "dimension": "contestation and dispute", "status": "covered", "notes": "Competing claims, conflict dimension, priority rules and frozen operations are modelled; adjudication is explicitly delegated to the dispute model and only ingested outcomes are recorded (SRC-015, SRC-013)." }, { "dimension": "spatial", "status": "not-applicable", "notes": "Deliberately excluded. LADM's spatial unit package is the correct home for geometry and boundary semantics; a mix-in over arbitrary meta-objects must not import spatial structure. Where a controlled object is a land parcel, the spatial model is referenced, not restated (SRC-013)." }, { "dimension": "measurement and valuation", "status": "gap", "notes": "Fractions are modelled exactly, but value, consideration amount, accounting treatment and tax position are out of scope and no sibling valuation model is yet registered. ISO 19152-4 (valuation information) would be the alignment target; it was not consulted." } ], "known_omissions": [ "Jurisdiction-specific property, trust, succession and matrimonial-property law is not modelled; only the basis code and its evidencing source are carried, so an agent cannot determine from this model whether a claimed right is actually valid anywhere.", "The normative clause text of ISO 19152-1:2024 and ISO/IEC 27002:2022 is paywalled and was not read directly; LADM's class structure was confirmed at catalogue level and through secondary technical summaries, and control 5.9's wording through a secondary explainer (SRC-020). Attribute-level LADM alignment is therefore unverified.", "Trust law specifically — the split between legal and equitable title, trustee duties and beneficiary rights — is approximated through the beneficial-holder and steward findings rather than modelled natively; civil-law systems without a trust concept will map imperfectly.", "Bailment, lien-by-possession, pledge and other possession-derived positions are only partially covered by the custody modality and the encumbrance finding.", "Escheat and bona vacantia are named as a succession trigger but the state-acquisition procedure and its notice requirements are not modelled.", "No valuation, consideration or settlement semantics; the reference to a settlement record held elsewhere is a placeholder for an unregistered sibling model.", "OAIS (ISO 14721 / CCSDS 650.0-M-3) was sought as an anchor for archival custody transfer but could not be retrieved; the custody and successor-custodian elements therefore rest on DCMI and GDPR rather than on the archival standard.", "Automated agents as holders — whether an autonomous software agent can hold rather than merely exercise control — is left open; CID and DID permit an autonomous software controller, but no source consulted resolves whether that constitutes holding.", "CIDOC CRM ownership and custody properties (P51, P52, P30) were not fetched as primary text and are not canonical here.", "PREMIS preservation rights and agent roles were not fetched.", "GDPR controller and processor are a data-protection sibling, not modelled as title; they were not fetched as primary support.", "RUFADAA and other digital-asset fiduciary statutes are regional and omitted as classes.", "UNIDROIT Cape Town Convention, UCC Article 9 and the Hague Securities Convention were not fetched; security-interest procedure is out of scope.", "Social Tenure Domain Model (STDM) and continuum-of-land-rights graphics are secondary to VGGT and LADM and were not fetched.", "Adverse possession, prescription, bona vacantia, escheat, community property and orphan-works regimes lack a single global primary instrument in this source set and are jurisdiction-tagged gaps.", "DAO, smart-contract and non-person holders lack primary legal personality support here.", "ISO 19152 full text is paywalled; Party and RRR structure is taken from the Edition II co-editor paper, not from a purchased ISO PDF.", "ISO 19115-1 has no steward code; older profiles that listed steward are not used as if they were the current TC 211 list." ], "conflicts": [ "dcterms:rightsHolder defines a rights holder as a person or organization 'owning or managing rights over the resource', conflating the holder and the steward that this model deliberately separates. Exports to DCMI are therefore lossy and must emit a warning (SRC-012).", "CID makes control a factual capability — whoever can update the canonical resource is by definition a controller — while LADM, MLETR and property law treat control as a normative entitlement. A person can hold CID-control without any right, and vice versa. This model keeps them as separate modalities and refuses to reconcile them (SRC-001, SRC-013, SRC-006).", "The EU Data Act expressly declines to confer any new right on data holders, whereas UCC Article 12 makes control of a controllable electronic record a property-like position with take-free rules. The same digital object can therefore be property in one system and a mere factual holding in another (SRC-008, SRC-019).", "GDPR determines controllership functionally by who decides purposes and means, which can contradict a recorded contractual designation; a party designated as processor that determines its own purposes becomes a controller regardless of the record. The record is therefore rebuttable, not dispositive (SRC-007).", "CRPD Article 12 as interpreted by the CRPD Committee pushes toward abolishing substituted decision-making entirely, while most national systems retain guardianship. This model represents substitution as a bounded exception with mandatory safeguards; jurisdictions that treat guardianship as ordinary will find the model stricter than their law requires (SRC-010).", "Beneficial ownership transparency obligations require adequate, accurate and up-to-date information, while the CJEU has invalidated general public access to it. Registers must satisfy both, which forecloses the simplest implementation of either (SRC-009, SRC-018).", "DID v1.1 is a Candidate Recommendation, not a Recommendation; alignment to it is provisional and may change before it advances (SRC-002).", "CRPD Article 12 (legal capacity with support) conflicts with plenary substituted guardianship still used in many domestic systems; both are recordable, with substitute mode marked as tension.", "DCMI rightsHolder and ISO 19115-1 rightsHolder mean owning or managing rights, which conflates owner and steward; this mixin splits them.", "DID controller, MLETR person in exclusive control, LADM right-holder, FATF beneficial owner and HCCH trustee are five different control predicates; treating any one as the others is an error.", "ODRL transfer of ownership is an action over an asset and is not a copyright assignment or a land-register conveyance unless a sibling says so.", "MLETR exclusive control by a person conflicts with LADM joint holdings and DID multiple controllers; joint-control must be an explicit regime, not an implicit exception.", "VGGT legitimate unregistered tenure conflicts with any Dimension rule that only a registry entry makes an object controllable; unregistered claims are a separate legitimacy class.", "HCCH Article 13 permits non-recognition of trusts whose significant elements connect to non-trust States; trust records are not universally effective.", "Bearer instruments remain possible under some substantive law (MLETR commentary) while FATF requires immobilisation or conversion; both facts must be visible.", "FAO VGGT does not cover water and minerals; those resource regimes must not be smuggled in as tenure forms." ], "regional_assumptions": [ "Access, disclosure and beneficial-ownership defaults are calibrated to EU law (GDPR, AMLR and the CJEU's WM/Sovim judgment). Jurisdictions with open-by-default corporate or land registers will need a different default and should record that divergence in the register charter.", "The transfer-validity and good-faith-acquisition finding is shaped by UCC Article 12, a US uniform act whose enactment is state-by-state and incomplete; take-free rules are not universal.", "MLETR is a model law requiring national enactment; exclusive-control semantics apply only where enacted, and the number of enacting states remains small.", "The capacity findings assume a CRPD-ratifying jurisdiction. States that have not ratified, or that entered reservations to Article 12, will not require the safeguards this model treats as validity conditions.", "VGGT's recognition of customary, communal and informal tenure is voluntary guidance, not binding law; a jurisdiction may refuse to recognise an informal holding that this model records as legitimate.", "CARE's authority-to-control is not legally enforceable in most jurisdictions and operates as a governance commitment; a Dimension adopting it must give it effect through its own charter and contracts.", "Land-specific alignment assumes LADM Edition II; jurisdictions still on ISO 19152:2012 use different class names and lack the georegulation framing.", "Torrens indefeasibility is a jurisdictional property, not a mixin default.", "Common-law trusts are defined by HCCH Article 2; civil-law fiducie, treuhand and waqf are not assumed equivalent without an adopting-Dimension mapping.", "Forced heirship and matrimonial property (HCCH Article 15) override chosen trust law in many civil-law forums.", "Beneficial-ownership percentage thresholds (often 25 percent) are local implementations, not the FATF definition.", "Publicity of legal-owner registers versus confidentiality of BO registers varies by State.", "Guardianship of adults remains lawful in States that have not fully implemented CRPD Article 12.", "Digital-asset succession without key recovery is operationally common and legally unsettled outside a few statutes." ], "adversarial_checks": [ "Is 'ownership' being treated as one relation? Rejected. The EU Data Act's refusal to create a data-holder right, GDPR's purposes-and-means test, NIST's accountability-based information owner and CID's factual controller cannot be merged without producing a register that asserts property rights nobody holds. The modality field is mandatory and non-defaulting as a direct consequence.", "Does a cryptographic key holder own the object? Rejected. CID makes updating the canonical document sufficient for controller status, which means an operator or key custodian would silently become an owner. Key management is therefore referenced as evidence of control and explicitly excluded from constituting it; key rotation is not a transfer.", "Is guardianship a benign structural node? Rejected as framed in the previous-version material, which modelled a 'guardianshipArrangement' with a ward, a guardian and a review date. CRPD Article 12 requires support-first, proportionality, freedom from conflict of interest, shortest-time application and independent review. The finding was rewritten so an arrangement without an expiry and a named independent reviewer is invalid, not merely incomplete.", "Should ownership data be public by default? Rejected. The CJEU held that general public access to beneficial ownership information is a serious and disproportionate interference with Charter Articles 7 and 8, since a legitimate-interest regime achieves comparable results. Default deny with recorded legitimate-interest determinations follows directly, against the intuitive design.", "Can a register simply record transfers and reconcile conflicts later? Rejected. MLETR requires a reliable method establishing exclusive control at all times and UCC Article 12 makes the exclusive power to transfer an element of control; a register that accepts two dispositions and reconciles afterwards has already failed the exclusivity test. Enforcement was moved to write time.", "Is an unregistered or customary holding an absence of control? Rejected. VGGT requires respect for communal, indigenous, customary and informal tenure, and CARE requires recognition of collective authority. Low assurance is recorded as an honest value with an explicit non-invalidity statement, rather than being treated as a null holder.", "Does the model duplicate a sibling? Checked against the previous S1 material, which embedded party attributes, access grants and audit into the ownership model. All three were removed to REFERENCE links; the mix-in now holds only references and roles for parties, declares what must be audited without defining the log, and supplies grantor standing without evaluating permissions.", "Is the finding set padded with file-type or format concerns? Checked. No finding depends on JSON, YAML, Git, MCP or MongoDB; storage and interface appear only in the AGENTS.md bootstrap contract and in the exclusivity question about replica authority, where consistency guarantees genuinely bear on the semantics.", "If an agent issues an access grant from a party who is only a DID controller or only a custodian, the grantor-of-record check must fail unless a live title, mandate, stewardship power or capacity authority covers that act.", "If a mandate still appears valid after the parent title transferred, verification must fail; powers do not float free of title.", "If legal owner, beneficial owner and person in exclusive control are collapsed into one owner field, FATF concealment patterns (nominees, layers, bearer forms) become invisible.", "If a Dimension treats VGGT informal tenure as a data-quality error, it will mint false unowned objects and invite eviction-like deletions.", "If CRPD-implementing support is stored as guardianship, the principal is wrongly stripped of holder status.", "If MLETR exclusive control is treated as beneficial ownership, bailees and system operators become false owners.", "If ISO 19115 steward is emitted as a canonical code, the record is not aligned to the official CI_RoleCode list.", "If chain of title is hard-deleted to satisfy a privacy request without a tombstone, both audit and succession reconstruction fail." ] }, "researchAdjudication": { "boundaryDecision": { "entry_kind": "mixin", "status": "accepted", "rationale": "Both providers independently classified WM-XCT-001 as a mixin and both keep party identity, authorization evaluation, audit logging, dispute procedure, IP licence terms and valuation outside the model. Claude's boundary is the operative one: seven neighbor notes each carry a distinction and source_refs, and its out_of_scope list draws the decisive line that this model records a claimed basis and its evidence rather than determining legal validity. The three accepted Grok additions were tested against that line — governing law, situs and involuntary-deprivation effects are recorded as pointers and ingested effects, not as adjudications — so the boundary holds without widening. Object scope stays 'exactly one referenced meta-object per control assertion' per Claude's controllable-object-anchor." }, "decisions": [ { "concept": "Base provider selection", "disposition": "Claude adopted as base", "rationale": "Not chosen on size. Claude's boundaries are complete where Grok's are absent: register authority and competence, disclosure tiering with a legitimate-interest test, retention/tombstoning against erasure rights, and standards alignment-versus-conformance all exist as sourced structure in Claude and only as checklist assertions in Grok. Claude also names its gaps and its one tier-4 source explicitly." }, { "concept": "Entry kind", "disposition": "mixin, accepted without change", "rationale": "Independent agreement between both providers, and both keep party identity, authorization, audit and dispute procedure external. No reclassification or split is warranted." }, { "concept": "Trust arrangement and separate fund", "disposition": "Accepted into steward-appointment", "rationale": "Claude declares trust law a known omission; Grok supplies it from HCCH 1985, a tier-1 primary instrument absent from Claude's source set. Fills a real hole in the fiduciary split without duplicating steward-custodian-appointment." }, { "concept": "Governing law, situs and mandatory overrides", "disposition": "Accepted into control-nature", "rationale": "Claude has no conflict-of-law element at all, which leaves basis-of-control unable to say under which legal order a ground is asserted. Recorded as a pointer set rather than a recognition determination, so the model boundary on legal validity is preserved." }, { "concept": "Involuntary deprivation, expropriation, insolvency and freeze effects", "disposition": "Accepted into succession-and-lapse", "rationale": "Distinct from holder-side lapse and from transfer validity. Grok tags these as jurisdiction-local doctrines rather than universal classes, which matches the base model's refusal to assert jurisdiction-specific property law." }, { "concept": "Tenure form typology (public, private, communal, indigenous, customary, informal)", "disposition": "Rejected as a finding; deferred to research", "rationale": "Genuinely orthogonal to Claude's control-modality axis, but adding a second classification finding to the same area would leave an agent unsure which field to set, and Claude already carries VGGT legitimacy through q-basis-informal, collective-authority-to-control and q-assurance-lowconfidence. Better handled as an added axis inside control-modality-classification after research." }, { "concept": "FATF beneficial-ownership concealment typology", "disposition": "Rejected as a finding; enrichment deferred", "rationale": "Claude's legal-versus-beneficial-holder already covers the nominee/trustee disclosure, currency of verification and restricted access. Grok's nominee-layering-bearer-share typology and the 'control through other means beyond a percentage threshold' point are question-level enrichments of an existing finding, not a new finding, and the addition mechanism cannot express that." }, { "concept": "DID controller and delegate as a separate finding", "disposition": "Rejected as duplicative", "rationale": "Claude carries de-facto technical control as one of five explicit modalities, has a boundary note excluding key management from constituting control, and an adversarial check rejecting key-holder-as-owner. A separate finding would restate it." }, { "concept": "Exclusive control of the record (MLETR Articles 10-11)", "disposition": "Rejected as duplicative", "rationale": "Claude's exclusivity-and-double-transfer covers the reliable method, concurrent-disposition detection, fork reconciliation and copy marking, and enforces exclusivity at write time rather than by reconciliation. Grok's joint-control caveat is already handled because Claude scopes exclusivity per object-and-modality." }, { "concept": "RRR qualifications on title", "disposition": "Rejected as duplicative", "rationale": "Fully covered by Claude's restrictions-and-encumbrances (beneficiary, priority rank, effect on transferability, release) plus holder-responsibilities (duty bearer, discharge evidence, reassignment trigger)." }, { "concept": "Ownership evidence quality", "disposition": "Rejected as duplicative", "rationale": "Covered by evidentiary-sources-and-attestation and assurance-and-currency, which additionally separate issuer, subject and presenter. Grok's Torrens-indefeasibility caution is a drafting note for the assurance finding, not separate structure." }, { "concept": "Register governance bundle and contestation layer (base-only)", "disposition": "Retained in full", "rationale": "Grok has no counterpart to register authority and competence, disclosure defaults anchored in the CJEU WM/Sovim judgment, retention with tombstoning, or competing-claims status. Nothing in Grok contradicts them, so they carry through unchanged." }, { "concept": "Transfer-watch / subscription notification function", "disposition": "Deferred", "rationale": "Grok's watch-transfers rests on ODRL and FATF, neither of which defines a notification service, and eventing plausibly belongs to a sibling rather than to a control mixin that already excludes runtime authorization and audit. Weak support, so deferral over acceptance." }, { "concept": "Merged source set", "disposition": "Union of both, with provenance retained per source", "rationale": "The three accepted findings require Grok's HCCH (SRC-008) and FATF (SRC-006), and VGGT already exists in the base as SRC-015 so Grok's SRC-007 must be de-duplicated onto it rather than added twice. Claude's tier-4 SRC-020 and CR-stage SRC-002 stay flagged as provisional in the merged pack." } ], "publicationHolds": [ "Source and live-version verification is not complete and must be retained as a hold: Grok's CRPD citation resolves to a generic OHCHR instruments page rather than Article 12, its LADM support is a FIG co-editor paper rather than the ISO text, Claude's UCC Article 12 citation is a Uniform Law Commission community page rather than the act text, and Claude's DID v1.1 is a Candidate Recommendation snapshot whose alignment is provisional.", "Multi-profile domain validation has not been performed by either provider. Before publication the mixin must be exercised against at least a land-parcel profile, an electronic-transferable-record profile, a corporate-vehicle/beneficial-ownership profile and a personal-data profile, since its defaults are calibrated to EU law and would misfire in open-register jurisdictions.", "Normative clause text of ISO 19152-1:2024, ISO/IEC 27002:2022 and ISO 19115-1 was never read directly by either provider. Every attribute-level alignment claim to LADM, control 5.9 and CI_RoleCode must be labelled unverified in the draft, and no conformance claim may be made.", "The imported HCCH trust material (Articles 2, 3, 8, 11, 13, 15) and FATF Recommendation 24/25 material were read at page and guidance level. Clause-level confirmation against the primary instruments is required before these claims are cited in the merged draft.", "The two additions that touch legal effect — governing-law-and-situs and involuntary-deprivation-and-lapse-events — must be re-read against the base out_of_scope line stating that this model records a claimed basis and its evidence rather than its legal validity, to confirm the merged text does not slide into asserting recognition or adjudicating deprivation.", "Merged source de-duplication is unverified: VGGT and CRPD Article 12 appear in both packs under different IDs and URLs, and MLETR appears as a landing page in one and a PDF in the other. The synthesizer's source merge must be reviewed before the draft is published." ], "deferredResearch": [ "Tenure-form typology from VGGT (public, private, communal, indigenous, customary, informal, mixed) as an axis orthogonal to control modality — determine whether it belongs as an added dimension inside control-modality-classification or as a distinct finding, and how it interacts with the non-defaulting modality rule.", "FATF concealment typology as enrichment of legal-versus-beneficial-holder: nominee shareholders and directors, layered legal persons, bearer-share immobilisation, and control through other means beyond any local percentage threshold.", "ISO 19115-1 CI_RoleCode alignment, including confirmation from the live TC 211 codelist that no 'steward' code exists, so the model does not emit a non-canonical role code in exports.", "Valuation and consideration sibling: Claude's checklist records this as its only outright gap, with ISO 19152-4 named as the untested alignment target and no registered sibling model.", "Archival custody transfer anchor: OAIS (ISO 14721 / CCSDS 650.0-M-3) could not be retrieved, so the custody and successor-custodian elements currently rest only on DCMI and GDPR.", "Whether an autonomous software agent or a DAO can hold rather than merely exercise control — both providers leave legal personality for non-human holders unresolved, and no consulted source settles it.", "Placement of a transfer-watch / legitimate-interest notification capability: whether it belongs to this control mixin or to a sibling eventing or access model, given that the mixin already excludes runtime authorization and audit." ] }, "statistics": { "sources": 28, "bundles": 6, "layers": 15, "findings": 31, "questions": 120, "artifacts": 28, "functions": 16 } }