Provenance Passport

A Provenance Passport is the per-datum record written at ingestion: source, timestamp, licence, jurisdiction, retention, permitted use, training and redistribution rights, caching rights and expiry [D] (data-plane.provenance-passport, S4).

It cannot be retrofitted at any price.

That is the whole argument for its priority. Every other part of the Data Plane can be added in a later release. This one cannot: a datum ingested without a Passport is a datum whose rights are permanently unknown, and reconstructing them after the fact means asking a vendor to certify what it permitted you to do eighteen months ago.

Write, propagate, enforce

• Write at ingestion. There is no permissive path and no development flag. A datum without a Passport is not returned [D] (data-plane.provenance-passport, S4).
• Propagate through derivation. A derived artefact carries a lineage edge and inherits the obligations of everything it derives from [A].
• Enforce at use. The check is at the point of use, not only at the point of ingestion, because the permitted-use set is a function of the purpose the datum is being used for.

Where a right has not been read, it is UNKNOWN, and UNKNOWN is enforced as deny [A]. A refusal to record a licence term the system has not read is not caution. It is the only way the record stays worth having.

Why a compliance mechanism is also the asset

The Passport is usually read as a compliance obligation. It is also the substrate of the only thing in the estate that compounds and cannot be bought: a per-datum history of which source answered which question, under which entitlement, and whether it turned out to be right [A]. Source Intelligence accumulates only where the Passport existed from the first datum [D] (data-plane.source-intelligence, S5).

The retention case that runs the other way

In sanctions and politically-exposed-person screening, the match evidence must be retained with the screening decision, because a false positive is a consequential harm to a real person and the organisation has to be able to show why it decided as it did [E]. That is a retention requirement that runs against the usual minimisation instinct, and it is modelled explicitly in the Passport rather than left to a policy document [D] (data-plane.provenance-passport, S4).