# Temporal governance and governed attribution

Status: proposed architectural extension, 10 October 2026. Requirements below describe intended behavior, not implemented or validated capabilities. MUST, SHOULD and MAY apply only to a future implementation claiming this extension. This document does not change the existing Core Profile, Wrapper validator, JSON-LD context, integrity schemas or conformance levels.

## Purpose and architecture

Support collective learning, knowledge reuse and traceable responsibility while keeping control close to the source. Knowledge, contribution evidence, personal identity, authority and entitlements have independent lifecycles. There is no default global people index, individual productivity dashboard or unrestricted contributor ranking.

Wrapper → Mapper → Tracker remains the launchpad. Wrapper would bind versioned provenance and policy references to objects. Mapper would preserve local meaning and apply relationship-level visibility and linkability review. Tracker would record authorised changes, corrections and reuse with protected evidence and retention. These responsibilities do not imply current runtime enforcement.

A local context node would hold protected identity mappings, source evidence, authorisation and keys. The common registry would expose only explicitly permitted discovery metadata and node endpoints; discovery grants no right to reuse. A Mediator/policy service would resolve policy conflicts or refer them to an authorised human. Cultivator is a future component for learning proposals and optional community reciprocity; it is outside the launchpad.

## Separate records and boundaries

Conceptual fields below are design requirements, not a frozen wire schema. Existing object identifiers and participation records remain valid; contributions add references rather than replacing provenance.

| Record | Proposed minimum semantics | Boundary |
| --- | --- | --- |
| KnowledgeObject | id, type, version, custodian, source_locator, jurisdiction, classification, purpose, legal_basis, status, policy_ref | Knowledge identity is distinct from a person and from a payload. |
| Relation | id, subject, predicate, object, provenance, confidence, visibility, classification, validity_interval, policy_ref | Each edge needs its own publication and processing decision. |
| Contribution | contribution_id, object_or_edge_ref, event_type, timestamp, evidence_ref, attribution_mode, attribution_policy_ref | Evidence of contribution does not establish ownership, identity or compensation. |
| IdentityMapping | local mapping id, context-scoped actor reference, protected identity reference, controller, purpose, legal_basis, access_policy, retention_review | Stored locally with separate authorisation; never included by default in discovery or receipts. |
| Mandate | id, organisation, role, authority_basis, scope, validity_interval, delegations, responsible_controller, evidence_ref | Role and identity disclosure alone do not establish authority. |
| Entitlement | id, restricted claimant_ref, type, contractual_or_legal_basis, status, expiry_review, settlement_ref | Financial and moral-rights claims survive visibility changes where applicable. |
| GovernanceEvent | id, target, transition, trigger, authorizer, mandate_ref, decision_basis, recorded_time, effective_time, policy_version, proof_ref, propagation_status | Record what was authorised and why without making protected evidence public. |
| ReciprocityAgreement | id, community, membership_policy, eligible_events, allocation_rules_version, governance_process, opt_in_evidence, dispute_procedure | Voluntary agreement, distinct from attribution and entitlement. |

A node MUST distinguish controller, custodian, contributor, rights-holder and mandate-holder. Protected records MUST have independent access and retention policies. Anonymous public attribution may coexist with a restricted claimant mapping; that arrangement is not full anonymization of the protected records. Missing identity is unknown, not proof of anonymity. Use the existing actor identity and selective disclosure requirements alongside this extension.

## Temporal governance

The proposed extension state is separate from existing lifecycle vocabularies. Candidate states are draft, active, restricted, review_due, archived, anonymized and deleted. Superseded and disputed are independent flags. No enum migration is specified here. Keep effective time distinct from recorded time and support historical policy and mandate versions.

| Trigger | Required decision and transition |
| --- | --- |
| Retention or purpose review due | Enter review_due, notify custodian and evaluate policy; elapsed time MUST NOT itself authorise deletion. |
| Consent withdrawn where consent is the basis | Reassess affected processing and onward restrictions; determine other applicable obligations explicitly. |
| Mandate expired or revoked | Refuse new actions requiring that authority at execution time; preserve authorised historical evidence for its lawful period. |
| Restriction or policy change | Re-evaluate future discovery, retrieval and reuse; invalidate affected cached projections and propagate notices. |
| Authorised anonymization | Remove identifying mappings where lawful, assess residual graph linkability, record review scope and verification evidence before claiming anonymization. |
| Authorised deletion | Remove controlled copies according to policy, including indexes, embeddings and caches; track backup expiry and replica disposition, then request remote action. |
| Archival obligation or legal hold | Preserve required evidence with restricted access; document conflict, responsible institution, basis and review date. |
| Attribution visibility change | Update permitted projections independently of protected entitlement and accountability records. |

A transition MUST reference an authorised decision, current mandate, policy version and evidence. Unresolved authority or policy conflicts MUST block the requested action and enter review; they MUST NOT widen access. A node MUST report partial deletion, retained backups and failed remote requests explicitly. Review_due does not imply unrestricted processing: applicable access and purpose limits remain in force.

## Governed attribution and traceable accountability

Attribution modes may be public, organisational, role-based, pseudonymous, restricted or anonymous. Policy MUST govern contribution existence, fields, relationships, history, search and exports as well as display names. Changing attribution MUST NOT silently terminate a valid entitlement or transfer it to a commons pool.

Keep lawful evidence of authority, decisions and challenges in an authorised local archive. Tracker history would append corrections rather than rewrite evidence while records are lawfully retained. Append-only semantics MUST NOT require indefinite immutable personal data: payloads and protected proof references need retention and erasure design. Public keys, signatures, hashes and timestamps may themselves permit linkage. A signature proves only the scoped cryptographic claim, not source truth or lawful authority.

## Privacy-aware federation

Default-deny publication of personal-data-bearing objects and edges. Public discovery fields require explicit policy and graph-aware assessment of combined dates, roles, locations, rare attributes and linked nodes. Pseudonymization is not anonymization. Assess controller responsibilities, purpose, lawful basis and jurisdiction for each processing operation; fields alone establish no legal compliance.

Proposed signed policy envelopes carry envelope id, source node, target/version, profile/version, jurisdiction, controller, purpose, permitted scope, retention reference, policy version, effective interval, audience, key reference and replay-protection data. A receiving node MUST reject unsupported profiles, invalid signatures, unauthorised audiences, expired authority and uses incompatible with source conditions. Policy conflicts go to review, never permissive merging.

Candidate events: object.registered, relation.validated, mandate.granted, mandate.expired, policy.changed, access.revoked, anonymization.verified, deletion.requested, deletion.acknowledged, contribution.reused and claim.disputed. An event type is not proof the claimed operation occurred. Binding and compatibility with Relational Trace require review before wire-format adoption.

Consumers MUST deduplicate by issuer and event id, detect conflicting duplicate payloads, protect against replay and stale/out-of-order versions, and retain minimal processing evidence. Acknowledgements MUST identify the target version, request, result, decision basis and applied time; receipt alone is not successful deletion. Retries require bounded backoff and an unreachable-node queue. Propagation states distinguish pending, acknowledged/applied, refused, failed and unreachable; unresolved exceptions remain visible to authorised custodians. Remote nodes may retain material under applicable obligations. Federation is a request-and-evidence workflow, not universal recall or deletion enforcement.

Proposed governance capability identifiers, separate from existing numeric conformance levels:

- TG-L0: permitted metadata discovery.
- TG-L1: policy-aware reuse and lineage.
- TG-L2: lifecycle propagation and explicit exceptions.
- TG-L3: optional governed reciprocity.

These are candidates, not certifications. A node MUST advertise only tested capabilities and identify profile version, evidence, limitations and unsupported operations. No current demonstrator claims these levels.

## Self-organizing reciprocity

Research hypothesis: value can emerge through organised relationships and transformations. Reuse counts and graph centrality alone establish neither causation nor fair compensation. Communities may choose voluntary recognition or allocation rules; the protocol operator does not decide who deserves value.

A future Cultivator extension would require versioned opt-in agreements, eligible-event evidence, authorised votes, dispute and appeal procedures, and auditable allocation and settlement receipts. Membership does not transfer rights. Anonymous attribution with a valid claim requires protected handling; unreachable claimants require lawful unclaimed-entitlement treatment. Transfers to a commons pool require documented authority and agreement. Expiry requires rights review. Non-monetary reuse records provenance without inventing a monetary valuation. Financial distribution is deferred until legal, institutional and fairness review.

## Acceptance backlog and release gates

All scenarios below are unimplemented acceptance requirements, not test results. Use synthetic Node A/Node B data: A registers knowledge with locally protected identity; B reuses a permitted projection; a validator contributes evidence; retention review changes visibility. Record each expected refusal, retained record and propagation exception.

| Scenario | Required evidence |
| --- | --- |
| T1 Discoverability | Unauthorised searches, relation traversal, exports and history expose neither restricted identities nor sensitive edges. |
| T2 Reuse lineage | Every derivative references validated source versions and contribution events, with permitted evidence. |
| T3 Mandate | Expired/revoked authority cannot start a new action, including after a queued request was accepted. Historical authority evidence remains scoped. |
| T4 Privacy transition | Reviewer can reproduce linkability assessment and visibility decisions, including caches, embeddings and retained archives. |
| T5 Federation | B applies and acknowledges changes or remains an explicit unresolved exception; duplicate, replay, out-of-order, conflict and unreachable cases are exercised. |
| T6 Rights | Removing public identity does not terminate a valid entitlement or appropriate funds. |
| T7 Collective learning | No global person index, productivity dashboard or unrestricted contributor ranking is introduced. |
| T8 Reciprocity | Voluntary community rules yield auditable allocation and disputes without automatic rights transfer; future sandbox only. |

Gate 1: review terminology, candidate contracts, threat model, policy matrix and legal responsibilities. Gate 2: reproducible two-node demonstration of identity separation, authority, lifecycle, accountability and failure handling. Gate 3: independent review of anonymization and entitlement cases before any corresponding public performance claim. Implementation order: data contracts and fixtures; local governance; two-node propagation; learning demonstration; future reciprocity sandbox. No schedule or production readiness is implied.

## Open validation decisions

Minimum discoverable metadata and graph risk thresholds; operation-specific controller roles; anonymization verification scope and reviewers; archival/deletion conflicts; moral rights and employee contributions; identity resolver and key custody; retention for proofs, backups and embeddings; receipt/event compatibility; governance capture and minority protections; evidence of organisational benefit. Standards alignment with PROV-O, ODRL, DPV and JSON-LD is a design direction requiring field-level review, not a conformance claim.

Source: supplied Intertween Technical Development and Communication Memo v2_1 and its implementation-first addendum. The source's body labels itself working proposal v2.0. Existing source snapshots remain unchanged.