Rights, Embargo, and Reveal Rules

1. The real problem: rights=yes is a dangerous model

An asset can have an authoritative source, exact digest, and well-supported claim while still being impermissible for the intended publication. “Rights” is not one bit. You need the permission basis, authority to grant, exact scope, attribution obligations, commercial/derivative constraints, contractual or embargo limits, and the audience/time allowed to reveal it. This lesson replaces rights=true with an auditable policy matrix.

2. Keep four layers independent

Separate at least Rights Basis, Use Scope, Embargo/Contract, and Reveal State. Rights Basis records where permission came from. Use Scope covers purpose, media, territory, commercial/derivative use, and attribution. Embargo/Contract captures time or contractual restrictions. Reveal State captures who may see or publish the asset now. A green result in one layer does not make the others green.

3. Bind rights decisions to identity and version first

A rights decision must bind to the same bytes/version that will be used. A stable asset_id is useful for lookup, but publication needs an exact asset_version_ref or digest. If bytes or ingredients change, do not inherit the old rights decision. CON-001 owns source authority/version binding; this lesson consumes that binding and evaluates permitted use.

4. Record the permission basis explicitly

A policy row should identify whether the basis is ownership, a CC license, a custom grant, a contract, a public-domain assertion, or unresolved. Store an evidence reference and the exact terms/version. Labels such as “from the web,” “free image,” “we have permission,” or generic “CC” are not sufficient publication evidence and remain UNKNOWN or NEEDS_REVIEW.

5. Creative Commons: what irrevocability means

Creative Commons guidance says its licenses are irrevocable once applied and that the licensor should own or control the copyright needed to license the work. That does not mean every use is allowed. Evaluate the exact license and its conditions, and do not infer the status of a particular MAKNOW asset, side contract, or third-party right from the general rule.

6. Turn BY / SA / NC / ND into computable conditions

Represent CC conditions as separate fields: attribution required, ShareAlike obligation, commercial allowed, and derivative/adaptation sharing allowed. NC constrains commercial use; ND constrains sharing adaptations; SA imposes compatible licensing conditions for distributed adaptations. Read these from the exact license instead of guessing from a filename or memory.

7. Custom grants require explicit scope

A custom permission can be limited by purpose, media, territory, duration, audience, derivatives, commercial use, or campaign. A grant for internal_preview does not automatically cover public_commercial_campaign. If territory or derivative permission is absent from the evidence, do not turn it into true; preserve UNKNOWN, NEEDS_REVIEW, or NEEDS_COUNSEL.

8. Embargo is a separate gate

embargo_until controls reveal timing, not ownership or licensing. Rights may be fully established while public reveal is still too early; return BLOCKED_BY_EMBARGO. Conversely, the end of an embargo does not repair missing rights. Record a timezone-aware decision timestamp and bind the result to it.

9. Reveal audience is not the same as technical reachability

An asset may be revealable to INTERNAL_REVIEWERS or PARTNER_PREVIEW but not PUBLIC. Compare reveal_audience to the requested audience explicitly. A reachable URL or stored file is not proof of reveal permission. Requests outside the allowed audience remain blocked.

10. Attribution must be executable

If attribution is required, attribution_required=true is not enough. Keep the data needed to perform attribution—such as title, author, source, license, and required notices—and test completeness. When attribution is mandatory but the required data is missing, ALLOW is too strong.

11. Contract restrictions can coexist with a license

A public license and a private contract can appear in the same evidence set. This lesson does not issue legal rulings about conflicts. It records both and fails closed when a decisive contractual restriction is unresolved. An external standard never substitutes for the actual governing authority of the asset.

12. Borrow SPDX syntax discipline, not universal media law

SPDX License Expressions provide a machine-readable way to combine license identifiers and AND, OR, and WITH relationships. That structure is useful for parsing and audit, but SPDX is primarily a software-licensing standard. Media rights, releases, personality rights, and contractual restrictions that do not fit should remain separate fields rather than being forced into an SPDX expression.

13. Use typed fail-closed decisions

Emit precise states: ALLOW only when every required gate is established; BLOCKED_BY_EMBARGO for timing; BLOCKED_BY_LICENSE for incompatible license conditions; BLOCKED_BY_REVEAL for audience restrictions; NEEDS_REVIEW for resolvable missing evidence; and NEEDS_COUNSEL for decisive legal uncertainty. Include a reason and a recheck trigger.

14. Transfer: same bytes, new intended use

Apply the Bible transfer: keep the same source bytes, change use from internal_preview to public_commercial_campaign, and add a derivative crop. Do not copy the old decision. Re-evaluate purpose, commercial use, derivative permission, attribution, embargo, and reveal audience. If the original grant only covered preview or derivative permission is unclear, remain restricted.

15. Final artifact and non-claims

Rights–Embargo–Reveal Policy Matrix v1 should carry Asset ID/Version, Rights Basis, Owner/Grant, License Version, Attribution, Derivative/Commercial, Territory/Media/Purpose, Embargo Until, Reveal Audience/State, Contract Restriction, Evidence Ref, Decision, Reason, and Recheck Trigger. This lesson is not legal advice, does not choose canonical sources, does not score claim confidence, does not own approval revocation, and does not build the final release manifest.