Rights/Canon Breach

1. Technical access does not establish authorization to publish

A system may successfully retrieve a file, passage, image, or version and still lack answers to two separate questions: “Is this the project-approved current source/version?” and “Does the recorded permission or policy cover the intended use?” This lesson keeps those questions separate so retrieval success is never converted into authorization or canon integrity by assumption.

2. Rights and canon are independent axes

Canon is a project-governance concept in this lesson: which source and version is the approved reference for the product, course, or knowledge base. Rights/Permission asks something else: under the supplied metadata and policy, which uses are allowed, restricted, or unknown. An item can be canonical but outside the permitted adaptation scope, or permitted for reproduction while using a superseded non-canonical version.

3. Citation is not permission

A citation improves provenance or attribution; it does not create permission to reproduce, adapt, or distribute. WIPO’s copyright overview distinguishes economic and moral rights and notes that limitations and exceptions depend on national law. [WIPO-COPYRIGHT] In this lesson, citation presence is therefore evaluated separately from rights_metadata and permission_scope, and missing rights information remains UNKNOWN.

4. Canon version must be explicit and auditable

Recording only the source name is not enough. Each item should carry at least source_id, selected_version, and approved_canon_version. If the selected version differs from the governance-approved version, the fixture has a canon breach even when permission is otherwise sufficient. That is a governance decision, not a legal ownership conclusion.

5. Compare permission scope with intended use

A license, consent, or policy record may allow reproduction but exclude adaptation, or permit internal use while excluding public release. “Permission exists” is therefore not a sufficient boolean. The intended use must be compared with the recorded scope. All scopes in the lab are synthetic and decisions are limited to those supplied policy records.

6. Keep legal boundaries separate from technical boundaries

WIPO notes that copyright limitations and exceptions vary across countries, while the U.S. Copyright Office describes U.S.-law rights including reproduction, derivative works, and distribution and distinguishes protected expression from ideas, procedures, methods, and systems. [WIPO-COPYRIGHT] [USCO-CIRC1] These sources frame the lesson; they do not let the lab decide real-world ownership, fair use, license validity, or legal exceptions.

7. Generated or adapted material still needs provenance

If content is AI-generated, summarized, or adapted, the relevant source or input records and the applicable project policy still need to be known. A “generated” label does not create clearance. If provenance required to apply the policy is missing, the state stays open or the item is quarantined until evidence is available.

8. Rights & Canon Integrity Review Record v1

The owned artifact is a row-level record: Item ID, Source, Selected Version, Approved Canon Version, Canon Status, Rights Metadata, Permission Scope, Intended Use, Attribution Requirement, Provenance, Policy Decision, Legal/Policy Uncertainty, Review Trigger, and Release State. A reviewer must be able to reconstruct the decision from visible evidence rather than hidden reasoning.

9. Do not collapse the four-state matrix

There are four important combinations: canon OK + rights OK, canon OK + rights blocked/unknown, canon breach + rights OK, and canon breach + rights blocked/unknown. Only the first can become release-eligible under the fixture policy. The other states require different containment and recovery, so collapsing them into a generic “copyright problem” leads to the wrong repair.

10. UNKNOWN is a valid state, not a reporting defect

When rights metadata is missing, scope is ambiguous, provenance is incomplete, or the question genuinely requires legal interpretation, the system must not invent certainty. UNKNOWN/REVIEW means the evidence is insufficient for release. The lesson deliberately separates a deterministic policy breach inside the fixture from an unresolved legal or policy status.

11. Containment stops release without destroying evidence

Appropriate containment can include quarantine, withholding, returning to an approved canon version, narrowing the intended use, or routing to human review. Removing citations, deleting metadata, or swapping content without preserving provenance is not a repair; it damages the evidence chain. Containment should stay reversible and auditable.

12. Recovery must change the failed dimension

For a canon breach, recovery means selecting or approving the correct version and rerunning the gate. For a rights-scope breach, permission scope or intended use must become policy-compatible. For missing rights metadata or provenance gaps, evidence must be added or the case must remain under review. A green rerun with no relevant evidence change is not defensible closure.

13. Test closure with changed-context transfer

After a repair, do more than rerun the original fixture. Use a changed case where permission remains the same but the approved canon version changes. If the system copies the prior label, it will miss the new breach. In this lesson’s transfer case, an item is initially release-eligible but must return to quarantine after canon authority changes.

14. Lab: eight fixtures and 64 assertions

The lab includes eight synthetic cases: allowed baseline, superseded version, adaptation outside permission, unknown rights metadata despite a citation, missing required attribution, incomplete provenance for a generated summary, permitted but non-canonical content, and a transfer case where a canon change invalidates prior release eligibility. Each case yields eight outputs, for exactly 64 admin assertions.

15. Exit checklist and responsibility boundary

Before exit, you should be able to state canon status, what the rights metadata says, whether intended use is inside scope, whether attribution and provenance are complete, the release action, residual uncertainty, and what evidence would change the state. This is a governance and evidence-handling lesson, not legal advice; questions beyond explicit supplied policy require human review or qualified counsel.