Information Use License

Version

v4 · 2026-08-30 · History

Prime #

1381

Origin domain

Communication & Media Studies

Subdomain

information governance → Communication & Media Studies

Aliases

Post Transmission Use License, Downstream Use Restriction, Handling Caveat

Related primes

Commitment

Core Idea

An information use license transmits information together with a durable permission structure: an affirmative grant naming what the recipient may do with what it now knows, a residual prohibition covering everything else, and a terminating event — release, upgrade, exception, expiry, or revocation — at which the permitted set changes. The grant is the defining half. A rule that only forbids is a restriction; a license is recognizable because a party is positively authorized to do something with information it would otherwise have had no standing to use. ^[1]

Seven roles carry the structure, each load-bearing differently: identifiable information, a grantor with standing to set terms, a recipient, an enumerated set of permitted and prohibited purposes, a duration or terminating event, a propagation rule governing later recipients, and a remedy attaching on breach. Remove the grantor's standing and the terms are a wish; remove the propagation rule and the structure stops at the first hop; remove the terminating event and what has been granted is not a license but a conveyance.

What separates this prime from every other permission structure is an asymmetry between the thing granted and the thing transferred. An access decision is reversible in the sense that matters: withdraw the key and the party cannot read again. A use license operates on a payload that cannot be recalled, so the recipient's knowledge only ever grows and the license governs its licit actions and nothing else. Every awkward property follows — enforcement is retrospective, remedies compensate rather than restore, revocation constrains the future without unwinding the past, and the instrument's real work is done by whatever keeps a recipient willing to be bound after it already holds what it wanted. ^[2]

Structural Signature

A grantor with standing + identifiable information transmitted to a named recipient + an enumerated set of permitted downstream acts with a complementary prohibited set + a duration or terminating event + a stated rule for what binds the recipient's recipients → any downstream act outside the permitted set is a breach by the recipient, and the terms re-attach to every later holder the propagation rule reaches.

The formula is stated over acts — not over content, parties, or channels. That is the diagnostic edge: a candidate describable in full without naming a single thing the recipient might do is not an instance, however much licensing vocabulary surrounds it.

Recurring features:

• An affirmative grant with a residue rule behind it. Terms enumerate what is allowed and cannot enumerate what is not, so every license needs a rule for the acts nobody considered. A regime that never states one still has one, discovered under dispute and applied retroactively.
• Standing separated from possession. The power to set terms rests on authorship, custody, originator status, delegated authority, or control of the channel, never on merely holding a copy; the two roles routinely sit with different parties.
• Four independent axes. Purpose, recipient, form, and time vary separately, so an act can be licit on three and fail on the fourth: an approved analyst running an approved analysis on identified rather than aggregated records is outside the grant.
• A terminating event rather than a countdown. Grants end by clock, by named occurrence, by upgrade to a wider set, by a release someone must issue, or by revocation — and which applies determines who holds the trigger, frequently not the grantor.
• A propagation rule with exactly three settings. Onward transfer extinguishes the terms, replicates them onto the next holder, or narrows them. There is no fourth option, and terms that do not choose have chosen the first.
• A payload that cannot be returned. The obligation exists because deleting the copy does not restore the prior state, and nothing in the structure intervenes at the moment of use — so remedy follows detection, and detection follows the act. ^[3]

What It Is Not

The prime makes no claim that the information is secret, scarce, or sensitive. Terms attach routinely to material anyone can read: a public archive released for non-commercial analysis only, a corpus published with declared conditions on training, a dataset free to download and restricted in resale. The objection that terms are meaningless because the material is public misreads what is constrained — not the world's ignorance, but this recipient's action set.

It makes no claim that the grantor owns anything. Standing can come from authorship, custody, originating status, a subject's delegation, or control of the channel of arrival; ownership is one source among several and often not the operative one. A party can license facts nobody owns, and can hold a copy of something it has no power to license at all. ^[4]

It is not a technical enforcement mechanism, and it is not simply a delay. Software that meters or refuses to render implements a license and is not one; a grant enforced by professional exclusion alone, or by nothing at all, is structurally identical to one backed by an audit right. A term that merely postpones publication is the degenerate case, with a single time axis and an empty purpose axis, and reading every license as an embargo produces the common failure of specifying when a recipient may act and never what it may do.

It is not the protected-expression species. Licensing over copyrightable work is the most familiar instance and the least representative, because there the constraint runs against the world over a class of content; here it runs against a particular recipient in virtue of a particular transmission, and reaches bare facts no expression right would touch.

Finally, it says nothing about whether terms are fair, negotiated, understood, or read: a grant imposed as a non-negotiable condition of receipt is the same structural object as one bargained between equals. Nor does it promise permanence, expiry being a member of the structure rather than a defeat of it.

Broad Use

Institutional practice is dense with the relation. Research data use agreements name an approved analysis and forbid re-identification. Biobank and registry consent tiers carry a permitted-research-category forward from the donation into studies nobody had conceived at collection. Intelligence and incident-response communities attach handling caveats under which the originator keeps a say over onward passage, marking reports so the sharing limit travels in the same envelope as the content. Journalism runs a ladder of source terms — on the record, on background, not for attribution, off the record — in which one sentence carries four different permitted sets depending on which was agreed before it was spoken. Consumer reporting conditions release on the requester's stated purpose, which must be one the statute enumerates and no other; commercial data supply, deposit conditions, and laboratory material transfer run on the same shape. ^[5]

Engineered systems reproduce it without borrowing the vocabulary. A capability token carries a scope string constraining what its bearer may do with what it may already read. Rights-expression languages encode permitted acts, parties, and expiry in machine-checkable form. License headers travel inside the same archive as the code they govern; dataset documentation states intended and out-of-scope uses beside the artifact; declared crawl and training policies published alongside a corpus are unilateral grants to an unnamed class. Information-flow systems propagate a purpose tag to every derived value, so terms follow the computation rather than sitting at its entrance. Remedy varies wildly and the propagation setting varies deliberately; what does not vary is that a party already holding the information is told which of its acts are licit. ^[6]

Clarity

The confusion the prime dissolves is a false binary in sharing decisions. Deliberation often collapses onto one question — does this go out or not — and once answered the matter is treated as closed; that diagnosis of practice is this entry's own rather than a documented finding. The license shows that question to be malformed, because release and authorization are separate acts that merely tend to be scheduled together.^[7] The genuine variable is not whether to transmit but which permitted set to attach on transmission, and the binary hides that continuum behind a yes and a no. ^[8]

Seeing only the binary produces two failures that look unrelated and are the same error. The first is over-refusal: a request denied because full release would be unacceptable, when a narrow grant covering exactly the stated need was safe and never considered. The second is unconditioned release: the yes is given, nothing is attached to it, and the organization is later astonished by a secondary use it never contemplated and never forbade. Both decided along the wrong axis. Naming the license turns a gate into a dial.

A smaller muddle dissolves alongside it — the assumption that agreeing to receive is agreeing to be bound. Accepting delivery establishes possession and settles nothing about authority, and a recipient never presented with terms holds the information under whatever residue rule local practice supplies. The most consequential moment is therefore the one most often skipped: the instant at which the grant is stated, which is the only instant at which stating it is cheap.

Manages Complexity

What the abstraction lets a grantor stop tracking is the individual use, one request at a time, forever. Without it, a party that shares becomes a permanent adjudication bottleneck whose queue grows with recipients times contemplated uses times elapsed time. The license replaces that stream with a single object the holder evaluates locally, asking whether the act it wants falls inside the terms it already has. Decisions that were central and serial become distributed and parallel. ^[9]

A second thing that drops out is the relationship. Because terms attach to the information rather than to the parties' continuing dealings, none of the scaffolding that produced the transmission need survive for the constraint to hold — the project can close, the agreement lapse, the staff leave. Nobody keeps a relationship alive merely to keep an obligation alive.

A third is the recipient's internal architecture. Terms stated over acts rather than systems mean a grantor need not know how the recipient stores, indexes, or processes anything to know what it has authorized — which is what makes it possible to grant to an organization whose stack one has never seen, and why the operative question in a dispute is what was done rather than what was built.

Abstract Reasoning

The prime licenses a diagnostic run in order, each step able to end the analysis with its own verdict.

First, locate the grant. Ask what the recipient may now do that it could not have done before; if the honest answer is nothing, the object is a restriction in licensing vocabulary and the useful questions lie elsewhere.

Second, test standing. Ask whether the grantor could have made the same grant to a different party, and whether its power depends on anything beyond holding a copy. If standing rests on possession alone, two roles have been merged that come apart precisely when value is at stake.

Third, resolve the residue. Take a plausible use the terms neither permit nor forbid and ask which way it falls; whatever answer local practice supplies is the license's most consequential unwritten clause.

Fourth, run the propagation rule for one hop. Name a specific second-order recipient and state what binds it; inability to answer is itself the answer, and the terms end at the first recipient whatever the document says.

Fifth, find the terminating event and who holds its trigger. A grant ending on a release nobody is obliged to issue does not, in practice, end.

Two counterfactuals sharpen the verdict. The revocation test asks what changes the instant the grantor revokes: if the recipient must stop doing certain things while continuing to know everything it knew, the object is a use license; if the answer requires it to un-know, no license is present and the case belongs upstream. The stranger test asks whether a party that never received the information could have granted the same permission to the world — if yes, the constraint is indexed to a class of content and behaves like an expression right; if no, it was constituted by this transmission to this recipient.

Knowledge Transfer

The seven roles recur across substrates, and so do the grant-plus-residue shape, the three-setting propagation rule, the monotone-knowledge asymmetry, and the fact that enforcement necessarily sits downstream of the act it addresses. A lawyer drafting flow-down clauses, an archivist writing deposit conditions, and an engineer designing scope strings for a token service are working the same problems in different vocabularies. The question worth carrying between them is propagation — what becomes of the grant when the material moves on — which the major substrates answer in operative text: CC BY-SA 4.0 and GPLv3 give each downstream recipient a licence directly from the original licensor, and OAuth 2.0 confines a refreshed token to identical or narrower scope. ^[10]

What does not travel is nearly everything with content in it. Standing rules are domain-fixed: authorship settles the question in one field, originator status in another, a subject's delegation in a third, bare custody in a fourth, so an intuition carried across that line yields grants void exactly where they are relied upon. The definition of a use travels least of all, and is where most cross-domain arguments live — reading, indexing, quoting, aggregating, deriving a statistic, and fitting a model are one act in some regimes and six in others, so disputes that look like disagreements about permission are usually disagreements about individuation. Revocability does not travel: some settings make a grant irrevocable once relied upon, others leave it terminable at will. Neither does the residue default, the remedy, the duration, or the identity of whoever may issue a release. Carrying the skeleton across is productive; carrying any of these is the reliable way to get a transfer wrong while believing it succeeded.

Examples

Formal/abstract

Model a license as a structure over an alphabet of downstream acts. Let A be the set of things a holder might do with the information — read, quote, aggregate, join to another source, re-identify, publish, resell, derive a model. A license is a permitted set P contained in A, a residue rule deciding the status of acts outside P that nobody enumerated, and a propagation operator mapping the license a holder bears to the license its transferee bears. Terms that read as complete on paper almost always specify P and leave the other two implicit. ^[11]

Composition is where the structure bites. If a first party grants to a second and the second transfers onward to a third, the license the third bears is the operator applied to the original, and soundness requires that operator to be contractive: the permitted set it produces must never exceed the one it consumed. Regimes that let a holder grant onward more than it holds admit permission laundering — a chain of transfers, each locally valid, whose composition authorizes an act no grantor ever authorized. The defect is invisible at every individual hop and visible only in the composite, which is why it surfaces late, in the hands of a party that did nothing wrong, and traces to no single bad decision. ^[12]

Mapped back: P is the affirmative grant; the residue rule is the feature no enumeration can supply; the propagation operator is the propagation rule, its three settings being the extinguishing, contractive, and unsound expansive cases. Contractivity is what flow-down drafting tries to guarantee in language and what standing defects silently break. The model also bounds remedy: revocation shrinks P and cannot shrink a knowledge set that only grows, so any remedy presupposing restoration asserts what the algebra cannot express. And it explains why disputes concentrate on the residue rule, the one clause that costs nothing to omit and decides every unforeseen case.

Applied/industry

An issuer distributes quarterly results to accredited financial reporters two hours before the market opens. The grant is specific: recipients may read the release now, draft copy against it, and seek comment from analysts who are themselves under the same terms. The prohibition is equally specific: nothing may be published, quoted, characterized, or traded on before the stated release time. The terminating event is a clock, and at that instant the permitted set widens for every recipient at once without anyone issuing anything. ^[13]

Propagation decides the interesting cases. A reporter passing the release to a desk editor is a replicating transfer, and the editor becomes a holder on the same terms. A recipient who mentions the number to a colleague on a trading desk produces the hard case: the colleague never received the terms, so the license — constituted at transmission to a named party — does not reach them. Whether anything binds that third party is a question the license cannot answer, and what regimes bolt on at this seam is separate machinery aimed at the information's status rather than at any grant.

Enforcement is the instructive part. At the moment of maximum temptation the license is unenforceable in the ordinary sense: nothing prevents early publication and the information is already in hand. The operative remedy is removal from the accreditation list — the loss of a stream of future grants — so the instrument is priced against that stream and holds precisely to the extent the stream is credible and the breach detectable.

Mapped back: standing comes from controlling the channel rather than owning the facts, which are nobody's property once stated. Permitted acts are enumerated over an act alphabet, the residue is covered by convention rather than silence, and the terminating event is a clock with a single trigger-holder. Propagation is replicate-within-the-accredited-population and extinguish outside it, and the trading-desk colleague is the standing counterexample to the intuition that terms travel with information rather than with transmission. The accreditation list standing in for a remedy is what the irreversible payload forces: with no way to intervene at the act and none to restore the prior state, the only lever left is the recipient's interest in the next grant.

Structural Tensions

T1 — Unenforceable exactly where it matters most. Once the recipient holds the information, no term physically prevents a use; compliance is voluntary from that instant onward. Enforcement runs backwards from a visible downstream artifact to an inference about what produced it, so the acts a license genuinely deters are the conspicuous ones — publication, resale, a missing attribution. Purely internal uses leave nothing to run backwards from. The instrument is strongest against defections that would have surfaced anyway, and weakest against the quiet ones a defector most wants.

T2 — The propagation rule has three settings and each one fails. Extinguishing terms at transfer turns the first recipient into a laundering point through which any restriction can be washed clean. Replicating them onto every later holder is correct in principle and unadministrable at depth, since by the fourth hop no party can name the grantor or produce the terms. Narrowing at each step preserves soundness and strangles the circulation the grant existed to enable. Every regime picks one setting and absorbs its characteristic failure.

T3 — Purpose limitation forecloses the findings worth having. A permitted-purpose set is written before anyone knows what the information will show, so it enumerates only uses already imagined, while the results that justify sharing at all are disproportionately the ones nobody anticipated. Tighten the set enough to constrain anything and it forbids the secondary analysis that could not have been specified in advance; loosen it enough to admit that analysis and it stops excluding anything. Regimes answer with an exception channel, relocating the problem onto whoever staffs it.

T4 — The license outlives the arrangement that produced it. Terms attach to information and survive the project, the agreement, the vendor, and the people who negotiated them. What accumulates is a stock of encumbered holdings whose grantor has dissolved, whose intent nobody recorded, and whose release no living party can give. Holders face a restriction they cannot lift and cannot confidently interpret, and the rational response — read it as prohibitive and leave the material alone — quietly converts durable permission into permanent unavailability.

T5 — Standing to grant and possession come apart under load. The party holding a copy is frequently not the party entitled to set terms: custodians license what subjects hold rights in, aggregators license what contributors supplied, intermediaries license what merely passed through. Because grants get made by whoever is holding when the request arrives, validity goes untested until value has been created downstream — at which point unwinding is expensive, incentives favour not asking, and defective standing is cured by settlement rather than structure.

T6 — Revocability and reliance pull directly against each other. A recipient cannot build anything on a grant that may vanish, so recipients press for irrevocability and grantors who want investment concede it. But an irrevocable grant over information concerning a subject who may later withdraw is a promise the grantor may lose the power to keep. Wind-down periods and grandfathered outputs split the difference, protecting the investment already made while leaving the underlying conflict in place rather than resolving it, which is why the same argument recurs at every renewal.

Structural–Framed Character

Information Use License sits at the midline of the structural–framed spectrum — mixed-framed, aggregate 0.5, with every diagnostic at 0.5. The skeleton is a permission that rides with the payload: information deliberately transmitted to an identified recipient, terms enumerating permitted and prohibited downstream acts rather than mere access, a restriction that survives transmission, a defined party or event able to release, upgrade, expire, or override it, and breach defined over downstream use rather than receipt.

Institutional origin at 0.5 does the most work here. A grantor or governing authority, propagation rules for later recipients, and enforcement or remedy conditions are named requirements inside the identity, not context around it. What holds it at the midline is a relational core: the permission travels with the information instead of gating it, and the recipient's knowledge cannot be undone by the restriction. Research data, intelligence, genomic records, journalism, and interorganizational sharing keep those information–permission–purpose–duration roles.

Vocabulary travels partially at 0.5 — license, grantor, breach, remedy carry a contractual accent each field restates. Evaluative weight is 0.5: permitted and prohibited are normative by construction, though the prime describes the structure rather than endorsing terms. Human-practice-bound is 0.5: parties, obligations, and remedies presuppose a practice of granting and being bound. Import-versus-recognize is 0.5, since where sharing already runs on terms one recognizes the structure, while elsewhere the grantor–terms–propagation framing is imported.

The frame comes with the prime: name the grantor, the purposes, the duration or event boundary, and the propagation rules explicitly, and reserve it for questions of downstream use rather than who may retrieve.

Substrate Independence

Information Use License is a highly substrate-independent prime — composite 4 / 5 on the substrate-independence scale. The travelling structure is a set of roles rather than a body of law: information transmitted to a named recipient, a grantor with standing to set terms, an enumerated set of permitted acts against a complementary prohibition, a terminating event, and a rule for what binds the recipient's own recipients. Those roles are checkable without translation in research data agreements, intelligence handling caveats, commercial dataset terms, genomic consent, source protection in journalism, and interorganizational sharing pacts. What holds it below the ceiling is a normative commitment the formula cannot shed — standing, and a remedy that bites — so its reach stops at human institutions and never touches formal or physical substrates.

• Composite substrate independence — 4 / 5
• Domain breadth — 4 / 5
• Structural abstraction — 4 / 5
• Transfer evidence — 4 / 5

Relationships to Other Abstractions

Current abstraction Information Use License Prime

Parents (1) — more general patterns this builds on

• Information Use License is a kind of Commitment Prime

  An Information Use License is the already-transmitted-information species of a present act binding future conduct to another party under release and breach terms.

Children (2) — more specific cases that build on this

• Off the Record Domain-specific is a kind of Information Use License

  Off The Record is a strict specialization of Information Use License.

• On Background Domain-specific is a kind of Information Use License

  On Background is a strict specialization of Information Use License.

Hierarchy path (1) — routes to 1 parentless root

• Information Use License → Commitment → Constraint

Neighborhood in Abstraction Space

Information Use License sits in a sparse region of abstraction space (95^th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely rather than landing on a neighbor.

Family — Verification, Screening & Reference Standards (18 primes)

Nearest neighbors

• Trusted Intermediary Compromise — 0.67
• Blinding — 0.67
• Confidentiality — 0.67
• Information Locality — 0.67
• Boundary — 0.66

Computed from structural-signature embeddings · 2026-09-10

Not to Be Confused With

The nearest neighbour is Confidentiality, and the two ride so often in the same instrument that they are treated as one thing. They differ in direction and in whose interest is at stake. Confidentiality is a duty: it starts from a party already bound and carves out what may be done. A use license starts from a party with no standing to act and confers what it may do, so its native move is enablement and the restriction is merely the shape of what was not conferred. They exist independently — public material carries use terms daily with nothing for a confidentiality analysis to grip, and a holder can be bound to silence with no affirmative use granted. They also answer to different parties: a license's terms are the grantor's to relax, while a duty running to a subject is often not the transmitter's to waive.

Access Control decides who may reach a resource; the license begins after reach. They fail in opposite directions, which is the cleanest way to keep them apart: an access decision fails closed, leaving nothing in the other party's hands, while a license can only fail open, because the recipient already holds everything the terms concern. A control re-evaluated before each act is access control; a license is evaluated once, by the grantor, and thereafter only by the party it constrains.

License as Coordination concerns the economics of not negotiating: standing published terms let a class of actors check a rule instead of bargaining case by case. This prime concerns the structure of what is granted, and the two are orthogonal rather than nested. A negotiated bilateral data agreement is a use license with no coordination property; terms published openly to anyone are both. Standardizing a use license into a public menu buys the coordination property and pays for it in fit.

Commitment is the parent, binding an agent's future conduct so others may rely on it; this prime is the species in which the bound conduct is what an agent does with information it already has and cannot give back. The specialization is not decorative: irreversibility of the payload gives the enforcement, propagation, and revocation problems shapes they take nowhere else in the commitment family.

Contract is an enforcement bundle, the commonest vehicle for a use license and not the thing itself. Licenses arise from professional accreditation, editorial convention, deposit conditions, and terms published unilaterally beside a corpus — none a bargain — while most contracts carry no downstream-use terms at all. The error runs both ways: treating an unenforceable grant as no grant, and treating a signed agreement as a license because data is mentioned in it.

Consent travels the opposite way along the same chain: it is a subject's authorization for something to be done to or about them, moving upstream from the person the information concerns toward the party proposing to act, while a use license moves downstream from transmitter to recipient. The two are routinely linked, since consent often supplies the standing a custodian's later grant depends on. Confusing them yields the familiar failure in which a broad consent is read as a broad license, or a license is thought to repair a defect in consent it cannot reach.

Property Rights are an exclusive entitlement bundle over a resource, and the analogy breaks where it matters: a use license divides not the thing but the acts performed on it, and the grantor loses nothing by granting. A party with no entitlement can issue one on the strength of controlling a channel, and an owner who publishes without terms has granted nothing — only lost the occasion to attach them.

Custody Transfer is a discrete moment at which responsibility passes, releasing the first holder and binding the second — exactly the release a use license does not perform. Transmission adds a holder rather than substituting one, so obligations accumulate along the chain instead of moving along it, and the number of parties capable of breach only grows.

Solution Archetypes

No catalogued solution archetypes reference this prime yet.

Notes

The placement under commitment predicts where instruments of this kind fail. A commitment whose subject matter cannot be returned has no inspectable performance stage, so effort spent on wording yields less than effort spent on whatever keeps a recipient wanting the next grant — accreditation, repeat dealing, membership, reputation. Regimes investing heavily in the first and lightly in the second produce elaborate documents with no observable effect on behaviour.

References

[1] Hohfeld, Wesley Newcomb. "Some Fundamental Legal Conceptions as Applied in Judicial Reasoning". Yale Law Journal 23(1), 16-59, 1913. Separates privilege - the jural position of being free to act - from claim-right, duty, power and immunity, supplying the vocabulary in which an affirmative grant of permitted acts is distinguished from a bare prohibition. registry ↩

[2] Nissenbaum, Helen. Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford Law Books / Stanford University Press, 2009. Frames information norms as constraints on flows, with transmission principles naming the terms on which information passes from one party to another, rather than as controls on access. registry ↩

[3] Arrow, Kenneth J. "Economic Welfare and the Allocation of Resources for Invention". In The Rate and Direction of Inventive Activity, Princeton University Press for the NBER, 1962. States the irreversibility of disclosure directly: information's "value for the purchaser is not known until he has the information, but then he has in effect acquired it without cost". registry ↩

[4] Supreme Court of the United States. Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340. U.S. Reports, 1991. Holds that facts are not copyrightable however much labour went into compiling them, so standing to attach terms to bare facts cannot rest on copyright ownership. registry ↩

[5] United States Code. 15 U.S.C. 1681b - Permissible purposes of consumer reports. Fair Credit Reporting Act, 1970. Permits a consumer reporting agency to furnish a report "under the following circumstances and no other", enumerating the permissible purposes, and at subsection (f) bars any person from using or obtaining a report for a purpose outside that list. registry ↩

[6] Gebru, Timnit, et al. "Datasheets for Datasets". Communications of the ACM 64(12), 86-92, 2021. Proposes documentation travelling with a dataset that records recommended and out-of-scope uses for the party already holding it. registry ↩

[7] Pearson, Siani, and Marco Casassa-Mont. "Sticky Policies: An Approach for Managing Privacy across Multiple Parties." Computer, vol. 44, no. 9 (2011): 60–68. Supports the license's central object — "conditions and constraints attached to data that describe how it should be treated" — and with it the separability of the permitted set from the act of release. It does not describe how practitioners in fact deliberate about sharing. registry ↩

[8] Nissenbaum, Helen. "Privacy as Contextual Integrity." Washington Law Review, vol. 79, no. 1 (2004): 119–158. Supports the claim that a distinct set of norms governs "flow or distribution of information" — the terms on which information moves — and not merely whether it moves. It does not support the diagnosis that sharing deliberation collapses in practice onto a release/withhold binary, nor the ranking of the permitted set above the release decision as the genuine variable; both are this entry's own. registry ↩

[9] Dennis, Jack B., and Earl C. Van Horn. "Programming Semantics for Multiprogrammed Computations". Communications of the ACM 9(3), 143-155, 1966. Introduces capabilities as authority objects a holder carries and checks locally, removing the granting authority from each individual use decision. registry ↩

[10] The three substrates the paragraph names each state their propagation rule in normative operative text, which is why the earlier claim that "almost none states it" was withdrawn. Creative Commons. Attribution-ShareAlike 4.0 International Legal Code, Secs. 2(a)(5)(A), 3(b)(1): "Every recipient of the Licensed Material automatically receives an offer from the Licensor." Free Software Foundation. GNU General Public License v3, Sec. 10: "Each time you convey a covered work, the recipient automatically receives a license from the original licensors." Hardt, D., ed. The OAuth 2.0 Authorization Framework. RFC 6749, IETF, 2012, Secs. 1.5, 3.3: "Refresh tokens can be used to obtain additional access tokens with identical or narrower scope." Supports the propagation-stated-in-operative-text claim (177). registry ↩

[11] Lampson, Butler W. "Protection". ACM SIGOPS Operating Systems Review 8(1), 18-24, 1974. Models authority as an access matrix whose entries are sets of permitted operations - the formal shape of an enumerated permitted-act set. registry ↩

[12] Hardy, Norm. "The Confused Deputy: (or why capabilities might have been invented)". ACM SIGOPS Operating Systems Review 22(4), 36-38, 1988. Shows authority composed across individually valid steps producing an action no principal intended to authorise, the defect being invisible at each step and visible only in the composite. registry ↩

[13] Kiernan, Vincent. Embargoed Science. University of Illinois Press, 2006. Documents the embargo as an institution: advance distribution to accredited reporters under terms barring publication before a stated hour, at which the restriction lifts for every recipient at once, with loss of access rather than legal remedy as the operative sanction. registry ↩