Disciplines · Audits

Eve media and project-file governance — 2026-09

matching licence terms.

2sections2 minread
Markdown source
On this page

Task 14.7 is implemented as a deny-by-default engineering control. Before Eve invokes an autonomous image, audio, or video executor, an admitted rights authority must return an exact artifact-scoped bundle authorizing generation. Before customer-facing publication, the output must pass a second structured review covering its exact output, sources, project files, licences, attribution, redistribution, training restrictions, likeness/voice consent, generated-media disclosure, and provenance.

The canonical record is eve-sota-media-project-governance/2026-09-15.json, validated by eve-sota-media-project-governance.schema.json. It intentionally separates four requested uses—generation, publication, redistribution, and model training—because permission for one is not permission for another.

Enforcement boundary#

  • Every declared source asset and project file needs an exact active receipt and matching licence terms.
  • Required attribution needs an exact text or record reference.
  • Redistribution or model-training requests are blocked if any material prohibits that use.
  • Likeness and voice detection cannot be skipped; detected subjects need active, scoped consent receipts.
  • Synthetic customer-facing media needs an attached disclosure and a provenance-manifest reference.
  • A named rights reviewer must approve the evidence, and future-dated or missing review evidence fails closed.
  • The legacy rightsAndLicenseClear boolean is retained only as a compatibility signal. It cannot substitute for the structured bundle.
  • Autonomous media performs rights preflight before provider invocation and resolves output-specific rights again before publication.

Standards and claim boundary#

The record uses the C2PA 2.4 technical specification for provenance terminology, the SPDX licence list for standardized licence identifiers, CC BY 4.0 as an official example of attribution conditions, and the U.S. Copyright Office AI initiative as policy context for digital replicas, copyrightability, and training.

This is not legal advice and does not claim legal compliance. SPDX identifiers do not prove licence applicability; C2PA provenance does not prove truth or rights; official reports are not silently treated as enacted law. Territory-specific legal conclusions, contract interpretation, and final rights decisions remain human-owned under Task 14.6.