Procurement
Not procurement-ready- Named contracting entity and vendor records
- Quote, currency, term, renewal, cancellation, and invoice
- Support owner, service expectations, and commercial escalation
Trust is a verified state
What each reviewer needs—and what is still missing.
This preview deliberately separates source-code foundations from operational, legal, security, and commercial readiness. A feature flag or database record is not an assurance report, signed agreement, verified buyer, successful delivery, or payout capability.
Legal & privacy
Requires qualified counsel- Permitted purpose, prohibitions, duties, geography, and duration
- Contributor and subject rights basis, retention, withdrawal, and deletion
- DPA, recipients, subprocessors, audit evidence, and incident terms
Security
Assurance not complete- Authentication, least privilege, isolation, logging, and encryption
- Incident handling, vulnerability management, backup, and recovery
- Destination approval, deletion verification, and independent assurance
Data engineering
Reference specification only- Schema, dictionary, representative sample, and loader
- Stable revision, manifest, checksums, distributions, and change policy
- Delivery receipt, support path, format and compatibility contract
Controls already reflected in the design
- Private-by-default contributor catalog and explicit item selection.
- Context quality separated from rights and Marketplace Readiness.
- Unknown rights and prohibited sensitive classes fail closed.
- Public discovery excludes identities, filenames, paths, originals, and private context.
- Business agents may compare and prepare a request, but cannot assent, purchase, access raw data, or cause payout.
- Immutable revision and manifest are required before entitlement or delivery.
Required before live commerce
- Qualified legal review and effective marketplace agreements.
- Buyer verification, intended-use review, sanctions and high-risk-use policy.
- Operational security program, tested incident response, and appropriate assurance.
- Production delivery, access logging, revocation, and deletion verification.
- Payment, payout, tax, accounting, dispute, and support operations.
- Tested contributor allocation and legally appropriate retention/deletion model.
Current public policies
The existing consumer policies govern the current catalog service. They are not a buyer data license, DPA, security assurance, or marketplace offer.