Necessary, not sufficientThe catalogue-first rival

Catalogue-first governance materially improves the enterprise. Inventory assets, assign owners, scan quality, classify sensitivity and let teams discover approved data. That is a strong starting point. It fails when permission is purpose- or population-specific, derivatives lose lineage, semantic meaning changes between domains, retrieval alters evidence, deletion cannot propagate, or “approved” becomes a blanket entitlement.

The context-contract alternative can also fail. Contracts become documentation written after deployment. Reuse waits for months of committee review. Quality thresholds remain generic. Lineage stops at the warehouse while embeddings and memory multiply. Legal clauses are copied into a page without a technical enforcement point. Safe reuse has to be faster than repeated bespoke extraction and more observable than informal copying.

The CDO does not decide legal basis alone. Legal and privacy functions interpret applicable duties; business owners define purpose and accept operational accountability; data owners and stewards maintain meaning and quality; security controls access; product teams define affected populations and workflows; platform teams enforce contracts. The graph makes those decisions joinable without pretending one function owns them all.

Decision-specific permissionEntitlement is a relationship, not a property of the asset

Data is not simply entitled or not entitled. An organisation may hold an observation for one purpose, disclose it to one recipient, transform it under stated conditions and retain it for a defined period. A new workflow changes one or more of those relationships. The graph therefore places rights between the represented entity, transformation, context product and consuming decision. The same source can support several permitted edges and one prohibited edge.

Begin with the proposed data action. NIST’s Privacy Framework uses data action broadly across collection, generation, transformation, use, disclosure, sharing, retention and disposal. That is useful because AI systems perform several actions in one flow. Retrieval exposes a source to a processing system. Summarisation generates a derivative. Memory retains it. A tool may disclose or act. Entitlement review should not collapse that sequence into the original access event.

Purpose needs an operating definition. “Improve service” is too broad to constrain reuse. “Retrieve current policy and prior claim events to help an authorised reviewer prioritise active claims” identifies a workflow, decision and population. It can be tested against the source purpose, contract, policy and applicable interpretation. It can also be enforced by requiring the workflow identity and prohibiting the context product from serving an employee-performance or marketing system.

Affected population matters independently of the source population. A context product built from customer records can influence employees if it is used to evaluate their calls. A model trained on one region can guide decisions in another. A product defined around organisations can expose individuals through representatives or beneficial owners. Record the people or entities who experience the decision consequence, not only those named in the source schema.

Consent, contract, legal basis and internal policy are not interchangeable tokens. Each has scope, evidence, interpreter and change process. A consent record may not answer confidentiality. A supplier contract may govern reuse while a legal duty governs retention. A company policy may be more restrictive than the legal minimum. The context contract should cite the controlling evidence and the accountable function rather than reduce these sources to a generic “approved” flag.

Technical enforcement completes the relationship. Access policy receives the context product, workflow identity, declared purpose, population and requested action. It returns permit, limited permit or deny and records the basis. For high-consequence use, the decision may require a human authority or separate review. An interpretation that cannot reach the point of consumption remains documentation rather than control.

Original constructThe eight-node Data-to-Context Entitlement Graph

Graph operationTurn lineage into decisions and acknowledgements

The graph does not require one graph database. It requires stable identities and relationships that can be queried across catalogues, policy engines, pipelines, context stores, evaluation systems and decision records. A source version links to transformations. A transformation links to derivatives. A context contract links to consumers. A correction event traverses the same edges in reverse. Storage architecture can vary as long as the organisation can reconstruct the chain within the required time.

Use the graph at onboarding. A prospective consumer submits purpose, population, action and system identity. The service finds relevant source rights, derivative restrictions, semantic definitions, quality evidence and lifecycle obligations. Straightforward matches are permitted automatically. Conflicts route to the responsible legal, privacy, business or data owner with the exact unresolved edge. This is faster and more accountable than asking a committee to reread the entire asset history.

Use it again at change. A new embedding model changes the transformation node. A revised policy changes source authority and effective time. A new customer population changes the decision node. A memory feature changes retention. The graph identifies which certifications and consumers depend on the changed node, so review can be proportional instead of repeating every question or ignoring the change.

Incident response benefits from the same structure. If a restricted passage appears in an output, responders can identify source, retrieval, ranking, model, memory and consumer versions. If a stale claim influenced an action, they can find other decisions using the context snapshot. The graph does not determine remedy, but it provides the evidence needed for accountable containment and correction.

Lineage completeness should be tested with representative paths. Choose a source observation and follow it to the decision. Choose a context output and follow it back to source and rights. Trigger a correction and verify each derivative acknowledgement. Introduce an expired item and confirm the workflow blocks or degrades as specified. A diagram that cannot support these queries is descriptive lineage, not operating lineage.

Reusable contextThe context contract

Fitness without perfectionSet quality thresholds at the decision boundary

Accuracy is only one dimension. A source may be accurate but incomplete for the proposed population. Values may be consistent within one system and contradictory across domains. A complete record may be too old for the decision. A representative sample may be presented in a form users misread. The classic data-quality research used here supports a consumer and context orientation; the article’s contract translates that orientation into an AI decision path.

Thresholds should describe consequence. A drafting assistant may tolerate missing optional contact fields if the user can verify the text and no action follows automatically. Claims triage may require current policy, reliable identifiers and known missingness because prioritisation affects service. A final adverse action may demand stronger completeness, representativeness, review and recourse. A regulatory report may require specified fields and reference periods even when no individual decision occurs.

Residual limitations belong in the contract. Do not hide a missing region, weak source or stale interval behind an aggregate pass. State which cases fall outside certification and what the consuming workflow must do. It may warn, request source evidence, route to a specialist or block. A limitation is governable when the product can detect or reasonably bound it and the consumer has an executable response.

Semantic quality deserves separate treatment. A data dictionary can list a field while leaving its decision meaning unresolved. “Active”, “default”, “customer”, “claim closed” and “consent” often encode business rules and reference times. Map each term to authoritative rules, effective dates and domain owners. When meanings collide, preserve qualified terms or separate products rather than choosing one definition for organisational tidiness.

Representativeness is tied to use. A dataset may reflect the service population that generated it but not applicants who were rejected before entering the system. Feedback data may over-represent users who complain. Agent memory may over-represent recent interactions. The contract should name the represented and affected populations, known selection processes and evaluation cases that expose consequential gaps.

Quality evidence also changes after retrieval. Source accuracy does not guarantee that chunking retains context, ranking selects the current passage or a summary preserves qualification. Evaluate the assembled context seen by the system. Include conflicting sources, effective-date changes, negation, tables, cross-document definitions and empty retrieval. Observed failures update the contract and the certification boundary.

Transformation does not erase obligationDerived context, correction and deletion

Derivative laundering occurs when a restricted attribute disappears from a table but remains inferable from embeddings, summaries or correlated features. The governance question is not whether the original column survives. It is whether the derivative preserves information or effect that remains within a restriction. Testing should include inference, membership and population effects proportionate to consequence.

Chunking and retrieval can change semantics. A qualification may be separated from a rule. A superseded policy passage may rank above the current version. Similar language can cross a jurisdiction or product boundary. The context contract should define document structure, effective dates, ranking assumptions and evaluation cases that reflect how evidence can be misassembled.

Correction propagation needs a graph. When a customer corrects a source record, identify every context product, cache, feature, summary and memory derived from the old state. Some artefacts can be recomputed; some must be deleted; some decision records must remain preserved with a correction link. The mechanism depends on applicable duties and operational needs, but the organisation must be able to locate the derivatives before deciding.

Deletion has the same dependency problem. A source deletion without index removal can leave the content retrievable. An index deletion without cache expiry can leave the claim in sessions. A memory reset without model-training assessment may leave another processing path unexamined. Do not promise perfect erasure where the architecture cannot demonstrate it. Quarantine uncertain derivatives, preserve required evidence and escalate the unresolved boundary.

Lifecycle controlPropagate change without erasing accountability

A correction does not always mean overwriting history. The current context should reflect the corrected source, while an earlier decision record may need to preserve what the system actually saw. Link the correction to that record and identify whether the decision requires review or remedy. This separates operational truth now from evidence about a past action.

Propagation needs status and deadlines. Targets can acknowledge recomputation, deletion, quarantine, exception or lawful retention. A silent target is not success. Prioritise by whether the derivative remains retrievable, whether it can influence new decisions and the consequence of the old claim. An archival object under controlled retention differs from an active memory served to an agent.

Deletion requests and retention duties can conflict or vary by artefact. The graph gives accountable functions a common inventory on which to make the decision. It should not encode one universal deletion answer. Record the interpretation, artefacts covered, technical action, evidence preserved, unresolved limitations and communication to downstream controllers or processors where applicable.

Residency and cross-border constraints also travel with derivatives. A source held in one region can produce an embedding, trace or summary stored elsewhere. Context caches and hosted models may introduce processing paths absent from the warehouse map. The contract should specify permitted locations and ensure the platform emits enough evidence to test them.

Quarantine is a governance route, not merely a storage status. It removes the context from retrieval and new processing while preserving authorised access for investigation, correction or retention decisions. Name the authority that can release or delete it, the evidence required and the deadline. Otherwise quarantine becomes another unreviewed archive that later re-enters reuse.

Boundary casesWhat the contract must distinguish

Joint accountabilityMake the contract a governed product

The business owner is accountable for purpose, decision and value. The data owner is accountable for authoritative meaning and approved provision. The steward maintains definitions, quality evidence and change history. Legal and privacy functions interpret applicable rights and risks. Security manages access and confidentiality. Platform teams enforce policy, lineage and lifecycle mechanisms. Consumer owners honour the decision boundary and report failures. A context product needs these responsibilities named, even when one person carries several in a small organisation.

Escalation should follow the unresolved condition. A semantic collision goes to domain owners. A missing source or failed freshness threshold goes to the data product team. A new purpose or population goes to business, legal and privacy accountability. A retrieval failure goes to the context platform and consumer. A hard prohibition does not wait in the same queue as a quality improvement. Routing by condition keeps governance responsive.

Reuse economics matter. Measure how long a new consumer takes to onboard, which reviews repeat, how many contract fields can be evaluated automatically and which derivatives raise operating cost. Measure corrections, stale-context incidents, denied purposes and consumer change. The goal is not to maximise reuse counts. It is to increase valuable reuse within explicit boundaries while reducing the cost of proving that boundary.

Contracts need versioning and consumer acknowledgement. A consumer certified under version three may not satisfy a new prohibited-use clause or freshness rule in version four. The owner states whether the change is backward compatible, requires migration or immediately suspends use. Consumers acknowledge and supply evidence. The system records which version governed each decision.

Independent challenge should rise with consequence and conflict. A product team can assess a low-consequence drafting context against published rules. Final adverse decisions may require separate review of entitlement, population and quality evidence. The CDO should not centralise every judgement, but must ensure that those accepting residual limitation are distinct enough from those rewarded for release when consequence warrants it.

Dataset documentation practices such as datasheets and data statements help expose motivation, composition, collection, preprocessing, population and maintenance. They are inputs to the context contract, not substitutes for it. The contract adds the consuming decision, rights relationship, transformations, retrieval assumptions and lifecycle enforcement that emerge after a dataset becomes production context.

Interactive instrumentData Entitlement, Quality and Reuse Console

The Console keeps hard entitlement boundaries separate from quality, semantics, freshness and lifecycle evidence. It returns a route and next evidence, never a trust or data-quality score.

The CDO operating agendaMake safe reuse faster than copying

Begin with context products that several teams already rebuild: policy context, customer definitions, product terms, claims evidence or operational knowledge. Map the graph from source to decision. Name the owner, steward, rights interpreters, consumers and lifecycle operator. Convert repeated review questions into contract fields and policy checks.

Make onboarding executable. A consumer declares purpose, population, action and system identity. Policy returns allowed, limited or prohibited use and records the decision. Quality checks select thresholds for that decision. Retrieval and evaluation suites test the transformation assumptions. The review route escalates only conditions that require interpretation rather than sending every use to a committee.

Track reuse benefit and onboarding time beside incidents and rejected uses. A contract that nobody can adopt will be bypassed. A fast product that cannot propagate correction will accumulate hidden liability. Product management for data and governance have to share the same service measures.

Review context contracts when source rights, semantics, transformations, consumers or affected populations change. Preserve evidence of the earlier contract for decisions made under it. Do not silently extend a certification from triage to adverse action or from customers to workers.

The CDO agenda is not perfect data. It is explicit fitness and entitlement. Reusable context becomes more valuable because its permitted decisions, residual limits, correction paths and prohibitions are visible. That clarity lets teams move quickly where reuse is sound and stop early where transformation would otherwise hide the risk.