Permissions

This document sets who can do what to a record.

---

1. Four things kept first

1. Originals and interpretations have separate permissions. Who can see the original (recordings, scans, photos: the authentic layer) and who can see the interpretation (transcription, correction, translation, summary: the interpretive layer) are decided separately.
2. If nothing is decided, it is closed. A record the depositor has not specifically opened is seen only by the depositor.
3. Machines hold no rights. An AI does only the work a person gives it. It cannot apply a confirmation stamp, widen a scope, delete, or sign. (HGP-0001 section 2)
4. What is blocked by a key and what is blocked by a promise are written down separately. Keeping the administrator from seeing originals is blocked by a key (encryption). secretary does this from v0.2 (November); arkive does not do it yet. Until then, we do not hide that it is blocked only by promise.

2. Five roles

Depositor (owner of the original)

The person who left the record. For a recording, the speaker; for an old document, whoever deposited it (a clan (munjung), a family). The depositor sets the scope (who can see it), gives and withdraws use consent, deletes, and names the successor. These powers do not pass to any other role. The depositor and the owner (the owner of the physical object or the original) can be different. This is common with old documents. When they differ, the ledger records the owner, and while there is no record of the owner’s permission (a deposit agreement), the depositor has the same limits as a “stand-in”: they cannot widen to public, order destruction, name a successor, or consent to training (07-Deposit section 2). For a recording, the speaker is always both owner and depositor. When a group (a clan (munjung), a Confucian academy (seowon), an association) is the depositor, the powers attach to a position (the head of the main family line (jongson), the representative), not to a person. How the group decides internally is up to the group (07-Deposit section 6). Earlier names: “speaker” in the HGP specification, “기탁자” (depositor) in arkive, “user” in secretary. They are all the same position.

Editor (edits the interpretive layer only)

A person or AI who edits the interpretive layer of a record the depositor has entrusted. Transcription AI, correction AI, and researchers deciphering cursive script (talcho) belong here. Edits are layered on top, not by deleting. Who changed what into what, when, and why is kept. The confirmation stamp (raising a machine transcription to “confirmed”, checked by a person) is applied only by someone given confirmation stamp permission for that record. By default, these are the depositor and human editors. The administrator applies it only in the exception described under “Administrator” below. An AI editor can only propose edits. An editor may be able to see the original but cannot edit it.

Viewer (sees only the permitted scope)

A person who sees records within the scope the depositor opened. Family, clan members, accredited researchers, and institutions named by the depositor belong here. A viewer can add comments. Comments are stacked separately in the interpretive layer and do not change the original or the interpretation. A viewer sees only what the depositor decided: they may see the interpretation only, or the original as well. The five scope levels (sealed, private, relation, community, public) are in 00-Principles section 3.

Administrator (Nodeone)

Handles accounts and storage: creating and suspending accounts, storage space, backups, moving stores, and running the succession procedure. It is designed so that the administrator cannot see the content of originals or interpretations. The administrator sees only file numbers, fingerprints, sizes and status. One exception: if the depositor gives the administrator permission to see the interpretive layer of a particular record, the administrator can see the interpretation and apply the confirmation stamp for that record only. The stamp is recorded in the administrator’s name (confirmed_by.as: "admin"). The administrator still cannot see the original. The depositor can withdraw this permission at any time. The administrator does not act without the depositor’s instruction. It does not build any structure it could open alone. (HGP-0005 section 4, “Duties of the trustee”) Earlier names: “trustee” and “repository” in the HGP specification.

Successor (after the owner is gone)

A person the depositor named in advance. When the depositor dies, the successor inherits a share of the key after a set procedure (confirmation of death, identity check, waiting period, record of execution). A successor cannot widen the scope. What the depositor sealed stays sealed. Death does not lift the scope. (HGP-0005 section 8, Memory and Authenticity Protocol article 9) If no successor was named, nothing passes to anyone, and the record is kept locked.

3. What was added or left out

Candidate	Decision	Reason
Heir	Added as successor	It already exists as “successor” in the HGP specification. “Inheritance” is a word for receiving property, but an original is not property to be bought and sold.
Proxy	Left out	The specification says the depositor’s powers do not pass to another position. A family member who taps the phone on someone’s behalf is helping, not holding a permission. Legal guardianship goes to “Still to decide” below.
Verifier (an institution that only checks fingerprints)	Left out	Fingerprint checking is made possible for anyone, without the content (HGP-0003 article 5). It is not a role but an action open to everyone. In specification HGP-0008, “verifier” is the person who makes the confirmed version, so the names also clash.
Joint owner	Left out	Not a separate role; it is handled as “there can be more than one depositor”. Each is the depositor of the passages in their own voice.
Witness (specification)	Left out of this document	It is a signing position, not a permission. Signatures are covered in 02-Fingerprint and 03-manifest. If a witness needs permission to see the record, they are given it as a viewer.
Attendee (specification)	Left out	They were only present and hold no permissions. They have only a duty of confidentiality.
Finalizer (arkive)	Merged into editor	“Someone given confirmation stamp permission for that record” does the same job (section 2, Editor; Decision 0006).
Institution (arkive institution)	Treated as viewer	It is a position that sees records because the depositor named it. It is not mixed with the administrator.
Certification authority (specification)	Left out	It is where the manifest is signed. Nodeone can also serve as one, but since it does not see the content, it falls within the administrator’s permissions.
Vault keeper, machine, witnessing device (specification)	Left out	These are programs and devices, not people. If an AI edits the interpretive layer, it is an editor; otherwise it has no permissions.

4. Table by action

○ can · △ only when conditions are met · ✕ cannot

Action	Depositor	Editor	Viewer	Administrator	Successor
View the original (listen)	○	△ only records entrusted to them	△ when opened up to the original	✕	△ within the scope the depositor set
Download the original	○ all of it, at any time	✕	△ when download is also permitted	✕ only moves it while locked	△ within the scope the depositor set
Edit the original	✕	✕	✕	✕	✕
View the interpretation	○	○ only records entrusted to them	△ within the opened scope	△ only records the depositor entrusted	△ within the scope the depositor set
Edit the interpretation (layer on top)	○	○	✕ comments only	✕	✕ comments only
Confirmation stamp (to confirmed)	○	△ people only	✕	△ only records the depositor entrusted, in the administrator’s name	✕
Add comments	○	○	○ only on what they can see	✕	○
Decide who can see it (scope)	○	✕	✕	✕	✕ cannot widen
Give or withdraw use consent	○	✕	✕	✕	△ withdraw only
Send the original outside (a transcription company and so on)	○ only for agreed purposes	✕	✕	△ only automatic tasks the depositor agreed to	✕
Invite or remove editors and viewers	○	✕	✕	✕	✕
Account management (create, suspend, storage, backup)	△ own account only	✕	✕	○ cannot see content	✕
Delete (destroy the whole record)	○ the fact of deletion remains	✕	✕	✕ only carries out the depositor’s instruction	△ when the depositor permitted it in advance
Revert an interpretation one added	○	○ a trace of the revert remains	✕	✕	✕
Pass on the key (name a successor)	○	✕	✕	△ only runs the succession procedure, cannot open	✕
See who opened it and when	○	✕	✕	△ numbers and times only, without content	○
Check that a fingerprint matches	anyone	anyone	anyone	anyone	anyone

Notes:

• Deletion means destroying the key. Even if the locked file remains, no one can open it. The fact and the time of deletion are not deleted. (HGP-0003 article 9)
• When an original is sent outside, one line is written in the manifest: when, to which company, and for what. (secretary principle 5)
• Work done by an AI editor always carries a “machine” mark. When a person confirms it, it becomes “machine generated, human confirmed”. (HGP-0008)
• Stand-in depositor: for a record whose depositor is not yet known or which has no deposit consent form (for example, an old document whose holder is “not yet recorded”), someone can give permissions in the depositor’s position on their behalf. This is recorded in the permission record as stand_in: true, and is kept distinct from the real depositor on screen and in the ledger. A stand-in can invite viewers and editors, apply the confirmation stamp (as: "depositor" together with the stand-in mark), and retract. A stand-in cannot widen the scope to “public”, order destruction, name a successor, or consent to training. When the real depositor appears, the position is handed over and what was done on their behalf is shown to them, and the depositor can withdraw those permissions. (Decision 0011)
• App key: the key a layer 2 app uses to read the layer 1 store. The depositor opens it per app and per volume. The app reads only what a viewer of that volume can see (sealed, approval required and seal candidate items are locked; no original files), and the only thing it can write is edit proposals. Proposals carry a machine mark (made_by), and the confirmation stamp is applied by a person. Every request is logged without content, and on withdrawal the key closes at once. It is not a new role but “viewer + AI editor proposals”. (Decision 0011)

5. Examples

• Old documents (arkive): when a clan deposits one volume of a diary, the depositor is the clan; the AI that made the draft decipherment of the cursive script and the researcher who checks it are editors; clan members and accredited researchers are viewers depending on scope; and Nodeone, which keeps the scan files, is the administrator.
• Recording (secretary): when a person records their morning walk, that person is the depositor and the one who applies the confirmation stamp; transcription AI and correction AI are editors; if “share with family” is chosen, family members are viewers who see the transcript only; and the Nodeone server is the administrator, which knows only file numbers and status.
• A recording containing another person’s voice: the person who recorded it holds the file as depositor, and for what another person said in it, that person is the depositor of their own passages. Until that person consents, no one but the two of them can open those passages. (Memory and Authenticity, Layer 0, article 0 and article 7)

6. Still to decide

1. The moment the original is unlocked for transcription. Decided in 09-Keys section 7 (decision 0018). For each task, the depositor’s device briefly hands the file’s content key to the server; the server unlocks it only in memory, sends it, and discards it. We state that this stretch is guarded by promise, not by lock.
2. Legal guardianship. Who can do what when the depositor is alive but can no longer make their own decisions (dementia and so on). It is not included for now.