A per-source compliance record (terms/robots/license URLs, archived snapshot, permitted-use determination, last-reviewed date) plus a daily job that diffs those terms and auto-pauses ingest on any change — fail-closed, with a timestamped audit trail for legal defensibility.
Why this matters
Entry 033 decides the fail-closed "No Gotchas" posture; this is its mechanism. It is the legal-side mirror of structural drift detection (G-041) and shares infrastructure with external-content monitoring (G-053).
Proposed design
- Compliance record — every source/API in the registry (G-066) carries:
ToS/T&C URL(s),
robots.txt, license, an archived snapshot (hash + stored copy) of each, the permitted-use determination, and the last-reviewed date. - Daily monitor — fetch each tracked terms/robots/license URL, diff against the stored snapshot. Scope: nominated sources, Entry 019 provider APIs, and Entry 028 external references.
- Fail-closed handling — on any diff (or unreachable/ambiguous terms): auto-pause that source's ingest, archive the new version, notify the compliance owner (G-061), and queue a re-review. Resume only on an affirmative re-determination.
- Audit trail — retain every timestamped terms version, so we can always prove what the terms said when we ingested under them.
- Ownership — a designated compliance role (high-Power / legal-designated) performs re-reviews; routine monitoring is automated.
Open decisions
- Where authoritative terms live per source (multiple URLs, regional variants).
- Diff sensitivity — meaningful-change detection vs. cosmetic edits (avoid alert fatigue without missing material changes).
- Permitted-use taxonomy and re-determination workflow (depends on G-044, G-002).
- Retention policy and storage for archived terms snapshots.
- SLA from change-detected to ingest-paused; handling of in-flight ingests.
Related
- Entry 033 — the No Gotchas decision this implements
- Entry 019 — provider APIs (also monitored) · Entry 028 — external references
- Entry 030 — reciprocity/attribution ethic applied to sources
- G-066 — source nomination & pattern-authored ingest (the registry this guards)
- G-053 — external content monitoring & drift detection (shared infrastructure)
- G-052 — external-reference verification & relatedness policy
- G-044 — CC-BY-SA derivative scope · G-002 — IP/copyright posture
- G-058 — AI crawler & data-licensing posture · G-041 — mapping versioning & drift
- G-061 — notification & activity system (compliance alerts)