Not a ladder.
A set of rights.
The obvious design — consumer inside recycler inside regulator — is wrong, and it over-discloses.
The audiences overlap. They do not nest.
An authority and a purchaser are each entitled to parts the other is not. No ordering of tiers can express that.
One definition. Every path obeys it.
Field level
Entitlements are declared per field in one registry. The consumer page, the machine interface and code-based access all read the same definition — they cannot drift apart.
Hidden by default
The public view is derived as the complement of what consumers may see. Add a new restricted field and forget to classify it, and it is withheld — never leaked.
Read trail
Code-based access records who asked, when, and from which country, with the address masked. Useful to you in an audit; useless as a profile.
Proof of holding, not paperwork.
The buyer of an individual unit is entitled to its own data — the health of the specific battery in their bike, not the model average. But a consumer has nobody to request an authorisation code from.
So the proof is physical: a code supplied with the product, printed under a peel-off layer. Entering it once activates that unit's own view. Whoever holds the product gets the data; a passer-by scanning the shelf does not.
A deliberate trade-off: after activation we do not re-check identity on every visit. Blocking casual scans is the objective — and second-hand buyers need that number most.
Two things nobody can implement yet.
The rules defining exactly who qualifies as a legitimate-interest party — and what they may download, share or re-publish — have not been issued. They were due before us all.
Until they arrive we grant what the law itself grants and no more. Narrowing pre-emptively would obstruct rights that already exist; widening would over-disclose. When the detail lands, it changes a definition, not our architecture.
One line we will not cross: a brand cannot use the code mechanism to decide which repairer or recycler is allowed to see a product. Verification of role, yes. Approval of competitors, no.