Access control

Not a ladder.
A set of rights.

The obvious design — consumer inside recycler inside regulator — is wrong, and it over-discloses.

Why tiers fail

The audiences overlap. They do not nest.

An authority and a purchaser are each entitled to parts the other is not. No ordering of tiers can express that.

Overlapping entitlement sets by audience Passport parts Part A — public Part B — service Part C — oversight Part D — the owner's unit Audience Anyone who scans Repairers & recyclers Market surveillance The person who bought it Oversight never receives Part D. The owner never receives Part C. Neither set contains the other.
How it is enforced

One definition. Every path obeys it.

Field level

Entitlements are declared per field in one registry. The consumer page, the machine interface and code-based access all read the same definition — they cannot drift apart.

Hidden by default

The public view is derived as the complement of what consumers may see. Add a new restricted field and forget to classify it, and it is withheld — never leaked.

Read trail

Code-based access records who asked, when, and from which country, with the address masked. Useful to you in an audit; useless as a profile.

The purchaser

Proof of holding, not paperwork.

The buyer of an individual unit is entitled to its own data — the health of the specific battery in their bike, not the model average. But a consumer has nobody to request an authorisation code from.

So the proof is physical: a code supplied with the product, printed under a peel-off layer. Entering it once activates that unit's own view. Whoever holds the product gets the data; a passer-by scanning the shelf does not.

A deliberate trade-off: after activation we do not re-check identity on every visit. Blocking casual scans is the objective — and second-hand buyers need that number most.

Still open

Two things nobody can implement yet.

The rules defining exactly who qualifies as a legitimate-interest party — and what they may download, share or re-publish — have not been issued. They were due before us all.

Until they arrive we grant what the law itself grants and no more. Narrowing pre-emptively would obstruct rights that already exist; widening would over-disclose. When the detail lands, it changes a definition, not our architecture.

One line we will not cross: a brand cannot use the code mechanism to decide which repairer or recycler is allowed to see a product. Verification of role, yes. Approval of competitors, no.

See your own disclosure map.