Every submission must pass the cth:FieldDataQuality SHACL shape before entering the validation queue. Submissions that fail are rejected at ingestion with a machine-readable error payload.

Any parcel whose GPS centroid intersects an officially recognised indigenous territory or Afro-Colombian collective territory requires a valid cth:FPICCredential signed by the Community Sovereign before submission is accepted.

Submitter must declare which measurement methodology was used (e.g. KoboToolbox GPS v2.3, Planet NDVI mosaic 2025-Q4, manual tape survey). Methodology ID must resolve to a registered entry in cth_methodology_registry.

ℹ️ These three rules compose: a submission must pass ALL of R-SUB-01, R-SUB-02, and R-SUB-03 simultaneously. Partial compliance is not accepted.

Only principals holding a valid cth:ValidatorCredential may sign validation results. Validator credentials list the specific methodologies and standards the holder is accredited to validate.

A Data Submitter may not validate their own submission. The validator DID must differ from the submitter DID. This applies transitively — a validator who is a beneficial owner of the submitting entity is also disqualified.

EUDR DDS can be self-declared by the operator (EU Regulation 2023/1115 Article 4). However, CBAM declarations (Article 7) and Article 6.4 carbon credits require third-party validation before a Digital Conformity Credential (DCC) can be issued.

When a Community Sovereign revokes FPIC for a territory, all downstream credentials (DCCs, EUDR DDS) that relied on data from that territory are immediately flagged status: suspended. Third parties holding those credentials are notified via webhook within 60 seconds.

Data may only be used for the purposes declared in the FPIC credential and the submission metadata. An agent or API call requesting data for an undeclared purpose (e.g. using EUDR data for a carbon market without explicit consent) is rejected by OPA.

Any commercial use of community data (carbon credits, premium certification fees, data licensing) requires a benefit-sharing agreement recorded in the governance ledger before data access is granted. Minimum 20% of net commercial value must flow to contributing community.

⚠️ Important: R-CON-01 is the hardest rule in the framework. Revocation can cascade to invalidate export documents that third parties (coffee buyers, EU customs) are relying on. CTH Data Stewards must proactively manage community relationships to avoid surprise revocations.

Every action taken by an AI agent — read, write, policy evaluation, credential check — must produce a W3C PROV-O provenance record. The record must name: (a) the agent DID, (b) the delegating human DID, (c) the action type, (d) the entity acted upon, (e) timestamp.

An agent MUST call POST /policy/evaluate before any write operation (submission, validation signature, credential issuance, ledger entry). The policy evaluation result must be allow: true before the write proceeds. This is enforced at the API gateway level — agents cannot bypass it.

When FPIC is not granted or has been revoked for a territory, no agent action may read or write data for that territory. This is not an OPA rule — it is enforced at Postgres row-level security, below the API layer. There is no override, no emergency bypass, no admin exception.

ℹ️ Agent design principle: an agent inherits the delegating human's permissions — never more. If the human cannot do something, neither can the agent acting on their behalf. Credential delegation is explicit and recorded in the JWT claims.

Changes to core framework elements — governance model, role definitions, FPIC requirements, compliance mappings, standards layer — require a ⅔ supermajority of the Governance Board. Minor changes (clarifications, bug fixes, new regulatory appendices) require simple majority.

The Community Sovereignty Panel holds a structural veto on any change that affects FPIC rules, community data rights, or benefit-sharing requirements. This veto cannot be overridden by any vote of any other body, including a unanimous Governance Board.

Critical security or compliance fixes may be deployed by CTH Data Stewards within 48 hours without a board vote. The patch must be (a) narrowly scoped to the security/compliance issue, (b) announced to all board members immediately, (c) ratified or reversed by formal board vote within 30 days.