# Eve media and project-file governance — 2026-09

Task 14.7 is implemented as a deny-by-default engineering control. Before Eve
invokes an autonomous image, audio, or video executor, an admitted rights
authority must return an exact artifact-scoped bundle authorizing generation.
Before customer-facing publication, the output must pass a second structured
review covering its exact output, sources, project files, licences, attribution,
redistribution, training restrictions, likeness/voice consent, generated-media
disclosure, and provenance.

The canonical record is
[`eve-sota-media-project-governance/2026-09-15.json`](eve-sota-media-project-governance/2026-09-15.json),
validated by
[`eve-sota-media-project-governance.schema.json`](eve-sota-media-project-governance.schema.json).
It intentionally separates four requested uses—generation, publication,
redistribution, and model training—because permission for one is not permission
for another.

## Enforcement boundary

- Every declared source asset and project file needs an exact active receipt and
  matching licence terms.
- Required attribution needs an exact text or record reference.
- Redistribution or model-training requests are blocked if any material
  prohibits that use.
- Likeness and voice detection cannot be skipped; detected subjects need active,
  scoped consent receipts.
- Synthetic customer-facing media needs an attached disclosure and a
  provenance-manifest reference.
- A named rights reviewer must approve the evidence, and future-dated or missing
  review evidence fails closed.
- The legacy `rightsAndLicenseClear` boolean is retained only as a compatibility
  signal. It cannot substitute for the structured bundle.
- Autonomous media performs rights preflight before provider invocation and
  resolves output-specific rights again before publication.

## Standards and claim boundary

The record uses the
[C2PA 2.4 technical specification](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html)
for provenance terminology, the [SPDX licence list](https://spdx.org/licenses/)
for standardized licence identifiers,
[CC BY 4.0](https://creativecommons.org/licenses/by/4.0/deed.en) as an official
example of attribution conditions, and the
[U.S. Copyright Office AI initiative](https://www.copyright.gov/ai/) as policy
context for digital replicas, copyrightability, and training.

This is not legal advice and does not claim legal compliance. SPDX identifiers
do not prove licence applicability; C2PA provenance does not prove truth or
rights; official reports are not silently treated as enacted law.
Territory-specific legal conclusions, contract interpretation, and final rights
decisions remain human-owned under Task 14.6.