Cleveland Software

Rights evidence · Supporting example

Rights evidence: what one record looks like

The supporting example for the rights evidence line. One record, six evidence states, and how anyone checks it without asking us.

This is the supporting example for the “Rights evidence for AI data” service. It is the answer to one question: why was this document allowed into this system?

A record is produced per source at ingestion, before chunking, and carries forward to every chunk. It preserves the copyright-management information (title, author, rights owner, terms, canonical URL) that arrived with the source, records the license basis, and states how confident each claim is. Anyone with the record and the public verification key can check it without asking us or the operator.

Six evidence states

Every claim in a record carries one of six states. The state says how the claim is known, not whether it is true.

State Meaning
verified Checked by an independent mechanism (a signature validated, a hash matched, a live fetch compared).
observed Seen directly by the ingestion system at the time (an HTTP header, an embedded metadata block).
attested Stated and signed by a named officer of the operator.
asserted Stated by the operator without a signature, or stated by the source.
inferred Derived by a rule or a model. Always paired with the rule or model version.
unknown Not determined. Recorded as such rather than left blank.

The record proves attribution and tamper-evidence. It does not prove that the license is valid or that the operator’s rights are what they claim. The operator’s officer attests to the facts. Cleveland Software certifies the method. The split is stated in the record so nobody mistakes one for the other.

Example

{
  "record": "LicensedDataUse",
  "version": "0.3",
  "id": "ldu_01J6Y3P8M4Q2R9K7T1V5W8X2Z4",
  "ingested_at": "2026-08-14T13:22:07Z",
  "operator": {
    "name": "Example Legal Intelligence, Inc.",
    "system": "case-law-rag",
    "environment": "production"
  },
  "source": {
    "canonical_url": "https://publisher.example/reports/2024/vol-12/opinion-338",
    "content_sha256": "9f2c…e41a",
    "fetched_at": "2026-08-14T13:21:59Z",
    "cmi_at_acquisition": {
      "title":       { "value": "Opinion 338, Volume 12 (2024)", "state": "observed", "via": "html.meta[name=citation_title]" },
      "author":      { "value": "Court of Appeals, Third District", "state": "observed", "via": "html.meta[name=citation_author]" },
      "rights_owner":{ "value": "Example Reports Publishing LLC", "state": "observed", "via": "html.meta[name=dc.rights]" },
      "terms_url":   { "value": "https://publisher.example/terms/ai-license-2025", "state": "observed", "via": "http.header Link rel=license" },
      "c2pa_manifest": { "value": null, "state": "unknown", "note": "No manifest present on this media type." }
    }
  },
  "license": {
    "basis": "contract",
    "agreement_ref": "ERP-2025-0147",
    "agreement_sha256": "b71d…0c9e",
    "scope": ["retrieval", "display_with_attribution"],
    "excludes": ["training", "redistribution"],
    "valid_from": "2025-03-01",
    "valid_until": "2027-02-28",
    "state": "attested",
    "attested_by": {
      "name": "J. Alvarez",
      "title": "General Counsel",
      "organization": "Example Legal Intelligence, Inc.",
      "signed_at": "2026-08-14T13:22:07Z",
      "signature": "ed25519:4mZq…Yw=="
    }
  },
  "cmi_preservation": {
    "policy": "preserve-all-observed-fields",
    "at_chunk": "identical to cmi_at_acquisition",
    "state": "verified",
    "via": "sha256 of serialized CMI block matches at ingestion and at chunk 0..41"
  },
  "chunks": [
    { "chunk_id": "c_000", "sha256": "1a7b…f3d2", "lineage_id": "ldu_01J6Y3P8M4Q2R9K7T1V5W8X2Z4#0", "rights_basis": "license.agreement_ref" },
    { "chunk_id": "c_001", "sha256": "5e0c…a918", "lineage_id": "ldu_01J6Y3P8M4Q2R9K7T1V5W8X2Z4#1", "rights_basis": "license.agreement_ref" }
  ],
  "method": {
    "certified_by": "Cleveland Software LLC",
    "scope": "The ingestion method preserved the fields above and produced the hashes above. Cleveland Software does not certify the validity of the license or the operator's rights.",
    "verifier": "cs-verify 0.3 (MIT)",
    "signature": "ed25519:Qx1p…7Ng=="
  },
  "timestamp": {
    "rfc3161_tsa": "https://tsa.example",
    "token_sha256": "c3e9…4b77",
    "state": "verified"
  }
}

How someone checks it

  1. Recompute the content hash from the archived source and compare.
  2. Validate the operator’s signature against their published key.
  3. Validate the method signature against Cleveland Software’s published key.
  4. Validate the timestamp token.
  5. Recompute the CMI block hash and compare against the value carried on each chunk.

None of those steps require contacting us. That is the point.

What this is not