28.1Public visibility and permitted reuse
Access to see a document and permission to reuse it elsewhere answer different questions, and the stipulated case keeps them apart. A fictional contributor grants one designated editor access to record R for a limited correction review. A public reader can see R's identifier and the notice that access is restricted, but cannot inspect R's body. The editor's ability to read R therefore carries only the purpose for which access was granted; it does not silently widen into permission to republish R, to reproduce its contents in a new summary, or to supply them to a further project. Viewing is a condition of entry; reuse for a new purpose is a separate decision that must be granted separately.
The distinction between access and reuse does useful work in what becomes publicly inspectable. A correction notice can identify the affected summary version and describe the scope of the authorized editor's review without disclosing restricted source content. The public can then verify that a correction was made, which summary version it corrected, and what kind of review was authorized, while the restricted body remains hidden. This is the truthful record worth preserving: it states plainly what the editor was permitted to examine and what the public is permitted to see, without pretending that hidden material was reviewed by anyone beyond the stated scope, and without converting a limited editorial permission into a general license.
The qualification that matters is narrow. These access permissions are stipulated features of the example, not asserted legal rules, so nothing here settles what a real repository's terms would authorize. Nor does restriction cost nothing: it reduces the public's ability to check R for itself, which is exactly the reproducibility concern that restrictions can also shelter institutions from scrutiny. But answering that concern by collapsing visibility into reuse would either overstate the editor's permission or obscure the access limit that the public record should honestly carry.
Even where a record's identifier and access restriction are publicly visible, visibility supplies only those two facts. In the stipulated example, a public reader can see that record R exists and that its body is closed, while the contributor grants a designated editor access solely for a limited correction review. That grant documents a scope; it does not settle whether other forms of use are permitted, and nothing in the example licenses a legal conclusion about republication, quotation in a new context, or reuse in a later project.
The inferential step is therefore modest but consequential. From public visibility of the restriction, one may conclude that the archive discloses the existence and shape of its limit; one may not conclude that the body has been reviewed, that the editor's mandate is general, or that a separate purpose falls inside the original permission. A new purpose is a new question, and the documented record answers it only to the extent that the contributor's stated terms address it.
This keeps the correction notice useful without overclaiming. The notice can identify the affected summary version and the scope of the authorized editor's review, while leaving the restricted content out of circulation. Public inspectability remains limited, and the notice should say so rather than imply independent verification of R's body.
The cost is real: restrictions narrow reproducibility and can shelter a source from scrutiny. Recording the access boundary precisely is what makes that cost visible; relaxing the boundary would be a separate decision. What the account owes readers is a truthful record of who could see what, for which stated purpose, and of the remaining gap between a documented scope and any permission that was never actually granted.
28.2A source withheld from an editor
Visibility tells a reader that record R exists and is restricted; it does not hand them the text. In the stipulated case, the designated editor may inspect R only for a limited correction review, while the public reader sees the identifier and restriction but not the body. Those permissions set the evidential boundary: whatever that editor confirms belongs to the correction review, and nothing beyond that scope becomes public or reusable.
The harder case arises when another editor receives a report about what R says but has no permission to open it. Here the right move is to separate levels. The report is a reported assertion: someone attributes a claim to R. It is not a verified excerpt, because no permitted inspection has checked the wording, the context, or the match between claim and body. Phrasing the matter as though the source itself had been consulted silently converts attribution into evidence. Describing the claim as reported by an intermediary keeps the distinction visible, though it does not endorse the intermediary either.
Conditionally, if the designated editor were permitted to quote a passage for the correction notice, that passage would become an excerpt verified within the authorized scope — but still not a license to circulate unrelated portions.
Public inspection remains limited, and that limitation is material. Restriction may shield an institution from scrutiny and prevents readers from reproducing the check themselves. The truthful record should say exactly that, rather than treating opacity as confidence. It also should not pretend that hidden material was reviewed by anyone who lacked access.
A correction notice can therefore name the affected summary version and the scope of the authorized editor's review without disclosing restricted content. This is narrower than declaring the underlying claim proved or false: the claim remains unverified for anyone outside the stipulated access. If such an archive is discussed through the FAIR/CARE distinction, the comparison is the author's analogy; CARE's Indigenous governance origin is not thereby a validation of this hypothetical arrangement.
Once the reported assertion has been separated from the verified excerpt, a further distinction matters: a source can be credible in its own terms and still unavailable to most readers. In the stipulated example, the fictional contributor grants a designated editor access to record R for the purpose of a limited correction review. The public reader may see R's identifier and the fact of its access restriction, but not R's body. Those permissions establish who may inspect what; they do not establish that R is true, false, or decisive.
The honest limitation is therefore narrower than either verdict. Withholding R does not show that the affected summary is accurate, and it does not show that the summary is refuted. What can be said publicly is more modest: R was identified, an authorized editor was permitted to review it for a stated correction scope, and the affected summary version was addressed within that scope. A correction notice can record exactly those points without reproducing restricted content. Beyond the authorized scope, neither the editor's access nor the contributor's grant licenses any claim about what R contains.
Credibility and availability must not be collapsed in either direction. Restricted material is not discredited merely because a reader cannot inspect it; conversely, a contributor's decision to supply it under conditions is not independent verification for a public audience. The resulting public record should therefore state the access limit plainly and attribute any account of R to the review that was actually authorized, rather than presenting hidden material as though its contents had been examined by those who cannot see them.
This restriction has a cost that should not be disguised: public reproducibility remains limited, and a restriction may also shield the source from scrutiny. That is a reason to describe the boundary accurately, not a reason to treat the boundary itself as evidence. Visibility and reuse are distinct design choices, and the permissions stipulated here are permissions, not legal rules.
28.3Different reader access
Access can vary without changing what evidence is. In the stipulated case, the designated editor may inspect record R to review a correction, while a public reader can see only R's identifier and the stated restriction. Both audiences are addressed to the same source, yet only one can examine its body. This difference matters because a shared identifier supports reference, not equal verification.
The practical response is to separate visibility of the record's description from permission to reuse or inspect it. The public correction notice can name the affected summary version and report that an authorized editor reviewed a defined correction scope; it need not reproduce R's content. What it cannot do is imply that readers outside the arrangement checked the source themselves. The record should therefore state who had access, under what limited purpose, and what remained hidden. That is a truthful account of unequal access, not a substitute for public inspection.
A related distinction is available in data-management guidance: FAIR permits authentication and authorization where necessary, together with persistent accessible metadata when data themselves are unavailable (Wilkinson et al., 2016; addendum 2019). The guidance also addresses usage licenses and provenance, neither of which the stipulated permissions settle by themselves. The point here is only that persistent descriptive metadata can accompany restricted material; it does not make this arrangement FAIR-compliant, and unrestricted publication is not required to keep an object identifiable.
The limit is equally clear. If most readers cannot inspect the evidence, they cannot independently repeat that source check through the published notice. The notice should accurately describe the scope of the authorized review. Restricted access does not itself make a broader claim false, but any broader assurance still needs adequate support; a separate audit is one possible route, whose existence and findings are not established here. Preserving a voice can therefore coexist with restricted circulation, provided the restriction is visible and its cost to verification is stated plainly.
Once access is unequal, the question is what a restricted inspection can carry. In the stipulated example, a fictional contributor grants a designated editor access to record R for a limited correction review. The editor's look at R can support a bounded claim: that the summary in a named version required correction within the stated scope. What it cannot support is a claim that every reader has inspected R, or that the record has been publicly verified.
The manuscript should therefore record three things separately: R's identifier, its access restriction, and the scope of the authorized editor's review. A public correction notice can name the affected summary version and say what the editor was permitted to check, without reproducing restricted content. This keeps visibility and reuse as distinct design choices: the notice is visible to all, while reuse of R remains limited to the purpose for which access was granted.
The natural objection is that restrictions shelter institutions from scrutiny and make results irreproducible. That objection has force precisely where a claim outruns the inspection route. Reproducibility is not all-or-nothing; it depends on what is claimed. If the manuscript claims only that a bounded review found a specific defect in a specified version, the private audit is proportionate evidence, and readers can judge that claim against its stated scope. If instead the manuscript invites readers to confirm the record's contents, it promises an inspection route that does not exist, and the restriction becomes a credibility problem rather than a protection.
The limit is therefore narrow and enforceable by discipline: the claim must stay inside the purpose for which R was opened. These permissions are stipulated in the example, and nothing here establishes who may legally grant, withhold, or override access. What the document owes its readers is a truthful account of who could see R, for what purpose, and therefore which conclusions that access can and cannot bear.
28.4Community authority and purpose
A persistent identifier or public URL answers a question of location: where a record can be found. It does not answer a question of authority: who may approve a use the record's makers did not contemplate. Conflating the two lets technical discoverability stand in silently for permission, which is a category error rather than a convenience.
The FAIR principles address discovery and reuse of research objects by people and machines (Wilkinson et al., 2016; addendum 2019). This is a real achievement: material that can be located, parsed and combined is more likely to support verification and secondary inquiry. Yet these principles concern findability and reusability in a technical and scholarly sense. They do not by themselves establish that a particular reuse is permitted or ethically acceptable, and nothing in them warrants unconditional openness. For the design argument here, usability metadata and authorization metadata are different instruments, and the first cannot substitute for the second.
CARE frames a different question. As Carroll and colleagues describe it, the framework centers people, purpose and Indigenous data governance when data reuse is considered (Carroll et al., 2020). There, authority over reuse is anchored in the governance relationships of the communities whose data is at issue, and the purpose of a new use becomes a substantive question for those relationships to settle. The claim is specific to that Indigenous data-governance setting; it is not a general grant of authority to platforms, repositories or preservation systems.
For preservation design the consequence is that a link records reachability, not consent. A system may truthfully store and display an access limit, an identified governing body, or a stated purpose restriction while remaining silent on whether any new use has been authorized. Recording that silence honestly is preferable to letting a resolvable address imply an approval no one has given.
The FAIR/CARE distinction now does specific work. The FAIR provisions discussed above concern findability, access and reuse; they do not by themselves settle the proposed archive's questions of purpose and collective authority. CARE addresses people and collective authority within its stated Indigenous data-governance context. Moving that vocabulary to a hypothetical archive of restricted editorial sources is therefore an author's proposed analogy, not a validation supplied by the framework itself, and the analogy would need its own justification before it could govern a different community. The origin of the vocabulary should remain visible even when the argument travels.
In the stipulated example, the contributor grants a designated editor access to record R for one limited correction review. That grant is scoped twice over: by purpose, because access exists to check a correction rather than to open the material to further reuse, and by role, because the permission attaches to the designated editor rather than to whoever might later encounter the identifier. These are permissions fixed by the example, not legal rules inferred from it.
The inferential step follows from separating visibility from reuse. Under the stipulated arrangement, a public correction notice can name the affected summary version and describe the scope of the authorized review without reproducing R. The record thereby states truthfully what was examined, by whom, and under what constraint, while the body of R stays closed. Public inspectability remains limited: readers can see the identifier and the restriction but cannot verify the editor's reading against the source.
That is the relevant limit, and it should not be softened. Restrictions can shield institutions from scrutiny, and purpose-bound access does reduce reproducibility for anyone outside the grant. The design does not repair that cost by implication. It preserves the access limit as part of the record so that a correction is traceable to an authorized, bounded review without pretending the hidden material was reviewed by the public or that its circulation has been approved.
28.5Retention without gratuitous exposure
Retention should carry whatever a correction requires and nothing that gratuitously enlarges the source's audience. In the stipulated case, a fictional contributor grants a designated editor access to record R for a limited correction review. A public reader can see R's identifier and its access restriction but not its body. The correction notice can therefore name the affected summary version and the scope of the authorized editor's review without reproducing restricted content. That combination is enough to locate the correction: a later reader learns which record bears on the summary, who was permitted to consult it, and how much of the problem was actually taken up.
What the record must avoid is overstating its coverage. Because the restriction is documented, the missing body is not mistaken for proof that nothing was consulted; because the scope of the review is documented, the correction is not read as a full examination of R. Both halves belong to the same entry, and the permissions themselves are stipulated facts of this example, implying no legal rule about any real archive. Retention of the locator is thus a decision about what a correction needs to be revisitable, separate from the decision about whether the source itself becomes visible or reusable.
This narrow good does not dissolve the objection that restrictions can protect institutions from scrutiny and reduce reproducibility. The archive described here remains inspectable only to the extent that the identifier and the restriction are public, and the resulting limits on public examination are a real cost to reckon with rather than an inconvenience that better metadata removes. Nor does a framework justify itself by its origin: the FAIR/CARE distinction from 28.4.1 still separates open-access ambitions from CARE's Indigenous governance commitments, and pressing that contrast into the service of a fictional archive is this study's proposed analogy, not the framework's validation of the archive. What retention buys is a truthful account of where the correction came from and what was authorized to be seen, with no pretense that hidden material was reviewed by everyone who cites the result.
The record should therefore identify R by identifier and state the access restriction that applies to it, while also naming the affected summary version and the scope of the designated editor's authorized review. Those entries let a reader locate the correction, determine which text was revised, and learn which permission governed the work. They do not disclose R's body.
That retention strategy is narrower than it first appears. The public reader can verify that a correction was made, what it concerns, and which editor performed the review, but cannot inspect the source on which it rests. Reducing exposure therefore reduces public inspectability: the evidence available for independent checking is the record of the correction and the permission, not the restricted material itself. It would be misleading to describe this arrangement as both maximally private and fully transparent. The honest scope is careful record-keeping under bounded access, not unrestricted reproducibility.
The permissions in the example are stipulated for the purpose of the illustration; no legal rule is inferred from them. Nor does the record's format itself resolve who may authorize future access. Its role is to preserve a truthful account of what was corrected and of the limits within which the review occurred.
One further distinction matters here. The FAIR/CARE distinction established earlier remains intact: CARE originates in Indigenous data governance, and applying its vocabulary to this hypothetical archive would be an author's analogy, not a validation of the archive by that framework. Keeping the analogy marked prevents a retention design from borrowing authority it has not earned.
28.6Correction without public disclosure
Restricting circulation need not prevent correction of a particular editorial claim. In the stipulated example, the contributor grants a designated editor access to record R only for a limited correction review. Through that channel, the contributor can challenge a specific edit—say, that a summary attributes to R a proposition it does not support—and ask the editor to compare the disputed wording with the record itself. The editor can then confirm, narrow, or reverse the edit without posting R or its passages into a public thread.
This separates correction from republication. The restricted channel supplies the material needed to assess the challenge; it does not convert that material into reusable public content. Access to R remains confined to the designated review, while the editor retains responsibility for correcting the summary version affected by the disputed edit. The permission is stipulated for this example, not a statement of legal rules.
The gain is specificity: the contributor can identify one edit and one source ground, and the editor can resolve it against the record rather than relying on competing paraphrases. The limit is equally specific. Outsiders cannot inspect R, so the public cannot independently reproduce the editorial comparison, test the editor's reading of the record, or detect every mistake that a broader review might catch. Restriction can therefore protect a limited channel from indiscriminate exposure while also shielding the correction process from scrutiny—a concern that cannot be dismissed by noting the contributor's good faith or the editor's authority.
Correction without disclosure is therefore a genuine but incomplete safeguard: it can improve a summary's fidelity to R without making R or the reasoning publicly inspectable.
Once a contributor's challenge has been accepted through the restricted channel, the correction still needs a place in the public record. That record can state that a scoped correction occurred: it identifies the affected summary version and the scope of the authorized editor's review, while leaving record R's body unavailable. The public reader can see R's identifier and its access restriction, but not the material on which the editor worked. These permissions are stipulated features of the example, not legal rules inferred from it.
What the record must not do is convert limited access into outside verification. Because the designated editor was the only party permitted to inspect R for the limited correction review, no external reader has checked the restricted content against the corrected summary. A notice implying such a check would misdescribe its own evidentiary base. The truthful formulation is narrower: an authorized review took place, under stated permissions, and it changed this identified version within this stated scope. Everything beyond that remains unverified by readers who could not look.
This is where the restriction's familiar cost enters. Restrictions can shield institutions from scrutiny and reduce reproducibility, and that objection is not answered by a tidy notice. The answer is procedural honesty: the notice discloses the limit instead of quietly absorbing it into an assurance of accuracy. Reproducibility is genuinely reduced here, and the record should show the reduction rather than disguise it. A reader who learns only that a correction occurred has been told something true but deliberately incomplete.
The governance language surrounding such restrictions is likewise analogical. CARE's origin in Indigenous data governance is not repurposed as a validation of this fictional archive, and the FAIR/CARE distinction holds: making a correction findable is not the same as making its basis inspectable. The public record preserves the truth of the correction and the truth of the limit; it should not purchase tidiness by claiming an inspection that never happened.
28.7A scoped provenance statement
The provenance statement can therefore say precisely what happened without widening it into a general assurance. In the stipulated case, the fictional contributor granted a designated editor access to record R for one limited correction review. That editor could inspect the body of R alongside the affected summary version in order to establish what the correction required. These permissions belong to the example; no legal rule follows from them.
Beyond that circle, the statement must be equally precise. A public reader can see R's identifier and the notice that its access is restricted, and can see which summary version was affected together with the scope of the authorized editor's review. What the public reader cannot do is inspect R's body. The notice therefore indicates that a scoped correction occurred while leaving protected content unavailable; it does not imply that outside readers verified the restricted source or checked the editor's reasoning against it.
This asymmetry between the editor's restricted inspection and the public reader's inability to inspect R is the point, not a defect to conceal. Provenance records who could inspect which versions, for which purpose, and where that permission ended. Collapsing the editor's access into public inspectability would convert limited permission into a claim of universal access; suppressing the record altogether would leave the affected summary version looking unqualified. The truthful form keeps both facts in view: an authorized review took place, and its evidential basis remained closed.
One distinction established earlier should remain visible as well. The FAIR/CARE contrast is preserved here on its own terms: CARE has an Indigenous governance origin, and any application of that contrast to this hypothetical archive is an analogy the author draws, not the framework's validation of the archive.
The statement is useful precisely because it says what the record establishes and what it does not. In the stipulated case, the designated editor could inspect record R during a limited correction review; the public reader can see R's identifier and its access restriction but not its body. The provenance statement therefore records two layers: the authorized inspection that occurred and the inspection that remains unavailable. It does not convert the first into general access.
This matters when the statement is applied downstream. A public correction notice can name the affected summary version and the scope of the authorized editor's review without reproducing restricted content. That is enough to tell a reader which account changed and under what editorial conditions, while leaving the body of R unreviewed by them. What the notice cannot support is a claim that the source was publicly verified, or that the correction is reproducible by anyone holding only the notice. Where a purpose requires such reproducibility, the statement should say the purpose is not supported by current access.
The notice's inability to support public verification or independent reproducibility remains a substantive limitation. Restrictions can protect institutions from scrutiny and can reduce reproducibility; a scoped statement does not neutralize that risk. It disciplines it: the scope of permitted use, the identity of the authorized reviewer, and the remaining gap are preserved as facts about the record rather than smoothed into a narrative of full transparency. Discarding the private review would be no better. The editor's inspection belongs to the truthful history of the correction, even though it does not license broader circulation.
The relation to FAIR and CARE distinguished in 28.4.1 should remain intact. CARE keeps its Indigenous governance origin; extending its vocabulary to this hypothetical archive is an analogy made in this chapter, not the framework's validation of that archive.