We open with a structural problem that a body of regulators has independently described. The OECD published it in November 2025, which means the ground under this position is shared rather than ours alone.
Licensing and permitting are among the most widely used regulatory tools, and their core purpose is to manage risk before it materialises. When they are overused, fragmented or slow, they create unnecessary cost, delay projects, and weaken a government's ability to act.
In more than half of OECD members, enforcement authorities apply no risk criteria at all when targeting inspection and monitoring. Resource goes to low-impact activity while serious risk goes unchecked.
The OECD's recommended answer is a risk-proportionate ladder: do nothing, notify, notify with assessment, light authorisation, full authorisation. Requirements should sit at the rung the risk deserves.
The ladder sorts activity by how much scrutiny it deserves, and that shape is right. It leaves one question open: what is the permission meant to grow? A system tuned to downside alone can manage risk well and still leave capability undistributed.
The rungs already exist in law. Civic Ledger works out which rung a request belongs on, records why, and moves it when the evidence changes.
A permit clears an event. A licence creates an ongoing capability. Civic Ledger works across both and earns differently from each, so this distinction shapes the commercial model as much as the legal one.
Both instruments remain legal facts issued by authorities, and Civic Ledger keeps them that way. What we change sits in the middle. A permit carries conditions with the reasons attached, so the next request can cite the last one. A licence becomes a living commitment that tightens or loosens as compliance accumulates.
The distinction is commercially load-bearing. Permits generate volume: many small events, thin data, transaction economics. Licences generate depth: long relationships, compliance history, an accumulating record of kept conditions. Volume builds the conditions library. Depth builds the trust signal. Both matter, and each runs on its own economics.
Any pricing model that treats a one-day picnic permit and a three-year stewardship licence as one unit of sale will misprice both. Permits should be near-free and high-volume. Licences should carry the fee. That is our first concrete commercial claim, and it falls directly out of the legal distinction.
Every negotiated permission leaves something behind. The question that kept going in circles was which of it we hold, and the answer is clearest when the assets are sorted by who holds them rather than how they came to exist. Four layers. The citizen holds the credentials. The commons holds the record and the grammar. We license the operating logic and hold the standard.
The record that this group met these conditions in this space. Issued as a credential the holder keeps in their own wallet and presents when they choose. Selective disclosure lets them prove a condition was met without revealing which event, when, or where.
Every tested condition attached to a permission: noise caps, hours, insurance thresholds, access duties, what was tried and what held.
Why a condition was set. Four kinds: what was weighed, what was feared, what was owed, and what was imagined.
The registry underneath the credentials: which issuers are trusted, what has been revoked, what schema each credential follows. It holds no personal records and produces no score.
The condition schema, the proof format, and the issuance and verification rules. The grammar anyone needs in order to take part.
Why the grammar has to be open. If the schema is ours, nobody can write to the record or verify a credential without our permission, and what we would have is a readable archive rather than a commons. Opening it costs us schema control and buys us the only thing that makes the mark worth having, which is adoption.
Risk routing, the negotiation method, and the rule review logic. How a request finds its rung, how objections become conditions, and how patterns become defaults.
The conformance criteria: what a process must do to count as a good permission decision, derived from thousands of real ones.
The visible sign that a permission was issued through a conforming process. What makes the standard legible to a citizen, an insurer or a court.
Analysis built on the open record: which conditions fail, where friction concentrates, where risk rules run disproportionate to the risk.
An earlier version of this list called asset 4 a reputation ledger and placed it with us. Both were wrong. Reputation is a general score that travels with a person. What this holds is condition-specific and place-bound: did this group meet these terms in this space. And the record itself belongs to the person who earned it, so we verify rather than hold. Asset 5 is new, and opening it is the change that makes the commons claim real.
Article 5(1)(c) prohibits systems that classify people over time by social behaviour where the resulting score produces detrimental treatment in unrelated contexts, or treatment disproportionate to the conduct. It applies to public and private use alike. Discrete condition-compliance claims stay clear of it. A trust score would not. This is why the ledger produces no number, and the reason is legal as well as ethical.
This is the chain we have been circling. The asset is the decision pattern, and it sits several layers above the raw data. Reading upwards shows where ownership changes hands, and it lands higher than most people expect.
Noise readings, traffic counts, ecological sensors, land records, incident reports. Held by cities, agencies and residents.
stays with the cityInput determines which rung of the OECD ladder a request lands on, and therefore whether it needs a permit, a licence, or nothing at all.
stays with the cityThe negotiated terms, and the argument that produced them. This is where the platform starts generating something that did not exist before.
commonsAggregated across thousands of cases and three countries: which conditions hold, which fail, which are disproportionate to their risk.
commonsThe defensible claim that a process meets the pattern, and the mark that makes the claim visible to a citizen, an insurer or a court.
held by DML KROwnership of layers 1 and 2 is politically expensive and legally fragile, so we should say plainly that we are not seeking it. Ownership at layer 5 is cheap to defend and hard to copy, because it rests on a record no one else has spent three years accumulating.
Layers 3 and 4 sit in a grey zone. Conditions are generated through city operation, on city assets, by city officers using our engine. The operating agreements with Incheon, London and Melbourne need to say explicitly who holds them, because the standard rests on that answer being written down.
The commitment is real: the intelligence this platform generates belongs in a commons rather than in private hands. Stated on its own, that commitment removes our revenue, and we should be honest that it does.
Platforms that gather performance data typically hold the resulting intelligence, building knowledge asymmetry over the people who generated it. We are refusing that move. Rules are a byproduct of civic negotiation, and they belong in common hands.
Decidim protects its commons with a copyleft licence rather than ownership, and asks partners to return roughly three per cent of related revenue. It works at scale. It also rests on trust rather than enforceability, and Decidim remains almost wholly dependent on one city.
Open the record. Charge for conformance to it.
The conditions library, the reasoning record, the ledger and the grammar for writing to it are all open. Anyone may read them, fork them, build on them, verify against them. That openness is what makes the pattern they produce credible.
The scarce thing is the right to say this decision was made to the standard, and to carry the mark that proves it. Gore earns its revenue from the tag.
We make reciprocity a condition of the licence rather than a handshake. Anyone using the conditions commons at non-commercial scale pays nothing. Anyone deriving commercial revenue contributes a defined share back, with the obligation written into the licence text where it can be enforced.
Three instruments, because the engine, the record and the authority pull in opposite directions. The engine needs control, the record needs openness, the authority needs scarcity. Covering all three with one instrument is why the design keeps stalling.
"We cannot design any licence until we know your business logic, because the licence is just the mechanism to capture the value. If you do not have the business logic, we cannot design the licence."
Legal counsel, reported to the team, July 2026
He is right, and this document exists to remove the blocker. Here is the business logic in five steps, so the licence design has something to follow.
We host the negotiation that turns a request into a permission with conditions attached, across permits and licences, in three countries.
The only accumulated record of how civic permission decisions are actually made, why conditions were set, and whether they held. No one else is building this.
The record is credible because it is open and contestable. Enclosing it would remove the credibility that gives it worth, and break our commitment to the cities that generated it.
In the authority the record confers: the defensible standard for a good permission decision, and the mark that proves conformance. Scarcity sits at the authority layer.
Three instruments. Keep the record open and reciprocal. Charge operating companies to run the engine and oblige them to feed the record. Charge anyone, including those who never touch our software, for the right to claim conformance.
Counsel can now be given three bounded questions. Can a reciprocity obligation on commercial re-use be drafted enforceably in Korean, German and English law? Can conditions generated on city assets be held by DML KR, and where they cannot, what structure holds them instead? Can a certification mark be registered and defended while the standard is still being documented?
The test of a position is whether it survives contact with real requests. Select a case to see which instrument applies, what Civic Ledger changes, and what it earns.
The room exists, the licence to operate exists, the daytime demand exists. What is missing is a cheap way to authorise a different use of the same space between Tuesday and Thursday.
Risk is low and well understood, so under the OECD ladder this belongs near the bottom rung. In practice it often triggers the same process as a street festival.
Testing water, installing sensors, submitting evidence, and requiring a response. This is a capability held over years, against parties with more power than the group has.
Structural load, water, access, insurance, and what happens when half the group leaves in year two. The instrument has to survive the group changing.
These are the questions we bring into the room. We are asking which parts of the position break, and where you would rebuild them differently.
City officers, using our engine, on public land, produce a condition. Our position places the derived pattern with the protocol holder and leaves the underlying record with the city. Whether that survives procurement law in all three jurisdictions is genuinely open.
Decidim's three per cent works on trust and cannot be enforced. We want the obligation inside the licence. Whether a revenue-share condition attached to open data holds up in Korean, German and English law is a real question and we would value a straight answer.
The civic standard needs years of accumulated decisions to be defensible. The revenue needs the mark now. We are weighing registering the mark early and growing into it against waiting and losing those years.
If the record is a commons and the code goes to GitHub in September, a well-resourced city could take both and pay no protocol fee. Our answer is that the mark and the standard are what they actually need. We would like that answer tested hard.
A certification mark held by a commercial operator reads as capture. Held by a body with no revenue, it becomes hard to defend. The steward-ownership structure has to solve this, and we have yet to test it against a lawyer.
Naming the ledger a commons settles who may use it and settles nothing about who keeps it running. Uptime, governance and schema stewardship all cost money, and unfunded commons decay quietly. This needs an answer before the ledger carries anything a city depends on.
Our reading is that holder-held, condition-specific credentials with no aggregate score sit outside the AI Act's social scoring prohibition, and that routing a request to a lighter process on the strength of a record is proportionate and same-context. We would like that reading attacked rather than agreed with.
We claim permits should be near-free and licences should carry the fee. If cities will not pay licence fees at the level required, the whole shape inverts, and we would rather learn that before December.
Four documents, one argument. This one sets the position. The others show where value concentrates, the structure it depends on, and the evening it is being tested at. This reading order works best.
Four archetypes, airlines, Michelin, Gore-Tex and Stripe, and where Civic Ledger's assets sit against them.
What the platform should hold, what it should give away, and how the licence follows from that.
Entity diagrams for mySociety, Decidim and Library of Things, and the five-layer operating architecture.
The public evening on Tuesday 4 August: who is speaking, the running order, and the funding case.