The Sovereignty of Data

The default relationship between manufacturers and their data has been extractive. Equipment vendors collect telemetry through connected machines and aggregate it for their own purposes. SaaS platforms ingest operational data and retain broad usage rights buried in terms of service. Cloud providers store manufacturing data on infrastructure they control, under contracts that may or may not survive an acquisition or policy change.

Manufacturers have been passive participants in their own data economy — generating enormous value but controlling almost none of it.

Distributed identity frameworks change this equation fundamentally. Instead of handing data to a platform that decides what happens next, manufacturers retain cryptographic control over their data streams and set the terms under which others can access them. The shift is from data as a byproduct to data as a sovereign asset.

What Data Sovereignty Means in Practice

Data sovereignty in an industrial context has three dimensions:

Ownership: The manufacturer holds the cryptographic keys that control access to their data. No intermediary — including Assay — can grant access without the manufacturer's explicit, revocable authorization.

Granularity: Access permissions operate at the level of individual data streams, time ranges, and use cases. A manufacturer can license vibration data from Line 3 for predictive maintenance model training while keeping thermal data from the same line entirely private. The permissions are as fine-grained as the manufacturer wants them to be.

Revocability: Access grants are not permanent transfers. They function more like licenses that can be modified, suspended, or revoked. If a data buyer violates the terms of use, the manufacturer can cryptographically revoke access — not just contractually, but technically.

The DID-Based Permission Model

Assay implements data sovereignty through a permission model built on Decentralized Identifiers (DIDs) and Verifiable Credentials:

Manufacturer DID: Each manufacturing facility has a master DID that represents the organization's data authority. This DID is controlled by keys held by the manufacturer — not by Assay, not by any platform.

Data stream registration: Individual data streams (sensors, machine groups, production lines) are registered as sub-identifiers under the manufacturer's DID. Each stream has its own access control policy.

Access grants as Verifiable Credentials: When a manufacturer authorizes a buyer to access specific data, the manufacturer's DID issues a Verifiable Credential to the buyer's DID. This credential specifies:

• Which data streams are accessible
• The authorized time range
• Permitted use cases (e.g., "model training only" vs. "model training and benchmarking")
• Whether the data can be sublicensed or combined with other datasets
• The expiration date of the grant

Cryptographic enforcement: The data infrastructure checks these credentials before delivering data. A buyer whose credential has expired or been revoked simply cannot access the data — the system won't decrypt it for them.

Beyond Contracts: Technical Enforcement

Traditional data licensing relies on contracts — legal documents that define rights and obligations, enforced through litigation after a violation occurs. This model has three problems:

1. Detection: How do you know your data was misused? By the time you discover a violation, the damage is done.
2. Enforcement: Litigation is slow, expensive, and uncertain. Small and mid-sized manufacturers rarely have the resources to pursue contract violations against larger buyers.
3. Geography: Data crosses borders instantly, but contract enforcement is jurisdictional. A contract governed by US law may be unenforceable against a buyer operating in a different legal system.

DID-based sovereignty adds a technical enforcement layer that operates before the contract matters:

• Data that hasn't been authorized can't be accessed (encrypted, with keys controlled by the manufacturer)
• Access that has been revoked stops immediately (credential revocation propagates through the verification infrastructure)
• Usage terms are machine-readable and can be automatically enforced by the buyer's data pipeline (a credential that says "training only" can be checked programmatically before data enters a benchmarking workflow)

Contracts still matter — they provide the legal framework and define remedies. But technical enforcement handles the common cases automatically, without lawyers.

Practical Implementation

Manufacturers adopting Assay's sovereignty model go through several steps:

Key ceremony: The manufacturer generates their master DID keys in a controlled environment. Keys are stored in hardware security modules (HSMs) under the manufacturer's physical control. Assay never possesses these keys.

Stream mapping: Working with Assay's integration team, the manufacturer identifies and registers the data streams they want to make available for brokerage. Each stream gets a sub-DID and a default access policy.

Policy configuration: The manufacturer sets their licensing preferences — which streams, what uses, what price points, what exclusivity terms. These preferences are expressed as machine-readable policies attached to the stream DIDs.

Marketplace listing: Streams appear in Assay's marketplace with their metadata, schema, and statistical summaries visible to potential buyers. Buyers browse, evaluate, and request access. The manufacturer reviews and approves access requests — or configures auto-approval rules for requests that meet predefined criteria.

Ongoing management: The manufacturer monitors access through a dashboard showing who is accessing what data, how much they're consuming, and whether credentials are approaching expiration. They can modify policies, revoke access, or adjust pricing at any time.

The Manufacturer's Calculation

Data sovereignty changes the risk calculation for manufacturers considering data monetization:

Without sovereignty: Selling data means losing control. Once data is delivered to a buyer, the manufacturer relies entirely on contractual terms and trust. The worst case — competitive intelligence leakage — is hard to detect and harder to remedy.

With sovereignty: Selling data means licensing access under cryptographically enforced terms. The manufacturer retains control at every stage. Access is granular, time-limited, and revocable. The worst case is contained — and more importantly, it's preventable rather than merely remediable.

This difference is what opens the door for manufacturers in sensitive industries — aerospace, defense, pharmaceuticals, precision manufacturing — to participate in data markets for the first time. They aren't handing over the keys. They're issuing controlled, time-limited access passes under their own authority.

The sovereignty model doesn't just protect manufacturers. It creates a healthier market. Buyers get data from sources that would never participate in a traditional brokerage. Manufacturers get revenue from assets they previously couldn't monetize. And the market as a whole benefits from a larger, more diverse, higher-quality supply of industrial data.