Make sure the farmer can take their records with them.
Ownership is not the whole agreement
This chapter frames contractual and system questions. Treat imagery, field boundaries, operational history, trained models and aggregates as distinct assets. Define access, onward sharing and training use by purpose.
Test export during procurement
Test export of GeoJSON boundaries, CSV jobs, original imagery and metadata for processing, units, coordinates and time. A file is not portable if its meaning is lost. Review deletion, retention duties and post-contract access with local legal expertise.
Use least privilege and audit
Limit farmers to their fields, contractors to assigned jobs and analysts to required observations. Expire shared links and audit changes. Before sending records to an AI service, assess whether precise locations or personal information are necessary.
A standard file format does not grant permission
STAC 1.1 describes assets, roles, providers and licensing; data and metadata need not share the same license. GeoJSON RFC 7946 specifies coordinate interpretation, not permission to share farm information. Our proposed review separates readability, permitted use and onward sharing. Discovering imagery through a public catalog does not establish redistribution or model-training rights. Record format compatibility and permitted uses on the same acceptance sheet to prevent migration misunderstandings.
Test migration with one complete field history
Test exit with a full crop cycle for one field, not merely a small boundary file. Move boundary versions, jobs, observations, prescriptions, execution results and correction reasons into another environment and reconstruct the state on a selected date. Proposed acceptance criteria include preserved field-ID mappings, matching area, units and times, and traceability from source imagery to results. A PDF of the screen may not support reanalysis; a large image dump without calibration or missing-data meanings may be equally unusable. Record export time, fees, retrieval deadlines and unreadable fields before contracting.
Handle correction and deletion without losing provenance
Silently replacing a disputed boundary can erase the map basis for a historical application. A proposed design creates a new version with a reason and effective date while retaining the version referenced by prior jobs. This does not justify retaining every personal detail indefinitely: define purpose and retention periods. Agree who handles conflicts among deletion requests, legal retention and evidence preservation for insurance or incidents. This is a contractual and system-design framework, not a claim of identical deletion rights or retention duties everywhere. Determine the applicable requirements for each data category and jurisdiction.
Separate model-training use from the service delivered
Do not combine use necessary to deliver analysis with reuse to train models for other customers in one consent box. Our proposed record specifies data, purpose, recipient, location, duration, subcontracting and cessation separately. Consider whether location, date and an unusual crop could reveal a farm despite removed names. Removing a contribution from a trained model depends on implementation; a delete button should not promise complete reversal without evidence. State how refusal of additional use affects the base service, price and access to outputs so farmers can assess the actual exchange.