///An Indigenous Data Sovereignty Standard · Affiliated Tribes of Northwest Indians
Sovereignty forward, not an afterthought.
The Tiered Sovereignty Data Framework gives Indigenous Nations a clear, enforceable mechanism for governing data in digital spaces — translating CARE, OCAP®, and UNDRIP from principle into practice through four tiers of escalating care.
The tiers are centered, not elevated — inward means heightened responsibility of care. Select a ring.
///The Four Tiers
Four tiers, one direction of care
Every piece of Indigenous data — from public press releases to ceremonial knowledge — is classified into one of four tiers. Each tier answers the same four questions: what is stored, how it moves, how it is accessed, and how it may be transformed.
When in doubt, classify as T3.
The harm is asymmetric: over-classification delays access until review — correctable. Under-classification can publish sacred knowledge or disclose a burial site — often irreversible. Only authorized human decision-makers may downgrade a classification. Systems may automate protective upgrades, never downgrades.
///Convergence Systems Architecture
Sovereignty across four domains, or extraction through the gap
Classifying data is not enough. Data governed at rest can still be extracted in motion, in storage, or in processing. TSDF traces the full lifecycle and requires governance authority at every stage — because gaps in any layer create openings for extraction.
Data Sovereignty
“What data is stored, and under whose authority?”
The governance layer: the inherent right to govern collection, ownership, classification, and application of data about Peoples, lands, and relations. This is where CARE, OCAP®, and the four tiers live.
Network Sovereignty
“Whose infrastructure carries our information, under whose terms?”
The transmission layer: fiber, spectrum, towers, mesh. Data legally held by a Tribe that travels through infrastructure that doesn’t recognize Tribal jurisdiction is sovereignty made precarious.
Digital Sovereignty
“Whose services hold our data, and whose jurisdiction governs access?”
The service layer: cloud platforms, storage, spectrum, interfaces. Data residency is where a server sits; data sovereignty is whose law governs it. The two are not the same.
Computational Sovereignty
“Who determines how our data is transformed, and toward what ends?”
The transformation layer: analysis, statistical inference, AI/ML. When Indigenous data enters a model it is transformed in ways that can escape governance entirely — unless authority is asserted here too.
///Sharing as Relation, Not Extraction
Windows, not copies
When a Nation shares data under TSDF, it does not transfer assets. It opens a window that remains in its own house: partners see rendered views, run approved analyses that execute at the source, and receive results — while the underlying data never leaves its origin, and every derivative carries its provenance home.
| Extraction model | Relational model |
|---|---|
| Sharing = copying files | Sharing = opening windows |
| Access = possession | Access = participation |
| Value = accumulation | Value = relationship depth |
| Quality = single authoritative source | Quality = density of triangulation |
| Knowledge = data transferred | Knowledge = understanding co-created |
///Standing on Established Ground
Built to operationalize, not replace
TSDF doesn’t invent new principles — it makes existing ones enforceable in software and infrastructure. It is not meant to replace any sovereign framework or cultural ways-of-knowing.
///TSDF Standard · v0.9 series (pre-release)
The Standard, navigable
Every part of the Standard below, with a plain-language descriptor of what it does and the rules it carries. Dotted terms open a definition — the full glossary is at the bottom. For the authoritative text, read the standard document on GitHub. An official 1.0 will not be released without full authorization by resolution of ATNI.
01Theoretical Foundations
▶
What this part does
Names the problem and the response. Centuries of extractive research treated Indigenous knowledge as a resource to be mined rather than a relationship to be honored. The Standard responds by defining Indigenous Data Sovereignty — the inherent right of Indigenous Peoples to govern the collection, ownership, and application of their own data — and rejecting the colonial data paradigm.
Key ideas
- The colonial data paradigm. Dr. Maggie Walter’s “5D Data” critique: colonial statistics emphasize Disparity, Deprivation, Disadvantage, Dysfunction, and Difference — framing Peoples through deficit rather than strength.
- Data ABOUT vs. data FOR. Data about Indigenous Peoples is rooted in extraction; data for Indigenous Peoples is a tool of self-determination.
- The four-tier model as the mechanism that moves these principles from aspiration to enforceable policy.
02Foundational Principles & Distinctions
▶
What this part does
Establishes the political and conceptual ground rules before any classification happens.
Key rules
- Tribes are sovereigns, not stakeholders. All data exchange happens through government-to-government relations.
- Residency ≠ sovereignty. Where a server sits is not whose law governs the data. Authority remains with the Nation regardless of storage location.
- Scope is holistic. Collective & cultural data, individual & administrative data, and biophysical & relational data — the land itself is “the original knowledge organization system.” Data from Indigenous territories carries the same sovereignty claims as the territories themselves.
- The Convergence Systems Architecture. Four interdependent sovereignty domains (Data, Network, Digital, Computational) and the window architecture: view-only federated access where sharing opens windows rather than copying files, and computation travels to the data.
- Federated commons. A shared T0 base layer every network member holds locally — no single point of failure — with sovereign overlays that never leave each Nation’s infrastructure.
03The Four-Tier Data Classification System
▶
What this part does
The core of the Standard: precise definitions for T0–T3, the default rule, and minimum requirements in each sovereignty domain per tier.
| Tier | Definition | Critical principle |
|---|---|---|
| T0 OPEN | Formally and publicly released by the sovereign Indigenous entity for collective benefit | Release is an affirmative act of governance — never a default |
| T1 NETWORK | Shared among trusted Indigenous network members under reciprocal protocols | Reciprocity — relationships are mutual and ongoing, not transactional |
| T2 NEGOTIATED | Shared with specific external partners through explicit, documented agreements | FPIC as an ongoing, revocable relationship — not a one-time transaction |
| T3 SOVEREIGN | Complete Indigenous control; never leaves community-controlled systems | Architectural guarantees — external access technically impossible, not just prohibited |
Rules that travel with every tier
- Default to T3 when classification is uncertain or unassigned (the asymmetric-harm principle).
- Inward movement (toward T3) may be automated — triggered by agreement expiry, protocol violation, or provenance break. Outward movement requires an authorized human decision, documented with rationale. Automated downgrade is prohibited.
- T3 honors strategic invisibility — the choice to remain unseen is itself an exercise of sovereignty. T3 also carries internal protocols: the tier restricts external access; internal governance (clan, gender, ceremonial role) determines internal access.
- Each tier specifies requirements across all four domains — transmission pathways, storage platforms, access mechanisms, and AI/ML authorization — plus IEEE 2890-2025 provenance parameters.
04Framework Alignment & Interoperability
▶
What this part does
Maps every tier to the established frameworks it operationalizes, so adopting TSDF is evidence of honoring them — not a parallel obligation.
- CARE alignment: tier-by-principle mapping with implementation requirements (benefit-sharing mandatory in T2 agreements; only Indigenous authorities downgrade; audit logging; consent records linked to all non-T0 data).
- OCAP® alignment: the window architecture operationalizes Possession — data stays in the source Nation’s custody while authorized parties see rendered views. Where OCAP® exceeds TSDF, OCAP® prevails for First Nations data.
- UNDRIP: Article 19 (FPIC) → T2 mechanism; Article 23 → T0 release decisions; Article 31 (cultural heritage) → T3 architectural guarantees.
- IEEE 2890-2025: adopted as the authoritative provenance reference, including the Data Actor Model — every non-human actor (algorithm, database, AI system) must have a responsible human identified.
- FAIR reconciliation: “As open as possible, as closed as necessary.” FAIR applies only where CARE is satisfied first — and the window architecture lets data be findable, accessible, interoperable, and reusable without transferring possession.
- Local Contexts TK/BC Labels: labels provide cultural specificity; tiers provide governance enforcement. Both travel with the data.
05Governance & Partnership Model
▶
What this part does
Specifies what must be governed, never how a Nation must structure its governance — respecting the diversity of traditional and contemporary governance systems.
- Core functions: classification authority, consent mechanisms across all four domains, exclusive reclassification authority, infrastructure governance, and audit.
- The partnership spectrum (after David-Chavez 2024): Consultation → Collaboration → Knowledge Co-production → Indigenous-Determined. T2 agreements should name the level and build in progression toward Indigenous determination.
- Tribal research codes are enforceable law. Tribal IRBs and research codes form the primary legal basis of every T2 agreement and take precedence over external institutional requirements.
- Federated network governance for T1: membership criteria, reciprocal obligations, dispute resolution, protocol amendment, and commons management.
06AI/ML Governance
▶
What this part does
Draws hard boundaries for machine learning on Indigenous data — the domain where transformation most easily escapes governance.
| Tier | Training | Inference |
|---|---|---|
| T0 | Permitted | Permitted |
| T1 | Network approval required | Network scope only |
| T2 | Per agreement only | Per agreement only |
| T3 | Prohibited | Prohibited |
- Models inherit tiers. A model trained on T1 data carries T1 restrictions on its deployment and outputs. No T3 data may enter any AI/ML system — including “anonymized” derivatives.
- Attempted operations are logged even when denied (IEEE 2890-2025 custody action
denied) for audit. - The 5D problem in AI: T2 agreements involving AI/ML should require Indigenous-determined bias criteria, deficit-framing review, output oversight, and the right to require model modification or termination.
- The limits of computation: “Knowledge is embodied. Computation without relation is not knowledge.” AI can process; it cannot be accountable to kin.
07External Partner Accountability
▶
What this part does
Differentiated requirements for T2 partners, proportionate to extraction risk: Tribes set the terms; partners must qualify.
| Partner | Primary accountability | Highlights |
|---|---|---|
| Corporate (>$50M revenue, or data/AI business) | Contract + IEEE attestation | IEEE 7000/7001/7003/2890 certifications, designated compliance officer, consent to audit, binding arbitration recognizing Tribal jurisdiction, liquidated damages |
| Academic | Institutional policy + IRB | Institution-level (Provost/VPR) acknowledgment that IDSov supersedes university IP policy; publication review rights; Bayh-Dole handling; Tribal IRB primacy |
| Federal / governmental | Trust responsibility | EO 13175 consultation documentation, FOIA exemption strategy required in agreements, data return protocol; failures may breach trust responsibility |
| Small org / NGO (<$5M) | Relational, resolution-based | Tribal resolution grants trust; revocable by subsequent resolution without formal legal process — relationships, not contracts, are the primary governance mechanism |
The jurisdictional argument that resolves the academic IP conflict: Indigenous data originates under Tribal jurisdiction — university IP policies cannot retroactively claim what was never theirs.
08Adoption & Implementation
▶
What this part does
Step-by-step adoption paths for five audiences: Indigenous Nations (assess holdings, designate governance, default unclassified data to T3, update research codes), research partners (recognize the Standard, adapt IRB protocols, implement provenance), technology providers (tier-based access control, window architecture, Indigenous-controlled encryption keys), federal partners (consultation protocols, FOIA handling), and interTribal network operators (federated governance, T0 commons, graceful degradation when connectivity fails).
See the Use & Adapt tab for these paths in full.
09Compliance Checklists
▶
What this part does
Auditable checklists for each alignment: IEEE 2890-2025 (data-actor schema, custody chains, benefit-sharing documentation, denied-operation logging), CARE, OCAP®, Local Contexts, and one checklist per sovereignty domain — so “compliance” means something a reviewer can verify, not a vibe.
///Glossary
Terms, in plain language
Drawn from the Standard and its supporting documents.
///In Practice
What TSDF looks like in real work
Three generic walkthroughs drawn from the kinds of projects Tribal climate programs actually run. In each one, notice the same pattern: the work proceeds, partners get what they need, and the sensitive layer never leaves the Nation.
Infrastructure siting
An agency is evaluating corridors for new transmission lines and asks Tribes to “identify cultural resources and sensitive sites within the study area” — the classic extractive ask. Disclosed locations enter agency records, where public-records law and FOIA can reach them.
The TSDF pattern
Site locations, burial grounds, and gathering areas are classified T3 and never transmitted. Instead, the Nation runs the corridor screening inside its own systems (compute-at-source) and returns a constraint surface — “avoid these polygons, weighted by concern” — as a T2 rendered view under a formal agreement with FOIA-exemption strategy specified. The agency gets exactly what siting requires: where not to build, without ever holding coordinates of why.
Data inventory
| Public corridor alternatives | T0 |
| Regional habitat & hazard layers shared interTribally | T1 |
| Constraint surface delivered to agency | T2 |
| Sacred site & gathering locations | T3 |
Policy scanner
A climate program builds a tool that scans federal and state policy documents and generates per-Tribe advocacy briefs. The inputs look harmless — policy text is public — but the configuration is not: each Tribe’s priorities, vulnerabilities, and positions are strategy.
The TSDF pattern
Source policy corpus is T0 (external public data). Each Tribe’s priority profile is T3 or T2 — held by the Tribe or under agreement, never pooled. Generated briefs inherit the tier of their most restricted input (provenance inheritance): the brief belongs to the Tribe it was generated for, who alone decides whether to release it. And because tier restrictions govern AI/ML, no Tribe’s profile can be used to train models or generate another Tribe’s outputs.
Data inventory
| Federal/state policy documents | T0 |
| Shared scanning methodology & templates | T1 |
| Tribe-specific priority profiles | T3 |
| Generated advocacy briefs | inherit — released only by that Tribe’s decision |
Rapid-response information sharing
During flood or wildfire response, Tribes need to share conditions fast — but emergency data is exactly where sensitive information leaks: evacuation routes that reveal site locations, vulnerability maps that identify households.
The TSDF pattern
A federated T0 commons carries public alerts and baseline conditions — each Nation holds a local copy that syncs when connected and persists when the network fails. Real-time gauge readings and condition reports flow as T1 among verified network members under standing protocols — no per-incident negotiation when minutes matter. Coordination with FEMA or the state happens through T2 views. Household-level vulnerability data stays T3: responders inside the Nation’s systems see it; the network sees only aggregated need.
Data inventory
| Public emergency alerts, weather baselines | T0 |
| Live gauges, road status, condition reports | T1 |
| State/FEMA coordination views | T2 |
| Household vulnerability, routes near sites | T3 |
///Interactive · From the Tier Decision Guide
Which tier is my data?
QUESTION 1 OF 5
This tool walks the Standard’s published decision tree. It is guidance, not governance — classification authority rests exclusively with each Nation’s designated governance body. When in doubt: T3.
///Red Flags
Always T3 unless governance explicitly says otherwise
- Sacred site locations or descriptions
- Ceremonial information of any kind
- Individual health records
- Enrollment / citizenship records
- Financial records
- Traditional knowledge with any access restrictions
- Burial sites or funerary objects
- Clan-specific or gender-restricted knowledge
- Internal governance deliberations
- Specific resource harvest locations
- Data where consent is unclear or undocumented
///Evidence
Why a tiered standard — and why now
TSDF is not a preference; it is a response to a documented record. The evidence comes in three parts: the extractive history of asking Nations to disclose what is sensitive, the maturity of Indigenous Data Sovereignty as an operational discipline, and a policy landscape that requires consultation but under-protects what consultation reveals.
The extraction record
Peer-reviewed analysis of Indigenous community engagement in climate research.
///Claim 1 · Documented in peer review
Asking Nations to identify what is sensitive has been extractive
Vulnerability assessments, hazard mitigation plans, siting studies, and research projects routinely ask Tribes to disclose culturally sensitive sites, economically vulnerable assets, and TEK — and the record of what happens next is documented.
///Claim 2 · Documented in peer review
IDSov is now a robust discipline with clear metrics and processes
This is no longer aspirational language. Indigenous Data Sovereignty, network sovereignty, and computational sovereignty have published principles, assessment processes, institutional adoption, and — as of IEEE 2890-2025 — an international standard.
///The Policy Landscape
Consultation is required. Protection is partial.
Federal and state law mandates consultation with Tribal Nations — and those same processes are where sensitive information is asked for. The protections that exist are exemption-by-exemption, not structural. TSDF is designed for exactly this gap.
Federal
State example: Washington
///Convergence Systems Architecture
A process exploring convergence
TSDF is one output of a broader theoretical synthesis. In mathematical terms, convergence describes lines that grow closer while never intersecting: different Peoples orient around a shared problem while each retains their identity, methods, and ways of knowing. Applied to sovereignty, the argument is that data, network, digital, and computational sovereignty are indivisible — “sovereignty must extend across all layers or gaps emerge where extraction enters.” Twelve principles guide the architecture:
Read the full synthesis: Convergence Systems Architecture (Freeland, ATNI).
///Use & Adapt
Openly licensed, deliberately conditioned
Everything in this repository is released under Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0). The conditions are not fine print — they are the license doing sovereignty work.
Share & adapt
Copy and redistribute in any medium or format. Remix, transform, and build upon the material — adopt the tiers whole, or adapt components into your Nation’s or institution’s own governance documents.
Attribution & ShareAlike
Credit ATNI and the author, link the license, note changes — and release anything you build on it under the same license, so downstream versions stay open on the same terms.
Commercial use
No commercial use without separate arrangement. A framework written to prevent extraction is not raw material for a product.
Indigenous Governance Notice
While this document is openly licensed, implementations that govern Indigenous community data must be developed in partnership with those communities and in accordance with applicable Indigenous data governance and provenance principles (CARE, OCAP®, IEEE 2890-2025, community-specific protocols). The license grants permission to use the text; it does not grant authority over any community’s data.
Adoption paths
Indigenous Nations
Review data holdings against the tier definitions · default everything unclassified to T3 · designate a governance body for classification · update your Tribal research code to reference the tiers · determine partner requirements (Standard §7) · assess infrastructure for window-architecture sharing.
Research partners
Recognize the Standard as authoritative for partner Nations · incorporate tiers into IRB protocols and data-management plans · obtain institution-level acknowledgment that IDSov supersedes university IP policy · implement IEEE 2890-2025 provenance · return or destroy data per agreement.
Technology providers
Implement tier-based access control in architecture · support rendered views and compute-at-source · audit logging per IEEE 2890-2025 · Local Contexts Labels in metadata schemas · Indigenous-controlled encryption keys for T2/T3 · explicit approval before any AI/ML use.
Federal & state partners
Honor government-to-government consultation protocols · address FOIA/public-records exposure in every T2 agreement · document sovereignty-domain compliance · data return protocols with certification of destruction.
InterTribal network operators
Establish federated governance (membership, reciprocity, dispute resolution) · implement the T0 commons with resilience · deploy window architecture for T1 sharing · network-wide provenance · graceful degradation when connectivity fails.
Cite the framework
Pre-release, v0.9 series. Comment and proposed amendments are welcomed at climate@atniTribes.org. An official 1.0 release will not occur without full authorization by resolution of the Affiliated Tribes of Northwest Indians.
Related work
This repository is Part 1: the governance standard. A companion technical specification — the Federated Indigenous Data Protocol — provides implementation details for federated data infrastructure, licensed separately under Apache 2.0.
Related frameworks: CARE Principles · OCAP® (FNIGC) · Local Contexts · UNDRIP · IEEE 2890-2025