Play all three roles in order: ① a creator sets a scoped, expiring permission in their AI Passport vault → ② a platform fingerprints their upload and binds it to that policy → ③ anyone can check a copy of the work and get its live licence status, without learning who the creator is. Try checking a recompressed copy at the verify step — it still matches, because the fingerprint comes from the pixels, not the file.
This is your standing policy — held in your AI Passport vault, not stamped into any file. Every work you publish points back to it, and you can change it at any time. There's no separate "revoke" switch: narrowing the scope or turning off AI training is revocation, because every check reads the live policy.