Cooperation begins with evidence and boundaries.

Identity and authority review

The review should establish the organisation’s legal identity, registration or equivalent evidence, address, authorised representatives, relevant mandate, decision-making route and any restriction that affects the proposed role. Evidence should be current, traceable to its source and reviewed by a role that is not relying solely on the applicant’s description.

A role name is not authority. “Institution,” “Node,” “issuer,” “assurance organisation” or “operator” becomes meaningful only when an approved instrument defines the permitted actions, prohibited actions, scope, term, oversight, suspension and exit.

Define the role before granting access

Every role schedule should state:

• the specific pathway, object or function;
• the actions the organisation may perform;
• the decisions it may make;
• the records or assurance statements it may issue;
• the information it may access and the purpose;
• the people authorised to act;
• the review and conflict controls;
• the start, review and end dates;
• the conditions for restriction, suspension or withdrawal;
• the approved public description, if any.

Technical access must follow the schedule. Access should not create a broader role than the instrument grants.

Allocate information responsibility

Before any personal or confidential information moves, the parties should map the purpose, minimum fields, source, responsible role, recipient, access condition, retention, correction, transfer, incident and exit treatment. The exact legal allocation depends on the organisations, activities and applicable law; it cannot be inferred from a platform label.²

If children or other people requiring heightened protection may be involved, the pathway requires an explicit scope decision, age-appropriate and context-appropriate design, safeguarding ownership and specialised review before activation.⁷

Define safeguarding, complaints and review

The instrument should state who receives a concern, who can see it, who acts, how conflicts are managed, when another responsible body is involved and what the Programme can and cannot provide. A complaint about one institution should not be decided only by the same person whose action is challenged where a separate review is promised.

The existence of a policy title is not enough. The people, coverage, process, secure records, escalation route and operating readiness must be evidenced.

Keep the Node narrow

A Local Programme Node is a designated coordination arrangement for specified activities. It is not automatically a branch, agent, subsidiary, employer, campus, educational provider, public representative or legal presence of the Programme, the Lead Operating Entity or another institution.

The Node schedule should identify its host, people, location or functional scope, permitted activities, prohibited activities, information access, supervision, reporting, safeguarding, term, suspension, exit and public naming. If the schedule is missing or expired, the Node has no active role.

Separate original issuance from independent assurance

The competent institution or other authorised original issuer remains responsible for the original record. An independent assurance organisation may examine only the matter stated in its own schedule and may issue only its own assurance statement.

Every assurance schedule should define the subject, source, method, bounded conclusion, matters not checked, authorised signatory, status values, issue and review dates, correction route, permitted disclosure and withdrawal rule. Several assurance statements remain several separate statements. They must not be combined into a Programme-wide seal, ranking or universal confirmation.

Control public communications and marks

An executed cooperation instrument does not automatically permit a public announcement. Public use of a name, description, quotation, letter or mark requires a separate record that identifies the exact wording, page, language, format, duration, approval owner and withdrawal rule.

A permitted logo, if any, belongs beside the organisation’s own bounded role or assurance statement. It should not appear in a general wall of marks that implies collective ownership, broad sponsorship or approval of every Programme activity.

A non-binding expression of interest

When the route is authorised, an organisation may be invited to provide enough information for an initial review: its identity, proposed bounded contribution, relevant authority, responsible contact and reason for interest. Submission begins review only. It does not create a relationship, confer a role, grant access, reserve a pathway or guarantee progression.

The recipient, purpose, information fields, retention, security and response statuses must be approved before the form is enabled.

Empty and disabled states

Expression of interest disabled

Programme services are introduced in defined phases. Before any public action becomes available, its responsible entity, authority, information safeguards, security controls and support route are confirmed and presented alongside it.

Organisation under review

Programme services are introduced in defined phases. Before any public action becomes available, its responsible entity, authority, information safeguards, security controls and support route are confirmed and presented alongside it.

Authority evidence incomplete

Programme services are introduced in defined phases. Before any public action becomes available, its responsible entity, authority, information safeguards, security controls and support route are confirmed and presented alongside it.

Closing actions

No submission action until the route is approved Review institutional governance