The record belongs to the producer

The four properties above are enforced between organisations. A mandate is activated, paused and revoked only by the party whose data it is; a read across one is recorded on that party's own trail whether it succeeded or was refused; and a portfolio mandate cannot ask for grower-level detail at all.

A grower's own sharing consent is also a server fact rather than an understanding. Releasing their record to a lender, a buyer or a certifier is recorded against them and scoped to who may read it, and withdrawing it writes a revocation that leaves the original grant standing — a permission given and later taken back is part of the record, the same way a reversing entry is.

Whether a grower performs any of that themselves turns on one thing, and it is not whether somebody sponsors them. A grower who holds their own tenant signs in, runs their workspace, and accepts or declines an invitation into a scheme from their own account — the sponsoring organisation cannot accept on their behalf, and the platform refuses the attempt rather than trusting it not to happen. A grower who exists only as a row in a scheme's register has no login attached to that row, so their consent is captured by the scheme on their instruction, with the member who wrote it down recorded on the grant.

That second arrangement is deliberate rather than unfinished, and it buys something worth having: a later dispute has a chain of custody instead of an assertion. It is still not self-service and we will not write it as though it were. Giving a register-only grower a seat of their own is the work, and the reading of who has looked at their record goes with it.