The outside link
Every problem you have ever had with your pictures was a copy
Not a leak, not a hack, not a villain. A copy: a folder somebody downloaded in October under an agreement that changed in March, still sitting in an account nobody remembers. Here is the alternative, and what it costs you.
What an outside party actually gets
A way in that belongs to them, that the school can withdraw, and that is verified again every single time it is used. Not a file. Not a folder. Not a link that works for whoever it was forwarded to.
Three things are checked at the moment somebody arrives rather than at the moment the arrangement was made. Whether the arrangement is still live. Whether every student concerned still has a current permission. And whether the destination is still somewhere we are willing to send anybody at all.
Where any of those fails, the attempt produces exactly the same unhelpful answer as an address that never existed. That sameness is deliberate: if a revoked arrangement failed differently from an imaginary one, somebody could learn which arrangements a school has by trying.
We do not hold the studio’s library, and that is a limit rather than a gap. Where an outside photographer owns the frames, the arrangement points at them. We do not take a copy.
Becoming a second copy of somebody else’s library would solve a convenience problem by creating the exact problem we are trying to remove.
Who can create one, and who cannot
An adult member of staff in a role that allows it. A district administrator, a school administrator, an adviser, a co-adviser, an editor-in-chief — where those people are adults.
A minor holding any of those roles cannot, and that check runs before the role is even looked at. It is not an adviser setting, it is not adjustable per student, and it does not depend on how much responsibility a particular seventeen-year-old has earned.
Advisers usually recognise this as the rule they already apply informally. The difference is that it no longer relies on the adviser being in the room. A student editor working alone at eleven at night on a deadline cannot make this decision even by accident, and that is the whole value of putting it in the system rather than in a handbook.
The trade you are actually making
We are not going to tell you this is easier than sending a folder. It is not. Here is the exchange, plainly.
| The question | A folder you sent | An arrangement you can end |
|---|---|---|
| How long does it take on a Saturday? | Two minutes | Longer, and it needs an adult to do it |
| Can you end it in March? | No -- the copy already exists | Yes, and it stops working at the next attempt |
| Does a family's withdrawal reach it? | Only if somebody remembers and asks | Yes -- permissions are consulted at each use |
| Can you say who has what, a year later? | No | Yes -- the arrangements are a list you hold |
| What if it is forwarded? | It works, and nobody finds out | There is no forwardable file |
Four of the five go one way. The first goes the other, and it is the one that decides whether a school actually uses the mechanism. We would rather that trade be visible than discovered.
How a photograph reaches the right student
A permission-checked lookup against your own roster: a name and an id. Your staff already know who was in the room, so the interesting alternative — sorting by recognising faces — would answer a question the roster has answered, and pay for it with a stored biometric template for every teenager in the building.
That capability exists in the wider platform. It is off unless a parent switches it on for their own student, it is never bundled into a publication permission, and where it is on the template is a set of numbers derived from a photograph rather than a saved picture of a face. It stays inside the private cloud we run ourselves and is never sent to an outside service. Withdrawal stops the matching at the point of asking.
The part we have not finished, in the same type as everything else. Destroying a stored template at the end of its retention window is not something we can demonstrate from one end to the other. So we will not tell you it happens nightly, on withdrawal, or at the end of the window.
How it is built to fail is what we can tell you: the cleanup stops and raises a standing alarm rather than marking a template gone when it cannot actually destroy it, and that alarm stays where a school can see it. When the whole chain can be shown, this will say so.
The questions this raises
Why not just send the files?
Because a file that has been sent cannot be recalled, cannot be counted, and cannot be re-checked against a permission that changed afterwards. Every real problem a school has with imagery outside its walls is a copy that outlived the agreement it was made under. Access that is re-checked on use has none of those properties, which is the entire argument.
What happens if a family withdraws after we gave a studio access?
The next request for that student stops working. The check is done at the moment somebody asks rather than at the moment the access was created, so a withdrawal does not depend on anybody remembering which arrangements exist or going to edit them.
Can a student editor create one of these?
No. That is the single clearest line in this band: the operations that send imagery outside the school are closed to a minor holding a staff-like role, and the check runs before the role's own permissions are considered. It is not a matter of how much you trust a particular seventeen-year-old.
What does an outside party actually get?
A way in that is theirs, that we can withdraw, and that is verified again every single time. Where the arrangement has ended, been withdrawn, or the destination has stopped being somewhere we will send anybody, the attempt produces the same unhelpful answer as an address that never existed -- deliberately the same, so that nobody can learn anything from the difference.
Do you host the studio's pictures?
No, and that is a deliberate limit rather than a gap. Where an outside photographer holds the frames, we point at them under an arrangement we can revoke. We do not become a second copy of somebody else's library, because a second copy is exactly the thing that outlives agreements.
What have you not finished?
One thing, and it belongs here rather than in a footnote. Where a parent has switched face matching on, the system stores a template -- a set of numbers derived from a photograph, not a saved picture of a face. Destroying that template at the end of its retention window is not something we can demonstrate from one end to the other. The cleanup stops and raises a standing alarm rather than marking a template gone when it cannot actually destroy it. When the whole chain can be shown, this will say so.