ORCID’s permission model separates what an organization may do from what a reader may see. Its trusted-organization guidance explains that an authorized organization can add information and update information it supplied, but cannot rewrite items added by the researcher or another trusted source. Revoking permission stops further additions and updates under that authorization; it is not a promise that all previously supplied items vanish.
The separate visibility guidance describes settings for everyone, trusted parties and private information. An organization can still see information it added, and a trusted individual is a different kind of delegate from a trusted organization. These distinctions make a simple public-versus-private label inadequate for describing every access situation.
Missing is not the same as absent
An institutional report built from public records should not automatically interpret a missing item as proof that the researcher has no such activity. The report may simply be observing a limited view. That is a logical limit of the dataset, not a claim that any particular hidden item exists.
A useful import could record the access context alongside the date and source of the retrieval. It could then distinguish an observed public field from an institutional assertion or an item the system was not permitted to read. This proposed design would make later interpretation more cautious without collecting additional private information merely to fill a report.
Authorization is not an editing shortcut
Suppose a department notices an incorrect affiliation in a hypothetical researcher profile. The first question should be who supplied that item and which correction route is appropriate. Having some permission to interact with the record does not imply permission to alter every assertion in it. A local correction ticket can preserve the disputed value, the responsible source and the requested change without inventing broader access.
For administrators, the operational aim is a report that explains what it knows and how it knows it. A green indicator, a successful sign-in or a public profile should not be stretched into a claim of unrestricted access. Clear provenance and narrow permissions can coexist with useful reporting, provided the institution resists turning an incomplete view into a definitive account of a person’s work.