What proof should a referrer have before bringing a data owner?

Before bringing a data owner to a prospective adviser or buyer, a referrer should have evidence that a relevant company decision-maker is willing to be introduced, understands the general purpose, and has approved the information being shared. The referrer does not need raw records to establish that an initial conversation may be useful.

The purpose is to avoid presenting a casual mention as an authorized lead. A self-reported opportunity still needs owner confirmation; a referral is not technical verification, rights clearance or proof of buyer fit.

Ask the contact to confirm the minimum facts in writing or in a company-approved channel. Capture the date and source of the answer. If the person says “we have years of records,” do not translate that into an exact date range, retention guarantee or sample count. If they say “we control it,” record it as reported until the relevant contracts and contributors are reviewed.

What evidence shows the owner wants a named introduction?

Ask whether the person is authorized to discuss a potential company data opportunity and whether they consent to an introduction to a specific recipient. Confirm the company entity, role and preferred contact path. A job title alone does not prove the person's authority over every system or contract.

At this stage, collect only high-level facts that are needed to route the conversation: broad data category, likely source systems, approximate period if known, and the decision the company wants to make. Mark each item as reported until the company or supporting evidence confirms it. Do not ask for customer names, screenshots, exports, credentials, sample rows or other raw data as referral proof.

Check what may already be in motion

Ask whether the company is already speaking with a buyer, provider, adviser or another referrer about the same or related scope. Record only what the company authorizes you to know. If an existing discussion is active, pause duplicate contact until the company specifies what it wants to happen. Do not infer that a referral has priority over an earlier relationship.

An existing contact list should remain private and limited to the people who need it. A general network list is not proof of consent to be contacted about a licensing opportunity.

Which source claims can a referrer honestly confirm?

A referrer can report that a company appears to hold an archive or that a manager is interested. That does not establish who owns the records, whether customer or employee material is included, whether the company can grant a license, or whether the data support a target task. Those questions require separate review by responsible parties.

What belongs in a referral evidence card?

Keep a concise record of:

• Company entity and willing contact, confirmed by the company
• Person's role and any known authority limits
• Approved recipient and purpose of the introduction
• High-level source category, marked reported or confirmed
• Approximate scope and known gaps, if owner-approved
• Existing buyer/adviser discussions, if disclosed by the company
• Information explicitly not authorized for sharing
• Date, source of each statement and next permission needed

Do not attach raw material. If the next party needs more detail, ask the owner whether a schema, aggregate or controlled sample is appropriate and arrange a separate permission check.

A hypothetical example

Suppose a referrer knows a manager at a fictional logistics firm. The manager confirms that the firm may explore whether a completed maintenance archive is suitable for licensing and approves a named introduction. The referrer records the source category as reported and says no records or rights have been reviewed. That is an honest referral. It does not claim the firm owns every record or that a buyer will accept it.

When should a referrer stop or pause?

Pause if the contact will not approve the introduction, cannot identify the company entity, asks the referrer to conceal the recipient, or wants raw records sent before scope and permission are established. Also pause if the company says another party is already handling the same opportunity and has not authorized additional outreach.

NIST's AI RMF Playbook encourages organizations to make roles and responsibilities clear in AI risk governance. Its suggestions are voluntary and do not validate a referral or create an authorization. Keep company confirmation and written scope as the evidence for the introduction itself.

Avelence's partnership and advisory model requires scope-specific authority. A referrer should bring a willing, permission-cleared contact and a transparent account of what is known, not a data dump or an unsupported claim of control.

Frequently asked questions

Should a referrer ask for sample records to prove the opportunity?

No raw sample is needed for an initial referral. Confirm willingness and recipient-specific permission, then record the high-level archive description as reported or confirmed. A later technical reviewer can request an appropriately authorized sample for a defined question; the referrer should not collect sensitive files simply to strengthen a lead.

What if the contact cannot confirm the exact retained period?

Record the estimate with its source and date, and identify who could check retention later. Do not convert “years of records” into a precise range or guarantee. A useful referral can carry an explicit uncertainty while leaving the recipient to decide whether a scoped inquiry is worthwhile.