An owner-approved company introduction is a specific authorization to connect a company with a named recipient for a defined purpose, using only the information the company approved. It should record who authorized it, what may be said, and what the recipient may do next.
An introduction is not the same as a data license, an NDA, authority to negotiate or permission to send a sample. Treat those as separate decisions and record them separately.
What must company-introduction approval actually say?
An authorization record should name the company entity, person approving, recipient, purpose, permitted description and any expiration. It should say whether the recipient may contact the company directly and whether another adviser or partner may participate. If the company approves only a general profile, do not identify it until the next permission is obtained.
| Approval recorded | What it allows within scope | What still needs a separate decision |
|---|---|---|
| Company name and named adviser | A specific introduction | Buyer contact, sample access or negotiation |
| Schema shared with named recipient | Review of stated fields for stated purpose | Use of underlying records or a different recipient |
| Controlled sample review | Access under its agreed environment and period | Broader retention, training or onward transfer |
These are examples of authorization layers, not prescribed legal categories. The company should describe the actual instruction in its own words and seek advice if it is unsure who may approve it.
Be clear about what is excluded: customer examples, company records, pricing expectations, confidential terms, or claims that have not been verified. Permission to share one fact does not imply permission to share a related document.
An NDA is not the same thing
A confidentiality agreement can limit how a recipient uses or shares information it receives. By itself, it does not prove that the sender is authorized to disclose the information, that the company owns every included right, or that data may be used for a particular purpose. Check both the authority to disclose and the recipient's obligations.
Likewise, the fact that a person works for the company does not answer whether they can approve an introduction on behalf of the relevant entity. The company should identify the right decision-maker and any internal approvals needed.
Which disclosure stages need separate decisions?
Use distinct stages:
- Non-identifying description of a potential source
- Company name shared with one approved recipient
- Structured description or schema shared for a defined purpose
- Controlled sample review under separate permission
- Broader access or a license under a written agreement
Each stage can expose more information and should have a separate check. An owner may authorize an introduction and still decide not to proceed with a sample or license. A recipient change or different purpose requires a fresh review.
How should the approved introduction be recorded?
Record the exact statement shared, its version, recipient and timestamp. Note whether it came from the owner, a public source or an intermediary and whether it was verified. The W3C PROV model distinguishes entities, activities and agents, which can help structure a record. The model does not create legal authorization or settle authority questions.
The NIST AI RMF Playbook suggests clear governance roles and responsibilities for AI risk work. Its recommendations are voluntary and do not determine corporate authority for an introduction. Use it as a general prompt to assign responsibility, not as a legal rule.
Example: limited company-profile disclosure
Imagine a fictional owner approves sharing its company name, broad sector and a one-sentence description of an archive with a specific adviser. The owner has not approved a sample, customer names, a direct buyer approach, or statements about ownership. The adviser can make only the approved introduction and must return to the owner for any expanded disclosure.
The example is hypothetical. It illustrates that authorization can be narrow and staged; it does not define a universal legal form.
A concise approval check
Before sharing, ask:
- Who approved this disclosure, and for which company entity?
- Which recipient and purpose are authorized?
- What exact words, facts or files may be shared?
- Is direct contact allowed, and who handles it?
- Does the recipient have confidentiality and use restrictions?
- When does approval expire or need renewal?
- What further approval is needed for a sample, negotiation or license?
If any answer is uncertain, pause and ask the company. It is easier to expand a clearly documented permission than to unwind an overbroad disclosure.
Avelence's model allows specified written mandates for leading discussions, working alongside a company, or identifying opportunities it closes. Those options do not override the separate recipient-specific checks for identity disclosure, data access or handoff.
Frequently asked questions
Can a recipient forward an approved company profile to a colleague?
Do not assume it is covered. Check whether the company’s instruction names an individual, a defined team or an entity, and what onward sharing is permitted. If the new recipient or purpose falls outside that scope, return for authorization before forwarding identifying detail.
Is a verbal willingness to meet enough to circulate a profile?
It may support arranging the particular conversation the company understood, but it should not be interpreted as blanket circulation permission. Confirm the receiving party, purpose and exact information in a company-approved record. When those details remain unclear, use a non-identifying description or pause rather than infer broader consent.
About the author
Yananai A. Chiwuta
Yananai A. Chiwuta is the Founder of Avelence. His work covers data-owner relationships, enterprise buyer research, and the commercial decisions behind operational-data licensing.
