A synthetic likeness changes the scale and nature of use.
A conventional license may authorize distribution of a finite set of approved images. Training or configuring an AI system can enable new outputs that were never individually captured, selected, or reviewed. Those outputs may be generated repeatedly, combined with new messages, or used long after the original campaign.
That difference affects control, compensation, reputational risk, privacy, security, and the ability to understand where a person's identity appears. Treating old language as blanket AI consent hides those changes from the person who bears them.
Separate consent should be specific and affirmative.
A responsible permission identifies the source assets, biometric or performance data, intended model or provider, purpose, allowed outputs, audience, territory, term, review process, prohibited contexts, compensation, retention, security, and whether the permission may be revoked or expires. It should be understandable without requiring the participant to infer technical consequences.
Refusal should not be converted into consent by a default setting. Participating in a photo session, portfolio, representation agreement, rights registry, or founding pilot is not AI permission.
Custody and output review matter as much as the checkbox.
A permission record is inadequate if source media can be copied without control or if the provider can retain data beyond the approved purpose. The workflow needs private storage, least-privilege access, provider restrictions, deletion or return rules, audit events, incident response, and evidence of what data actually moved.
Participants should be able to review the intended outputs and contexts before public use, with a path to reject or correct unauthorized results. High-risk categories and sensitive creators require a separate specialist environment, not a flag hidden inside an ordinary campaign.
The founding build fails closed.
Image Rights Vault does not train or deploy an AI likeness in the founding software. A disabled permission registry can help define future requirements, but it is not evidence that a provider, security model, consent form, or use has been approved.
Any later controlled test requires separate legal, consent, custody, security, compensation, provider, and participant-approval gates. The system should refuse the workflow when the AI feature flag or any required permission is missing.