# A Policy Profile for Croissant: Refusal as a Property of the Dataset

arXiv: https://arxiv.org/abs/2609.19640 · HTML: https://mlsanity.com/paper/2609.19640/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 5 of its 39 references that are in the map.
- First posted on arXiv 17 Sep 2026.

## Builds on (most cited first, 5 of 5)

- [Croissant: A Metadata Format for ML-Ready Datasets](https://mlsanity.com/paper/2403.19546/) (2024)
- [Packaging research artefacts with RO-Crate](https://mlsanity.com/paper/2108.06503/) (2021)
- [Recording provenance of workflow runs with RO-Crate](https://mlsanity.com/paper/2312.07852/) (2023)
- [A Standardized Machine-readable Dataset Documentation Format for Responsible AI](https://mlsanity.com/paper/2407.16883/) (2024)
- [Open Digital Rights Enforcement Framework (ODRE): from descriptive to enforceable policies](https://mlsanity.com/paper/2409.17602/) (2024)

## Abstract (arXiv)

Croissant is the de facto machine-readable descriptor for ML datasets: JSON-LD over schema.org. Since version 1.1 it also carries data use conditions, recommending DUO and ODRL for them. What no version specifies is how any of them is evaluated: no decision procedure, no bound on evaluation cost, no outcome for a condition an implementation cannot evaluate, no record of what was checked, and nothing on composition with caller-side authority. We supply that half. An additive profile lets a dataset declare the operations it admits and the conditions under which it admits them, over a closed set of five operators whose decision procedure is given in full, so a gate decides from the descriptor alone and records what it checked. Two corpora evaluate it and their evidence is kept apart. Three descriptors that gated a real nf-core pipeline give the deployment result: decisions from a profile document match the gate's native descriptor record for record, stripping the layer leaves a valid Croissant document, and the added cost is 11.7 μs against a 119 μs decision. A corpus generated from the profile's grammar gives the breadth, covering every operator, refusal class and conformance clause. Across its valid cases, 552 complete decision records agree three ways -- native descriptor, profile terms, and the same policy as ODRL in usageInfo. The carrier is therefore not the contribution; the evaluation semantics is. Finally, caller-bound and data-bound policies range over non-overlapping state spaces, so neither permit set contains the other.