Skip to content
GREEN FUTURETECH.
Explore

Research libraryTraceable by Design

Chapter 11 of 14 · Part III · Draft web edition

Traceability must fit real work and protect the people recorded

A system survives only if responsibilities, exceptions, privacy and constrained connectivity are part of ordinary work.

Sections
6
Exhibits
5
Minutes
27
Sources
26
EX 46 · Irreversible model downgrade: Operational frequency in shift work 2, Required independence of review 9. Quadrant: Independent gate

The cloth is woven from this chapter's 5 exhibits: each weft is one exhibit's own data, normalised; each warp group is a section. The probe reads the exhibit's own value where it crosses. Procedural visualisation, not a measurement.

The chapter as a draft: 6 sections, 4 exhibit wefts, one shuttle.

Lead exhibit · 46Decision mapillustrativeResponsibility should follow each custody decision
Independent gateDual-control shift gateStandardised self-checkAutomated validationOperational frequency in shift work →Required independence of review →Bale and roll receipt…Batch transformation…Missing-link quaranti…Subcontractor dispatc…Irreversible model do…Volume reconciliation…Final passport claim…

Read-outBale and roll receipt check: Operational frequency in shift work 8.5, Required independence of review 4. Quadrant: Automated validation

Method and source

Illustrative GFT role design derived from custody and due-diligence responsibilities in S03, S06 and S17. Coordinates are categorical design placements to separate routine capture from independent release review, not empirical measurements.

Unit: illustrative governance index (0 to 10). Status: illustrative. Sources: S03, S06, S17. Illustrative figures are teaching examples, not measured factory results.

The chapter's warpBar: share of the reading · square: an exhibit

Section 11.0 · Opening · 1 min · no exhibit of its own · one movement Go to section ↓

Overture · 1 min

A digital product passport fails on the factory floor long before it fails in a browser if the people who weigh bales, join fabric rolls, approve rework and inspect incoming certificates lack authority or time to record what happened.[S03] Traceability governance works only when every material observation has an accountable role, capture occurs at the point of work, outages place claims into a visible pending state, personal data collection stays restricted to a lawful purpose, and workers or producers have safe routes to challenge errors and report harm.[S10][S19][S1101] Green Future Tech Limited (GFT), Hong Kong SAR, specifies this operating discipline as a proposed extension to its three-part Cameroon textile programme, prepared on 31 January 2024 with source refreshes retained in 2026 (feasibility study, performance-management system design and digital strategy).[R06] None of the roles, exception workflows, privacy registers or training drills here is presented as a running factory deployment or audited compliance result; each is an engineering design to test in a bounded pilot before releasing any commercial origin claim.[S01][S02]

11.14 min · 2 sub-steps · 1 exhibit

Every material observation needs an accountable role

Related · chapter 029 paragraphs step it

Related exhibit 06 · chapter 02Decision mapillustrativeCustody models permit different claim strengths
Material mixing accommodated by the model →Separation of attribute from physical batch →Identity preservationSegregationControlled blendingMass balanceBook-and-claim

Read-outIdentity preservation: Material mixing accommodated by the model 0, Separation of attribute from physical batch 0

Method and source

Illustrative GFT classification based on the opened custody guidance and scheme pages. X categories: 0 = one declared source, 1 = mixing within an eligible class, 2 = mixing with other material permitted by the model. Y categories: 0 = attribute tied to the physical batch, 1 = attribute allocated by quantity, 2 = attribute instrument transferred separately. Positions are not measured scores or scheme equivalence findings.

Unit: categorical position, not a performance score. Status: illustrative. Sources: S01, S02, S03, S07, S0202. Illustrative figures are teaching examples, not measured factory results.

Read this exhibit in its chapter ↗
11.1 · Introduction · paragraph 1 of 9

Chain-of-custody standards require documented responsibilities across receiving, storage, processing, subcontracting, volume reconciliation and claim release.[S03][S06] Many traceability projects configure software as if one administrator enters and approves every transaction. On a real spinning, weaving, dyeing or garment floor, custody moves across teams whose incentives diverge when a delivery arrives without paperwork, a roll split loses its ticket or a shipment faces a dispatch deadline.[S06][S10] If the person measured on shift throughput also holds unrestricted authority to override a missing input link or release a product claim, records will bend toward shipping targets rather than evidential accuracy.[S02][S03]

11.2 Separation of duties prevents silent claim overrides

To prevent unverified material from entering an eligible pool by default, GFT separates operational observation from exception resolution and claim release.[S03][S06] Under the Content Claim Standard (CCS) published by Textile Exchange and Version 1.0 of the Aid by Trade Foundation (AbTF) Transparency Standard dated June 2025, a site must verify transport and transaction documents at receipt, maintain physical or temporal separation where required, reconcile volumes, and prevent double claiming.[S03][S06] Translating those rules into daily work requires six functional roles, even where a smaller facility combines several operational duties under shared supervision during early ramp-up.[S06][S17]

  • Receiving and warehouse custody officer: inspects bale or roll identifiers against delivery notes, records gross and tare weight on an identified scale, assigns a quarantine bay when paperwork is incomplete, and logs the receipt.[S03][S06]
  • Production line team leader: records batch transformations at bale laydown, spinning, knitting or weaving, dyeing, cutting lays and sewing bundles, linking consumed inputs to output lots and logging rework or waste.[S06][S10]
  • Quality and assurance reviewer: checks scope certificates, transaction certificates, laboratory reports and subcontractor eligibility before lifting a hold or approving a downgrade from physical segregation to mass balance.[S03][S06]
  • Purchasing and counterparty coordinator: maintains supplier scope registers, issues procurement schedules carrying custody terms, and confirms counterparty transactions in external scheme portals.[S06][S09]
  • Data steward and system custodian: manages identifier namespaces, offline queue synchronisation, schema validation, access permissions and backup exports without altering shop-floor observations.[S10][S26][S27]
  • Authorised claim-release officer: verifies before shipment that genealogy links are unbroken, volume reconciliation residuals sit within declared limits, and the passport statement matches the narrowest admissible input status.[S02][S03]

Where pilot staffing does not allow six individuals on every shift, GFT sets a minimum two-person rule for high-risk custody decisions: the person recording a receipt or transformation cannot approve an exception override, execute an irreversible downgrade under Section 7.2 of the June 2025 AbTF standard, or authorise claim release.[S06] Role assignments follow zero-trust access principles: subject and device authentication are checked before any session writes or approves a custody event, regardless of network location.[S26]

Exhibit 46 places these illustrative custody tasks across two dimensions: operational frequency during shift work and the independence of review required before supporting an external claim.[S03][S06][S17]

As Exhibit 46 shows, high-frequency events such as batch transformation logging and receipt checks sit in the lower-right region where standardised operator capture and format validation keep work moving.[S03][S10] Actions that alter claim admissibility, including subcontractor dispatch approvals, volume reconciliation sign-offs, irreversible downgrades from Hard Identity Preserved (HIP) or Segregation to mass balance, and final passport release, sit in the upper quadrants where independent review or dual control is mandatory.[S06] This chart is a governance design rather than a measured scorecard; it cannot establish that a facility has enough staff for each gate without pilot verification.[S03]

11.3 Exception review joins the existing shift and weekly cadence

A traceability system fails when exceptions wait for a quarterly audit, because physical lots have already been blended, cut, sewn and shipped before a discrepancy is noticed.[S03][S10] In GFT's Cameroon textile programme, the performance-management design sets a tiered review rhythm across shift handovers, daily production reviews, weekly plant reconciliations and monthly governance (covered in wp02 and the kpi-cascade tool).[R06] GFT proposes embedding custody exception review into that cadence rather than creating parallel meetings.[S03][S06]

At shift handover, the line leader and receiving officer review unclosed batches, quarantined receipts and damaged bale labels from the shift.[S06][S10] At the daily operational meeting, the quality reviewer and purchasing coordinator inspect shipments or cutting lays held for missing counterparty confirmation or subcontractor scope, assigning an owner to obtain the document or downgrade the batch claim.[S06][S09] At the weekly plant review, the data steward and claim-release officer reconcile physical stock against the eligible claims ledger before approving outbound passport disclosures.[S03][S06] Connecting traceability to the management cadence is a proposed extension; GFT has not operated this cadence in a live Cameroon mill.[R06]

11.44 min · 2 sub-steps · 1 exhibit

Capture should happen at the point of work

Step 1 of 7Point-of-work: routine capture (92 events)

Exhibit 47 · illustrativePoint-of-work capture takes less time than late clerical reconstruction

Point-of-work: routine capture (92 events)41.4Point-of-work: minor label fixes (6 events)27Point-of-work: quarantine holds (2 events)36Point-of-work: shift reconciliation share15Retrospective: Friday transcription (92 events)78.2Retrospective: cold discrepancy chase (8 events)176Retrospective: manual ledger rebuild30
Point-of-work: routi…41.4Point-of-work: minor…27Point-of-work: quara…36Point-of-work: shift…15Retrospective: Frida…78.2Retrospective: cold…176Retrospective: manua…30

Point-of-work: routine capture (92 events)

Point-of-work: routine capture (92 events): 41.4 illustrative minutes per 100 custody events · illustrative

Retrospective reconstruction, where clerks type Monday’s paper tally sheets into a spreadsheet on Friday afternoon, introduces transcription errors, loses the sequence of roll splits and encourages silent averaging of waste.

Point-of-work: minor label fixes (6 events)

Point-of-work: minor label fixes (6 events): 27 illustrative minutes per 100 custody events · illustrative

Point-of-work: quarantine holds (2 events)

Point-of-work: quarantine holds (2 events): 36 illustrative minutes per 100 custody events · illustrative

Point-of-work: shift reconciliation share

Point-of-work: shift reconciliation share: 15 illustrative minutes per 100 custody events · illustrative

Retrospective: Friday transcription (92 events)

Retrospective: Friday transcription (92 events): 78.2 illustrative minutes per 100 custody events · illustrative

Retrospective: cold discrepancy chase (8 events)

Retrospective: cold discrepancy chase (8 events): 176 illustrative minutes per 100 custody events · illustrative

Retrospective: manual ledger rebuild

Retrospective: manual ledger rebuild: 30 illustrative minutes per 100 custody events · illustrative

The method behind it: Worked example: Shift-level capture and exception-reconciliation time budget.

Method and source · Exhibit 47

Illustrative GFT workload model from the chapter case study: 92 routine events and 8 exceptions per 100 shift events. Values are assumed planning inputs to be replaced by timed pilot observations; they are not measured GFT operating results.

Unit: illustrative minutes per 100 custody events. Status: illustrative. Sources: S03, S10, R16. Illustrative figures are teaching examples, not measured factory results.

11.4 · the bodyExhibit 47 above; its figures are illustrative where marked.

Retrospective reconstruction, where clerks type Monday's paper tally sheets into a spreadsheet on Friday afternoon, introduces transcription errors, loses the sequence of roll splits and encourages silent averaging of waste.[S03][S10] Consistent with the data-first discipline of GFT's Cameroon textile programme, custody evidence should be captured at the physical boundary where material changes hands or form, using compact forms with pre-validated identifiers.[R06][S10]

11.5 Counterparty tracking differs from purchase-order administration

11.5

A common error in factory digitalisation is assuming that an enterprise resource planning (ERP) purchase order or invoice suffices as a custody record.[S09][S10] Commercial documents record financial obligations and pricing tiers, which often aggregate deliveries, omit bale or roll identifiers, or pass title through a trader who never takes physical possession.[S01][S10] The Sustainable Cotton Tracker (SCOT) operated for Cotton made in Africa shows why custody tracking and commercial ordering remain distinct: the SCOT FAQ states that the platform is not an order system, and instead requires registered counterparties to record and confirm certified material transactions by supply-chain role.[S09]

¶ 02 · 3 sources

S09S10S01

For shop-floor capture in an African cotton-to-garment chain, GFT separates commercial purchasing from custody confirmation through three interface rules.[S09][S10]

¶ 03 · 2 sources

S09S10

  1. Task-bounded input screens: a receiving terminal displays only fields observable at the dock (carrier reference, supplier identifier, bale or roll code, gross weight, tare code, moisture reading and seal status), without exposing unit prices or margins.[S06][S10][S19]
  2. Controlled identifier selection: operators scan a barcode or select from pre-issued active batch identifiers rather than typing free-text lot names, preventing typographical breaks in the genealogy graph.[S10][S12]
  3. Explicit unknown and hold states: if a delivery arrives with an illegible tag or a frame draws from an unlabelled bin, the operator has a non-punitive button to log an unknown-input exception and print a quarantine ticket, rather than inventing a code to pass a mandatory field.[S01][S10]
List · 5 sources

S06S10S19S12S01

11.6 Operator capture time must be budgeted and measured in a pilot

11.6

Barcode scans, scale confirmations, roll-split tickets and exception holds take physical time on the floor.[S03][S06] If engineers assume operators absorb extra capture steps at zero cost, workers under throughput pressure will batch scans at shift end, bypassing validation.[S10] In Cameroon, where WageIndicator records a standard 40-hour week, a 48-hour legal maximum with overtime at 1.2 times base pay, and a statutory monthly minimum wage (SMIG) raised to XAF 43,969 from 23 February 2024 (about US$76, up 5 percent from XAF 41,875 in 2023), administrative tasks must be budgeted within lawful shift hours.[R14][R16]

¶ 04 · 5 sources

where WageIndicator records a standard 40-hour weekR14, R16

S03S06S10R14R16

Exhibit 47 compares the illustrative minute breakdown per 100 custody events between point-of-work capture and end-of-week clerical reconstruction from the worked example.[S03][S10]

¶ 05 · 2 sources

…the illustrative minute breakdown per 100 custody events between point-of-work capture and end-of-week clerical…S03, S10 · illustrative

Exhibit 47

S03S10

The lesson of Exhibit 47 is structural: even under point-of-work capture, the 8 illustrative exception events require 63.0 minutes (27.0 + 36.0), exceeding the 41.4 minutes spent on all 92 routine scans.[S03][S10] Under retrospective reconstruction, chasing those 8 exceptions after physical lots have moved consumes 176.0 minutes and often ends in a batch downgrade.[S10] Because these durations are illustrative assumptions, GFT requires the Chapter 13 pilot to time live scan, relabelling and hold durations before fixing staffing ratios or unit-cost denominators in Chapter 12.[S03]

¶ 06 · 2 sources

the 8 illustrative exception events require 63.0 minutes (27.0 + 36.0)S03, S10 · illustrative

Exhibit 47

S03S10

11.73 min · 2 sub-steps · 1 exhibit

An outage must not erase the custody sequence

Industrial zones and rural ginning corridors in Central and West Africa face intermittent telecommunications and grid power interruptions (whose electrical and edge-computing engineering is addressed in wp07 and edge-architecture).[S10][S27] When a cloud-only portal drops offline while trucks unload seed cotton or a dye house batches fabric rolls, operators must halt production, skip the digital record, or scribble notes on paper for later entry.[S10] A governance model assuming continuous connectivity will stall the factory or corrupt custody during its first outage.[S10][S27]

11.8 Local queues and pre-issued identifiers keep physical work moving

11.8

GFT specifies an offline-first custody capture discipline to test during the pilot.[S10][S27] Every receiving dock, ginning press, spinning group, dye kitchen and cutting terminal operates against a local edge queue on non-volatile storage with battery backup.[S26][S27] Before a shift starts, the local node caches the supplier scope register, active production order identifiers and a block of pre-issued batch and event identifiers.[S10][S26]

¶ 02 · 3 sources

S10S27S26

When connectivity drops, operators continue scanning bales, logging transformations and printing local batch tickets from the pre-issued pool.[S10] Each observation is signed by the authenticated local device and operator session and appended to an append-only local log.[S23][S26] While disconnected from the central ledger, the local system enforces a strict boundary: it confirms internal observations and moves work-in-progress between workstations, but cannot verify external counterparty status lists, confirm an inbound electronic transaction certificate, or release an outbound passport claim.[S06][S24]

¶ 03 · 5 sources

S10S23S26S06S24

11.9 Event time and recording time preserve the physical sequence

11.9

When connectivity returns and queued records upload, naive databases overwrite the physical operation timestamp with server ingestion time.[S10] If a spinning laydown occurred at 09:15 on Tuesday during an outage, and the yarn shipment was logged from a connected dispatch office at 14:00 before the spinning terminal reconnected at 16:30, server receipt time makes the yarn appear shipped two hours before it was spun.[S10] Automated genealogy checks then reject the shipment or attach it to an unrelated lot.[S10]

¶ 04 · 1 source

If a spinning laydown occurred at 09:15 on Tuesday during an outageS10

S10

GS1 EPCIS Release 2.0 resolves this by separating eventTime (when the physical event occurred, with local time-zone offset) from recordTime (when the event was recorded by the repository).[S10] Combined with GS1 Core Business Vocabulary (CBV) Release 2.0 dispositions and business steps, preserving both timestamps lets the central ledger reconstruct the physical sequence after delayed upload while flagging clock-drift anomalies for steward review.[S10][S11]

¶ 05 · 2 sources

Combined with GS1 Core Business Vocabulary (CBV) Release 2.0 dispositions and business stepsS10, S11

S10S11

Outage queue and temporal reconciliation protocol

To keep offline capture auditable without inventing certainty during a link failure, GFT specifies a five-step protocol grounded in GS1 EPCIS Release 2.0 semantics and NIST SP 800-161 Rev. 1 resilience controls:[S10][S27]

  1. Pre-allocation of namespace blocks: each workstation holds a reserved prefix of event and batch identifiers (site-node-shift-sequence) so offline stations never generate colliding lot numbers.[S10]
  2. Dual-timestamp capture: every queued event records eventTime from a local hardware clock (with UTC offset and sync status), operatorRoleId, deviceId, and offlineCapture: true.[S10][S26]
  3. Outbound claim freeze during partition: any shipment prepared while the central ledger or status list is unreachable receives a pending-reconciliation disposition; goods may move to bonded storage under a provisional bill of lading that withholds public provenance claims.[S10][S11][S24]
  4. Idempotent replay and sequence sorting: upon reconnection, the edge queue transmits stored events using idempotent hashes; the repository orders genealogy by eventTime while retaining recordTime as the upload audit trail.[S10]
  5. Post-outage reconciliation check: before lifting pending-reconciliation, the data steward and claim-release officer verify that no eligible input volume was double-allocated across disconnected terminals and that counterparty certificates were valid at eventTime.[S06][S10][S24]

Exhibit 48 diagrams this sequence from local observation during an outage through queue synchronisation, reconciliation and conditional claim release.[S10][S27]

¶ 01 · 2 sourcesExhibit 48

S10S27

Exhibit 48FlowillustrativeAn outage creates pending records rather than invented certainty
Observe physicalstepLog eventTime inlocal queueHold outboundclaim releaseSynchroniseidempotenteventsReconcilesequence andstockRelease verifiedclaim ordowngrade

Read-outObserve physical step. Starting point. Leads to Log eventTime in local queue (link down).

Method and source

Illustrative GFT offline-to-online control flow based on S10 event-time semantics, S06 double-claim prohibitions, S24 status verification and S27 resilience practices. No outage duration or network uptime percentage is assumed.

Unit: . Status: illustrative. Sources: S06, S10, S24, S27. Illustrative figures are teaching examples, not measured factory results.

As Exhibit 48 shows, a power or network outage never forces an operator to choose between halting a spinning frame and fabricating a timestamp.[S10] Production continues against local identifiers, while external claim release pauses until eventTime ordering, volume balances and certificate status checks are reconciled.[S06][S10][S24] What Exhibit 48 cannot guarantee is hardware survival during prolonged power loss without the backup power and surge protection specified in wp07.[S27]

¶ 01 · 4 sourcesExhibit 48

S10S06S24S27

11.102 min · 2 sub-steps · 1 exhibit

Privacy starts with deciding which data are necessary

Traceability programmes often over-collect personal information under the false belief that publishing a farmer's name, national identity number, household GPS polygon or a sewing operator's payroll record makes a product passport more credible.[S19][S28] Indiscriminate collection exposes smallholders and workers to privacy breaches and commercial poaching while creating legal liabilities for every entity storing or transferring the data.[S19][S1102]

11.11 Data minimisation separates product evidence from personal identity

11.11

The European Data Protection Board (EDPB) guide for small businesses states the rule of data minimisation: an organisation can process only personal data that are necessary and proportionate for the specific purpose envisaged.[S19] When a brand or buyer verifies whether cotton shirts meet an origin or certified-content claim, it needs admissible evidence of custody, ginning campaign linkage, certification scope and volume reconciliation.[S03][S06][S28] Neither a consumer scanning a QR code nor a sourcing team inspecting a shipment pack needs the personal names, phone numbers, biometrics or home coordinates of farmers or sewing workers.[S19][S28]

¶ 02 · 4 sources

S19S03S06S28

In northern Cameroon, where inherited evidence record R03 notes that SODECOTON supports more than 220,000 cotton producers across nine ginning plants and two oil mills, production involves hundreds of thousands of households in producer groups.[R03] Recording deliveries at the ginnery requires a link to a producer group or pseudonymous member code so payment, agronomy support and scheme eligibility can be audited by certification bodies.[S06][S19] Publishing those personal records in a downstream feed or public passport violates purpose limitation and creates an irreversible privacy exposure.[S19][S28]

¶ 03 · 4 sources

…that SODECOTON supports more than 220,000 cotton producers across nine ginning plants and two…R03

R03S06S19S28

11.12 Applicable data-protection law requires local and cross-border legal review

11.12

Traceability systems spanning Cameroon production, Hong Kong SAR engineering and global export markets cross multiple legal regimes.[S19][S1102] Under the EU General Data Protection Regulation (GDPR), territorial scope is conditional on establishment or targeting/monitoring in the Union.[S19] Simultaneously, domestic African laws govern processing at the source.[S1102] In Cameroon, practitioner commentary published by LEX Africa on 31 October 2025 highlights Law No. 2024/017 of 23 December 2024 on personal data protection, covering collection, recording, storage, retrieval, transmission, alignment, erasure or transfer of personal data, and requiring consent, compliance protocols and prior authorisation from the Data Protection Authority where applicable (noting an alignment window to 23 June 2026).[S1102]

¶ 04 · 2 sources

…published by LEX Africa on 31 October 2025 highlights Law No. 2024/017 of 23…S1102

S19S1102

Because GFT does not provide legal advice and statutes require review by local counsel (see wp17), GFT designs the data model around data minimisation and segregated storage.[S19][S1102] Personal identifiers of producers and workers stay in restricted local cooperative or HR registries in Cameroon; the custody ledger and product passport receive only pseudonymous group, shift or workstation codes, role titles and institutional certificate references.[S19][S26][S28]

¶ 05 · 4 sources

S19S1102S26S28

Exhibit 49 sets out GFT's illustrative privacy-by-purpose register across five data categories in a cotton-to-garment chain.[S19][S28][S1102]

¶ 06 · 3 sourcesExhibit 49

S19S28S1102

Exhibit 49RegisterillustrativeData purpose determines access and retention
Data category
Smallholder producer identity
Lawful operational purpose
Cooperative payment, input credit and scheme audit
Custody ledger representation
Pseudonymous producer-group and delivery-lot code only
Public passport disclosure
Country or region of origin and scheme status only
Access and retention rule
Local cooperative registry only; delete or archive per local law

Read-outData category: Smallholder producer identity. Lawful operational purpose: Cooperative payment, input credit and scheme audit. Custody ledger representation: Pseudonymous producer-group and delivery-lot code only. Public passport disclosure: Country or region of origin and scheme status only. Access and retention rule: Local cooperative registry only; delete or archive per local law

Open the full register (5 rows)
Smallholder producer identityCooperative payment, input credit and scheme auditPseudonymous producer-group and delivery-lot code onlyCountry or region of origin and scheme status onlyLocal cooperative registry only; delete or archive per local law
Farm plot locationAgronomy support and deforestation or scheme verificationGinning catchment zone and bounded regional codeCountry or sub-national region name; no household coordinatesRestricted to accredited auditors; no cross-border export by default
Factory operator and clerk logsShift accountability, separation of duties and error reviewPseudonymous role-holder token and workstation identifierNever disclosed; facility name and process step onlyInternal plant quality and HR access; purge token link after audit window
Quality and release approversVerify authority for custody holds, downgrades and releaseRole title, institutional certificate ref and key identifierIssuing organisation name and conformity scope onlyRetain institutional sign-off for product-claim validity period
Worker grievance and remedy filingsInvestigate and remediate adverse labour or safety impactsExcluded from product custody ledger; separate case refNever disclosed on product records; aggregate reporting onlyStrictly confidential; managed by designated remediation channel
Method and source

Illustrative GFT privacy-by-purpose schedule grounded in S19 data-minimisation principles, S26 role-based access, S28 passport tiers and S1102 Cameroon data-protection scope. Retention rules are conditional on legal counsel review; no universal statutory period is asserted.

Unit: qualitative governance register. Status: illustrative. Sources: S19, S26, S28, S1102. Illustrative figures are teaching examples, not measured factory results.

The rule in Exhibit 49 is that the custody ledger never acts as a personnel file.[S19][S28] When a buyer or auditor inspects a garment batch, they see that receiving check RCV-2026-0412 was logged by Role: Receiving-Dock-A and released by Role: QA-Reviewer-02 under an active scope certificate.[S03][S26] If an accredited auditor on site needs to verify that QA-Reviewer-02 completed required AbTF training, the plant's internal register resolves that token locally without exporting employee files into cloud passports.[S06][S19][S1102]

¶ 01 · 6 sources

QA-Reviewer-02 under an active scope certificateS03, S26

Exhibit 49

S19S28S03S26S06S1102

11.133 min · 2 sub-steps · read with a related exhibit

Due diligence must include routes for challenge and remedy

Related · chapter 058 paragraphs step it

Related exhibit 21 · chapter 05FlowillustrativeA split and a conversion are different events
Lint bale laydown (inputEPCList)Spinning TransformationEventIdentified yarn cones (outputEPCList)Pallet AggregationEvent (ADD/DELETE)Knitting TransformationEventGreige fabric roll (parent ID)Subcontracted dye TransformationEventRoll-split TransformationEvent (child IDs)

Read-outLint bale laydown (inputEPCList). Starting point. Leads to Spinning TransformationEvent (consume bales).

Method and source

Illustrative event sequence distinguishing irreversible material conversion (EPCIS TransformationEvent), reversible logistics grouping (AggregationEvent) and roll splitting or subcontracted wet finishing. Normative event semantics follow GS1 EPCIS 2.0 (S10); credential-wrapped event mapping follows the pre-production UNTP Digital Traceability Events specification (S30).

Unit: . Status: illustrative. Sources: S10, S30. Illustrative figures are teaching examples, not measured factory results.

Read this exhibit in its chapter ↗
11.13 · Introduction · paragraph 1 of 8

A digital map of supplier tiers and bale lot numbers is an input to supply-chain management, not proof that people growing cotton or sewing garments work under fair, safe and voluntary conditions.[S17][S20] Conflating traceability with labour assurance creates two hazards: buyers may treat an EPCIS event graph as a substitute for workplace due diligence, or designers may attach unverified labour-risk scores to supplier nodes without giving workers or producers a safe route to contest errors or obtain remedy.[S17][S20][S1101]

11.14 Supplier mapping cannot prove decent work or absence of coercion

The International Labour Organization (ILO) defines forced labour as work or service exacted from any person under the threat of a penalty and for which the person has not offered themselves voluntarily, covering all work in any activity, industry or sector, including the informal economy.[S20] In Cameroon, where inherited record R16 notes an informal employment share of about 90 percent, labour due diligence requires ongoing attention to recruitment, wages, working hours, overtime consent and subcontracting.[R16][S20] A barcode scan confirming that a bale moved to a spinning mill, or that panels were sewn on Line 3, records where material moved and when; it provides zero observation of whether wages were paid, overtime was voluntary, or freedom of association was respected.[S10][S20]

Similarly, the OECD Due Diligence Guidance for Responsible Supply Chains in the Garment and Footwear Sector emphasises practical, collaborative approaches to identifying, preventing, mitigating and accounting for how enterprises address adverse impacts.[S17] Traceability records identify which facilities, subcontractors and ginning corridors participate in a chain so risk assessments can be targeted.[S17] Once mapped, due diligence requires workplace assessment, corrective action plans, purchasing practices that do not induce unauthorised subcontracting or excessive overtime, and verified remediation.[S17][S1101]

11.15 Operational grievance channels must be accessible, safe and distinct from custody tickets

Under Principle 29 of the United Nations Guiding Principles on Business and Human Rights (UNGPs) published by the Office of the United Nations High Commissioner for Human Rights (OHCHR), enterprises should establish or join operational-level grievance mechanisms for adversely impacted individuals and communities so grievances are addressed early and remediated directly.[S1101] Principle 29 and Principle 31 explain that these channels support due diligence by surfacing concerns before harms compound, and must meet effectiveness criteria (legitimacy, accessibility, predictability, equitability, transparency, rights-compatibility, learning and dialogue) without undermining trade unions or judicial recourse.[S1101]

In an operable governance system, GFT separates three complaint pathways so each reaches a competent owner with confidentiality safeguards.[S03][S17][S1101]

  • Pathway 1: Commercial and evidential custody dispute. A supplier, ginnery, warehouse or buyer contests a weight discrepancy, rejected transaction certificate, batch downgrade or error declaration. Owner: Quality reviewer with the data steward. Resolution follows EPCIS error-declaration and reconciliation rules (Chapters 4, 6 and 8), retaining original and corrected records.[S03][S10]
  • Pathway 2: Product quality or composition nonconformity. A cell, laboratory or customer identifies off-specification yarn, shade variation, fabric defects or wrong composition labels. Owner: Quality engineering and production management. Resolution follows quarantine, rework and corrective-action rules (linked to wp02 and R29, where manual inspection is 60 to 70 percent accurate and misses 20 to 30 percent of defects against above 90 percent for computer vision).[R29][S34]
  • Pathway 3: Worker, producer or community grievance. A worker, subcontracted operator, farmer or community member reports unpaid wages, coerced overtime, unsafe conditions, retaliation, or improper data disclosure. Owner: Human-rights and labour grievance committee with worker or union representation and external recourse. Records sit in a confidential register excluded from the traceability database, with non-retaliation rules and local-language intake (spoken, paper drop-box and assisted intake).[S17][S19][S1101]

Where a grievance reveals an operational cause threatening custody integrity, such as late order changes forcing unrecorded night-shift subcontracting, the committee issues an anonymised corrective requirement to purchasing and operations without exposing the complainant.[S06][S17][S1101]

11.163 min · 3 sub-steps · 1 exhibit

Training is complete only when people handle exceptions

Step 1 of 7Clean barcode scan (happy path)

Exhibit 50 · illustrativeTraining must test the difficult cases

Mandatory operator drillSupervisor and QA joint drillBasic onboarding checkTechnical steward rehearsalRecovery procedure complexity →Severity of claim defect if mishandled →Clean barcode scan (h…Torn bale label repla…Unknown roll in cutti…Duplicate bale ID on…Offline queue and rep…Expired scope certifi…Personal-data over-re…Wrong moisture basis…
Mandatory operator drillSupervisor and QA jointdrillBasic onboarding checkTechnical stewardrehearsalRecovery procedure complexity →Severity of claim defect if mishandled →Clean barcode scan (h…Torn bale label repla…Unknown roll in cutti…Duplicate bale ID on…Offline queue and rep…Expired scope certifi…Personal-data over-re…Wrong moisture basis…

Clean barcode scan (happy path)

Clean barcode scan (happy path): Recovery procedure complexity 1.5, Severity of claim defect if mishandled 2. Quadrant: Basic onboarding check · illustrative

Chain-of-custody standards require organisations to train staff on traceability procedures and retain training records.

Torn bale label replacement

Torn bale label replacement: Recovery procedure complexity 3.5, Severity of claim defect if mishandled 7.5. Quadrant: Mandatory operator drill · illustrative

Unknown roll in cutting lay

Unknown roll in cutting lay: Recovery procedure complexity 4.2, Severity of claim defect if mishandled 8.8. Quadrant: Mandatory operator drill · illustrative

Offline queue and replay sync

Offline queue and replay sync: Recovery procedure complexity 7.8, Severity of claim defect if mishandled 7.8. Quadrant: Supervisor and QA joint drill · illustrative

Expired scope certificate hold

Expired scope certificate hold: Recovery procedure complexity 6.5, Severity of claim defect if mishandled 9.4. Quadrant: Supervisor and QA joint drill · illustrative

Personal-data over-request refusal

Personal-data over-request refusal: Recovery procedure complexity 4.8, Severity of claim defect if mishandled 8.5. Quadrant: Mandatory operator drill · illustrative

Wrong moisture basis correction

Wrong moisture basis correction: Recovery procedure complexity 8.2, Severity of claim defect if mishandled 4.5. Quadrant: Technical steward rehearsal · illustrative

Method and source · Exhibit 50

Illustrative GFT competency-testing matrix based on S06 training and record-keeping duties, S10 error declarations, S19 data minimisation and S31 accessibility guidelines. Coordinates are instructional design categories, not measured test scores.

Unit: illustrative scenario index (0 to 10). Status: illustrative. Sources: S06, S10, S19, S31. Illustrative figures are teaching examples, not measured factory results.

11.16 · the bodyExhibit 50 above; its figures are illustrative where marked.

Chain-of-custody standards require organisations to train staff on traceability procedures and retain training records.[S06] Most implementation budgets spend training hours on the "happy path" in a classroom: scanning a clean barcode on an intact bale with fast Wi-Fi and a matching delivery note.[S06][S10] Within forty-eight hours of launch, an operator faces a rain-smudged tag, a split roll lacking a child ticket, a subcontractor return with a 15 kg weight difference, or a disconnected terminal.[S06][S10] Without exception rehearsals, operators improvise workarounds that corrupt the genealogy graph.[S03][S10]

¶ 01 · 3 sources

a subcontractor return with a 15 kg weight differenceS06, S10

Related · Exhibit 27 · chapter 06

S06S10S03

11.17 Instructions and interfaces must meet testable accessibility and language rules

11.17

A shop-floor interface or standard operating procedure (SOP) works only if operators on every shift can perceive, understand and act on it under warehouse lighting, noise and time pressure.[S31] GFT applies World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG) 2.2 principles to shop-floor capture tools and public passport views, paired with plain-language job aids.[S31]

¶ 02 · 1 source

…Web Content Accessibility Guidelines (WCAG) 2.2 principles to shop-floor capture tools and public passport…S31

S31

  1. Perceivable and non-colour-dependent states: holds, pending-sync warnings and released states never rely on red, amber or green colour alone; every status pairs high-contrast text (HOLD, PENDING SYNC, RELEASED) with distinct icons ([!], [~], [OK]) legible on monochrome labels and terminals.[S31]
  2. Keyboard, scanner and large-target operability: workers wearing gloves or using a weighbridge keypad can complete every capture and exception step via physical keys or a barcode trigger without fine touch gestures.[S31]
  3. Plain language and bilingual job aids: technical terms from GS1 EPCIS (TransformationEvent, correctiveEventIds) or scheme rulebooks (irreversible conversion) are translated into concrete actions in French, English and local working languages used in northern and littoral Cameroon sites, backed by laminated cards at each station.[S06][S10][S31]
List · 3 sources

S31S06S10

11.18 Pilot competency must be verified through fault-injection drills

11.18

Rather than measuring training readiness by attendance signatures, GFT defines a competency gate to pass before the Chapter 13 pilot starts (with the wider vocational training pipeline covered in wp09).[S06] Every receiving clerk, line leader, quality reviewer and data steward must complete fault-injection drills using synthetic training lots and leave a verifiable record trail.[S03][S06][S10]

¶ 03 · 3 sources

S06S03S10

  • Drill 1: Damaged or duplicate bale label at receipt. The trainee receives two bales with identical lot numbers or a torn barcode. Pass condition: quarantine both bales, log a disputed-receipt exception referencing the transport document, and refuse a duplicate stock receipt.[S06][S10]
  • Drill 2: Unidentified reserve roll added to a cutting lay. A cutting trainee completes a 10-roll lay where one roll lacks a batch link. Pass condition: log the missing link on the cutting-lay transformation event, restricting the bundle batch from carrying a provenance claim until quality review reconstructs the link or downgrades the batch.[S02][S06][S10]
  • Drill 3: Network outage and delayed replay. A terminal is disconnected while the trainee logs three events (receipt, storage move and spinning laydown), then reconnected alongside a duplicate message. Pass condition: use the local queue without halting work, hold outbound claims, and verify after sync that idempotent ingestion kept one record per event ordered by eventTime.[S10][S27]
  • Drill 4: Expired scope certificate or privacy over-request. A quality trainee receives a simulated shipment whose supplier scope certificate expired two days before dispatch, plus a buyer request for farmer names and phone numbers. Pass condition: block certified-claim allocation for the expired shipment and refuse the personal-data request using the privacy register.[S03][S19]
List · 6 sources

S06S10S02S27S03S19

Exhibit 50 maps these illustrative drills across two dimensions: severity of the claim defect if mishandled and complexity of the shop-floor recovery procedure.[S06][S10][S31]

¶ 04 · 3 sourcesExhibit 50

S06S10S31

As Exhibit 50 shows, the "happy path" scan in the lower-left quadrant carries low recovery complexity and low defect risk because software validates it automatically.[S10] High-severity cases in the upper quadrants, including unknown rolls in a cutting lay, duplicate bale codes, expired scope certificates and offline queue sync, require practiced judgment across operator, quality and steward roles.[S06][S10] Exhibit 50 sets the curriculum for pilot readiness; it does not claim any Cameroon workforce has yet been tested against these scenarios, and pass rates must be recorded during the Chapter 13 pilot.[S06]

¶ 05 · 2 sourcesExhibit 50

S10S06

11.19 Standard work connects operating discipline to the commercial cost test

11.19

Delivering an operable governance system yields three artefacts for the rest of this paper: the six-role responsibility matrix (Exhibit 46), the offline and exception standard-work protocols (Exhibit 48 and Exhibit 50), and the privacy-by-purpose register (Exhibit 49).[S03][S10][S19] Every control requires operator minutes, labels, edge storage, drills and independent review.[S06] Chapter 12 prices that recurring work against bounded counterfactual benefits before any platform vendor is chosen.[S03][S27]

Check the record

The chapter keeps its sources within reach.

Every knot is a source this chapter cites; select one to read its record, or filter the register by grade. Publication dates and inherited-source limits stay explicit. Read the paper's full evidence summary.

26 sources · 271 citation marks on this pageMost cited: S10, 59 times

Grade AGrade BGrade CKnot size: citations on this page

All 26 records shown

R03 · Grade C · inherited record

SODECOTON

Inherited evidence R03

Company profile: more than 220,000 cotton producers supported in northern Cameroon; nine ginning plants; two oil mills.

Publication date unrecorded. Inherited source-text record. The original publication has not been independently reopened for this web edition.

Chapter source notes

S03 Textile Exchange. 2026-10-30.

S10 GS1. 2022.

S19 European Data Protection Board. 2026-10-30.

S1101 Office of the United Nations High Commissioner for Human Rights. 2011.

R06 Cameroon Trade Hub. Publication date unrecorded; inherited source-text check.

S01 International Organization for Standardization. 2020.

S02 ISEAL Alliance. 2025.

S06 Aid by Trade Foundation. 2025.

S17 OECD. 2018-03-07.

S09 Cotton made in Africa / Sustainable Cotton Tracker. 2026-10-30.

S26 National Institute of Standards and Technology. 2020.

S27 National Institute of Standards and Technology. 2024-11-01.

S12 GS1. 2026.

R14 WageIndicator. Publication date unrecorded; inherited source-text check.

R16 WageIndicator. Publication date unrecorded; inherited source-text check.

R15 wage.is. Publication date unrecorded; inherited source-text check.

S23 World Wide Web Consortium. 2025-05-15.

S24 World Wide Web Consortium. 2025-05-15.

S11 GS1. 2022.

S28 UNECE / UN Transparency Protocol. 2026-10-30.

S1102 LEX Africa. 2025-10-31.

R03 SODECOTON. Publication date unrecorded; inherited source-text check.

S20 International Labour Organization. 2026-10-30.

R29 MDPI; industry inspection literature. Publication date unrecorded; inherited source-text check.

S34 European Commission, DG GROW. 2026-10-30.

S31 World Wide Web Consortium. 2024-12-12.

Keep the thread · chapter 11 of 14

Chapter 12 picks up the thread.

Move the shuttle along the rack to preview any chapter: its sections, exhibits and reading time. Draft web edition. This research is not investment, legal or tax advice; illustrative models are not measured factory results.

The paper's rack · 14 boltsBolt length: reading time

12Part IV: Scale follows demonstrated control

Traceability economics depend on the work needed to sustain it

Compare the cost of producing admissible evidence with bounded benefits rather than an assumed premium.

  • 12.1Cost starts with capture and reconciliation work
  • 12.4Per-garment cost needs a defensible denominator
  • 12.7Benefits must be measured by a counterfactual
  • 12.10Choose scope before choosing a vendor
Reading time
34 min
Exhibits
4
Sections
6
Continue to chapter 12
← Previous: chapter 10, Digital signatures preserve assertions while trust needs governanceContinue the threadChapter 12 · Traceability economics depend on the work needed to sustain it

Find a thread.

Type to search.