A mutual-aid exchange for data: agencies pre-commit their layers as dormant grants, a declaration flips them live on the incident map — governed, fresh, revocable — and the audit trail writes the after-action annex itself.
An ad-hoc working group. Shapefiles by email. Credentials read out over the phone. A data-sharing agreement negotiated mid-response — the worst possible time. And when the incident ends, half the access quietly lives on.
Twenty years of federal audit findings say the same thing: the data existed; the agreements, trust, and plumbing didn't. In one landmark hurricane response, sharing worked mainly because the right people had met at a workshop two years earlier.
Relationships shouldn't be the infrastructure. The compact should be.
EMAC pre-ratified the law in all 50 states. Mission Ready Packages make an offer deployable "in less than a minute." Activation is selection, not negotiation.
Europe's rapid-mapping service pre-positioned authorized triggerers and a standard product portfolio — 570+ activations on an SLA clock.
The UN's exchange pre-positioned org-level trust, sensitivity tiers, and per-crisis completeness grids that show what's missing, not just what's there.
Modern "share, don't ship" protocols pre-positioned zero-copy, revocable grants with usage telemetry — share a reference, never a file.
Nobody assembled them for disaster GIS. The Compact is the assembly: pre-position everything expensive — law, trust, packages, protocol — so incident time is selection and activation, never negotiation.
Verified agencies register Data Mission Ready Packages and pre-sign dormant grants. Drills earn badges. The lawyers work here — once.
A declaration flips matching grants live in seconds. Layers appear wearing passports; gaps become tracked requests.
Access dies with the incident. The audit trail renders as the after-action data annex — automatically.
Three sensitivity tiers: open · by-request · restricted, with steward review on the sensitive end.
The incident's hazard, geography, and clock are evaluated against every dormant grant's conditions. Matching cells animate hollow → solid; each one adds its live layer to the incident map, scoped to the AOI. Nothing is emailed. No new accounts are created.
Every shared layer wears a passport: providing org · vintage · refresh SLA · tier — with a freshness dot that flags an SLA breach on its own. And providers see exactly who consumed what: the trust incentive that makes agencies willing to share.
Per-AOI completeness of the core checklist — shelters, damage, debris, utilities, roads, boundaries. ✓ covered · ◐ stale · ✗ missing. The board shows what you don't have, while there's still time to get it.
A missing chip opens a prefilled, tracked request: submit → steward approval → time-boxed grant → fulfilled as a live layer, never a zip → demobilized with the incident. The resource-order discipline your data requests never had.
Close the declaration and the exchange auto-revokes every incident grant (with a recovery tail for the long jobs). No orphaned credentials, no "who still has access?" audit six months later.
Then the part every after-action report skips because it's too painful to reconstruct: who shared what, with whom, when, and how fresh it was — rendered from the audit trail as a print-ready data annex, with a replay slider for the timeline. One click. Zero re-typing.
Every verb logged: declared · activated · accessed · approved · revoked. Accountability is the product.
Declare a Tulare Basin flood exercise: the AOI is the live county boundary, fetched at declaration time from the state service — not a drawn box.
Statewide shelters, 15-minute power-outage areas, FEMA floodplains, state highways — and the damage grant serves the actual 2023 Tulare flooding damage-inspection archive, vintage-labeled.
Archive data says 2023 archive. Synthetic fulfillments say DEMO. An unreachable feed says so. Grant enforcement is named for what it is: a backend concern, served by Strata with short-lived, referer-bound tokens.
| Layer of the stack | Discovery portals & hubs | The Compact |
|---|---|---|
| Find — what data exists | Excellent — keep them | Consumes them as the substrate |
| Agree — who may use it, when | Out of scope | Pre-signed dormant grants + tiers |
| Activate — turn it on at declaration | Manual, per incident | Automatic flip, in seconds |
| Track — requests & gaps | Email threads | 213RR-style queue + Data Grid |
| Account — who accessed what | — | Full audit → after-action annex |
It complements your COP, your state hub, and your existing EOC stack — sovereign, MIT-licensed Strata core, deployed on your servers behind your SSO. Re-pointing it to another state's services is configuration, not development.
So don't. Pre-position the agreements, the packages, and the plumbing — and let the declaration do the activating.