Welcome to Innovating Trust

Last week on Innovating Trust, we examined Europe’s expanding regulatory landscape and made a simple but powerful observation: when viewed structurally, frameworks such as digital identity, cybersecurity regulation, and interoperability standards begin to resemble parts of a single operating system for trust.

But if that architecture is real, it raises an uncomfortable question.

What actually enforces the commercial and operational boundaries of software once it is deployed?

In this solo episode, Steve Atkins argues that the traditional three-layer model of digital trust—identity, cryptography, and security—contains a critical gap. While those layers answer who is acting, whether systems are authentic, and whether environments are resilient, none of them can answer a fourth question that modern software systems increasingly depend on:

Is this software currently permitted to behave the way it is behaving?

That question belongs to licensing.

Historically treated as a commercial function rather than infrastructure, licensing has remained largely disconnected from the operational trust architecture that governs modern digital systems. But in a world of continuously updated software, modular capabilities, global deployment, and evolving regulatory obligations, that separation no longer holds.

This episode explores why runtime licensing is emerging as the missing enforcement mechanism within the Ownership layer of the trust stack—transforming commercial authorisation from static contract terms into executable operational infrastructure.

Along the way, the discussion introduces the concept of entitlement decay, the growing gap between what software is authorised to do and what it is technically capable of doing as systems evolve after deployment.

The episode also examines the regulatory dimension. With frameworks such as the Cyber Resilience Act (CRA)requiring security obligations to persist throughout a product’s operational lifecycle, licensing systems increasingly function not only as monetisation tools but as mechanisms for continuous compliance enforcement in the field.

For vendors, this shifts licensing from a procurement decision to an architectural one.
For operators, it becomes a signal of compliance maturity.
And for the wider trust ecosystem, it reveals that licensing is not peripheral infrastructure—but a structural component of digital governance.

Three accompanying articles published this week on The Quantum Space explore the argument in greater depth, examining licensing as infrastructure, entitlement decay as a systemic risk, and the role of runtime licensing in completing the operational model of digital trust.

You can also subscribe to our podcast on the platforms below;