A fusion watch can share a case without surrendering decision authority.

Your analyst links an access-control alert, a travel record and a report of police activity near a site. The external authority asks for names. A liaison is already on the call, and several internal managers are watching. Everyone can see the case. Nobody has yet established who may disclose it or who will accept it.

The failure starts inside the watch. A dashboard makes service, case, data, platform, shift and escalation control look like one authority. They are six different rights. The boundary then makes the error consequential. The recipient remains governed by its own law and decides under its own mandate.

An agreement can make that crossing orderly. It cannot give either organisation a power it lacks. You need a named owner at every internal step, a bounded exchange and an explicit act of acceptance on the far side.

Separate the six internal owners. A case drifts when everyone on the floor can work it but nobody knows which decision each person holds. The platform manager starts limiting disclosure. The analyst promises response. The sponsor changes the queue. Each has stepped outside a useful authority.

Give the capability owner the service boundary, hours, coverage and exception policy. Give the analyst ownership of case assembly and provenance. The data steward controls meaning, quality, permitted disclosure and retention. The platform owner controls access, transport, storage and technical recovery. The watch holder owns the live queue and shift. The escalation owner accepts risk and commits the organisation beyond procedure.

WHO’s IHR 2005 benchmark uses five capacity levels. Its developed level combines permanent core staff, identified data, an interoperable platform, funding and training. That combination matters because no dashboard owner can supply all five. The service owner must fund the dependencies while the other owners govern them.

As checked on 27 August 2026, FEMA’s Resource Typing Library returned 20 emergency-operations-centre skillsets. Centre management, situational awareness, action tracking and records appeared separately. Your role map can combine posts, but it should not erase the different competencies and decisions.

Designate one qualified watch holder. Multiple managers create hesitation because seniority offers several plausible directions. Analysts begin seeking consensus for routine floor decisions. The queue then waits for a meeting while each manager assumes someone else holds it.

Name one holder for the full watch and record the deputy. As of 27 August 2026, FAA Order JO 7210.3EE Change 2 requires one official in charge when two or more specified managers are on duty. A controller-in-charge candidate must have six months’ prior certification in the relevant area or facility. The rule is an air-traffic example, not a corporate qualification. The transferable discipline is one current holder with demonstrated competence.

A senior visitor can direct the escalation owner without silently taking the floor. Transfer the watch only when the outgoing holder names the open cases, clocks, restrictions and unresolved exchanges, and the incoming holder accepts them.

Keep data authority attached to the record. The case owner knows why several records belong together. That knowledge does not settle whether each source may cross the boundary. A combined case can contain several disclosure decisions even when the platform displays a single row.

Record the source owner, data steward, purpose, quality limit, handling marking and expiry for each component. NIST PF 1.0 uses Figure 8 to model data-processing-ecosystem relationships. The UK NCSC separately groups SOC logs into four categories: application, host, network and cloud. Both make the same operational problem visible. Responsibility follows records and processing relationships, not the screen containing them.

Reference data needs the same treatment. OCHA gives global oversight to two core Common Operational Datasets: administrative boundaries and sex- and age-disaggregated population data. Country endorsement sits elsewhere. Your facility layer, personnel register and police report can likewise have different stewards and approvers.

Use the liaison as an authority bridge. A liaison fails when presence is read as command. The watch assumes the receiving organisation has accepted the case. The recipient hears useful context but never assigns its own decision owner. Both sides later point to the same meeting as evidence of transfer.

Require the liaison to deliver the bounded package, explain provenance and restrictions, obtain a named receiving owner, and return acceptance or rejection. CPG 502, published in 2010, recommends identified liaison personnel and describes a full-time analyst or intelligence officer as one implementation. It also identifies classification, system access and training as constraints. Adjacency supplies no automatic access.

US DHS distinguishes two centre functions: ongoing fusion-centre information sharing and emergency-operations-centre incident coordination. Use that distinction at the interface. Your watch maintains the integrated record. The receiving authority decides whether to investigate, deploy, warn or decline under its own mandate. The liaison keeps both records aligned.

State authority for every exchange. A standing MOU often creates false comfort because the title sounds official. The document may allocate contacts and channels while leaving the actual disclosure governed by statute, regulation, contract or consent. Following the document therefore provides no immunity when the exchange itself is unlawful.

For every transmission, record the purpose, lawful basis, approved fields, recipient, permitted use, onward-sharing limit, security, retention and deletion rule. Under the UK GDPR, worker health information requires an Article 6 lawful basis and an Article 9 special-category condition. That is a UK condition, not a global formula. The agreement must route the operator to the regime that governs the case.

Restrictions travel with the package. In the United States, 6 USC 1503 permits specified cyber sharing for cybersecurity purposes. A non-federal sender must remove personal information known at the time to be unrelated to the threat, and recipients must observe lawful restrictions. Membership in a sharing community does not widen that authority.

If immediate harm makes contemporaneous recording impossible, use the emergency rule that actually applies and record the decision afterwards. UK ICO guidance allows necessary and proportionate emergency sharing with later documentation in those circumstances. It does not suspend data-protection law.

Keep the agreement’s exit beside its entry. Operational clauses are easy to find because people need fields, contacts and channels. Amendment, withdrawal, surviving safeguards, records and disputes are often buried elsewhere. During a breach or contested case, those clauses become the operating procedure.

Put the approver, change method, effective condition, precedence, suspension, withdrawal notice, surviving confidentiality and security duties, record custody and dispute route in the same controlled instrument. EMAC Article XIII supplies one jurisdiction-bound model: 30 days’ written withdrawal notice, while obligations already incurred survive. That compact rule does not become your period. It shows what a usable exit states.

Link the agreement to an amendable schedule and runbook. A contact or secure channel can then change without expanding purpose. Require review after a significant complaint or security breach, as the UK ICO advises. The review record should identify what changed, who approved it and which duties survived.

Make acceptance a recorded act. Delivery fails as a handoff because systems acknowledge packets, not responsibility. CAP 1.2 provides five message types: Alert, Update, Cancel, Ack and Error. It references an earlier message through sender, identifier and sent time. Those controls preserve message history. An Ack still does not prove that an operational authority owns the case.

Your acceptance record needs the case identifier, version, sender, named recipient, time, scope, restrictions, next action and open questions. The recipient must accept under its own procedure. If it rejects the case, the watch retains ownership, records the reason and either corrects the package or escalates to another authorised route.

Keep the acceptance state visible through relief. UK HSE describes three handover elements: outgoing preparation, exchange between outgoing and incoming personnel, and incoming cross-check. It recommends two-way verbal and written communication. Add the receiving organisation’s acceptance, restrictions and next clock to that exchange.

Close both records without forcing one retention rule. A shared case produces an official record in each organisation. Deleting the watch copy because the recipient accepted it can destroy the disclosure decision. Keeping both copies forever can breach a purpose-limited regime.

Each organisation applies its own retention, access and deletion duties. Under UK GDPR Article 5(1)(e), identifiable data is generally kept no longer than necessary for the processing purpose. In governed US criminal-intelligence systems, 28 CFR Part 23 requires review and validation before a retention period that cannot exceed five years. Neither rule supplies a universal watch period.

Close the operational handoff only after the receiving authority accepts the case and both sides record what their regimes require. Then test the seam. ISO 22320:2018 applies where two or more organisations cooperate while keeping separate structures or using a combined one. Run an exercise where the first recipient refuses, a restriction changes and the watch holder is relieved. The useful result is a complete authority trail, from internal case assembly to downstream acceptance, that neither organisation has mistaken for shared command.