# T017 — Cabot Sharing Rule vs Unresolved External Account Scope Cabot Policy 305.1 permits captured-plate sharing with another law-enforcement agency when the data indicates evidence of an offense and says the data may not otherwise be shared, while Cabot's Flock tenant retained 40 active accounts using non-Cabot domains with Search and Hotlist Tool enabled. The export does not reveal what cameras or networks those accounts could access, so the record raises a compliance question without proving a violation. ## Statement A Policy 305.1 states: "Captured plate data that indicates evidence of an offense may be shared with other law enforcement agencies. Captured plate data may not be otherwise shared, sold, traded, or exchanged" ([[Cabot LPR Policy 305.1]], `305.1 License Plate Readers.pdf`, p. 3). ## Statement B The July 21, 2026 user export contains 87 active accounts, including 40 using non-Cabot domains; all 87 active rows show Search and Hotlist Tool enabled ([[Cabot Flock User Access Export]], `Users_July_21_2026.pdf`, full-file page-pair reconstruction). The domains include state-police and Lonoke-area public-safety namespaces plus one consumer-email domain. ## Why it matters If the accounts can search Cabot reads, Cabot's authorization, purpose, relationship, and audit records are necessary to test the policy's evidence-of-offense boundary and account-management controls. If the accounts are scoped only to their own networks or inactive data domains, the apparent tension narrows substantially. The current user export cannot distinguish those possibilities. ## Resolution status `open` — resolve through per-user network/camera scope, SharedNetworks and Network Audit/history exports, account-approval and role-change records, retained search/audit logs, and a custodian explanation of what Search and Hotlist Tool mean for outside-domain users. ## Discovery Surfaced during the 2026-07-22 Cabot production ingest by comparing Policy 305.1 to the produced user export. ## Notes An enabled feature column is not proof that an account searched Cabot data. No account-holder names, email addresses, IDs, or individual login dates are republished in the wiki.