Knowledge Access should not be treated as a simple Open / Closed distinction. Knowledge should remain as broadly accessible as possible, and unnecessary Information Inequality should be avoided. At the same time, Access may need to be limited by legitimate Governance Requirements concerning Security, Privacy, Professional Responsibility, Intellectual Property, and other considerations.

Knowledge Access can therefore be structured through three Access Models: Open, Restricted, and Controlled.

Open Knowledge is Publicly Available and allows General Access without requiring specific Identity, Affiliation, Qualification, or Authority as an Access Condition.

Restricted Knowledge uses Affiliation with a particular Organization, together with appropriately assigned Role, Authority, Context, and related factors within that Organization, as Access Conditions. The basis for Access lies in Organizational Governance, and only Authorized Users who satisfy the relevant Conditions may access the Knowledge.

However, legitimate Knowledge Access does not always depend on Organizational Affiliation. Researchers, Professionals, Independent Individuals, and other Actors may have a legitimate basis for Access under applicable Governance even when they are not affiliated with a particular Organization.

Under Controlled Access, Access Authorization is therefore established according to Applicable Governance through a combination of Conditions such as Verified Identity, Qualification, Authorized Domain, Purpose, and Access Environment, rather than Organizational Affiliation itself.

For an Independent Individual, Verified Identity, Authorized Purpose, and an Approved Controlled Environment may be combined to permit Access to Knowledge, for example through a managed Environment such as a Library.

For a Verified Professional, Professional Credentials, Authorized Domain, Purpose, and related Conditions may be verified to permit Access to an appropriate Scope of Knowledge under Applicable Governance. Remote Access may also be permitted where the necessary Security Conditions are satisfied and Governance allows it.

Importantly, Controlled Access is not an Exception that weakens Restricted Access. Both are forms of Governance-based Access Control. What differs is the set of Conditions through which Access Authorization is established. In some cases, Organizational Affiliation and Delegated Authority provide the basis. In others, Authorization may be established through a combination of Identity, Qualification, Domain, Purpose, Environment, and other Governance Conditions.

This structure preserves Confidentiality and Security while avoiding the exclusion of legitimate Knowledge Access solely because an Actor lacks Organizational Affiliation.