Run an approved query where data lives

Data steward and data holder (federated data, purpose views): Run an approved query where data lives. Starts when: View issued. Steps: Submit query; Query runs at holder; Only results leave; Record run. Done when: The run record shows the query, holder and result hash with a receipt. Rules that apply: Five Safes framework.