This is what has been bugging me about selling zanzibar in our org. Our usecase is we act as a passthrough/gateway for data stored by a 3rd party. So establishing ownership of a resource (which is in the resource metadata itself) is only possible when data is actually queried. We could use caveats to establish ownership, but at that point we may as well not bother with a zanzibar approach at all. Someone here suggested streaming data which is sort of a tough sell, but since we don't host the data it's difficult.