Every asset the studio may use, and the consent or licence behind it.
Patient consent scans stay on paper for now: they are protected-zone records and upload arrives with the phi database. Record the row here; the asset stays blocked until everything is in place.