diff --git a/apps/editor/src/application/framework/mappers/case/CasePackageSnapshot.ts b/apps/editor/src/application/framework/mappers/case/CasePackageSnapshot.ts
index 4c9cc37..e3e4c3f 100644
--- a/apps/editor/src/application/framework/mappers/case/CasePackageSnapshot.ts
+++ b/apps/editor/src/application/framework/mappers/case/CasePackageSnapshot.ts
@@ -36,6 +36,8 @@ export type CaseDocumentSnapshot = {
   lastChangeDateTime?: string
   /** Link to the CFLicense governing this framework */
   licenseURI?: { title?: string; identifier?: string; uri: string }
+  /** OpenCASE: unauthenticated CASE API reads. Absent means sign-in is required. */
+  publicAccess?: boolean
 }
 
 /**
diff --git a/apps/editor/src/application/framework/mappers/case/caseToDomainFramework.ts b/apps/editor/src/application/framework/mappers/case/caseToDomainFramework.ts
index d15ce99..dea64bd 100644
--- a/apps/editor/src/application/framework/mappers/case/caseToDomainFramework.ts
+++ b/apps/editor/src/application/framework/mappers/case/caseToDomainFramework.ts
@@ -56,6 +56,7 @@ export function mapCaseSnapshotToDomainFramework(snapshot: CasePackageSnapshot):
     statusEndDate: doc.statusEndDate,
     lastChangeDateTime: doc.lastChangeDateTime,
     licenseURI: doc.licenseURI,
+    publicAccess: doc.publicAccess === true ? true : undefined,
   }
 
   const items: Framework['items'] = new Map()
diff --git a/apps/editor/src/application/framework/mappers/case/normalizeCasePackage.ts b/apps/editor/src/application/framework/mappers/case/normalizeCasePackage.ts
index ab72bb0..8f10bbf 100644
--- a/apps/editor/src/application/framework/mappers/case/normalizeCasePackage.ts
+++ b/apps/editor/src/application/framework/mappers/case/normalizeCasePackage.ts
@@ -297,6 +297,9 @@ export function normalizeCasePackageResponse(res: unknown): CasePackageSnapshot
       }
     : undefined
 
+  const opencaseExt = asRecord(asRecord(doc.extensions)?.['ext:opencase'])
+  const publicAccess = opencaseExt?.publicAccess === true ? true : undefined
+
   // Extract CFAssociationGroupings from CFDefinitions
   const defs = asRecord(pkg.CFDefinitions)
   const groupingsRaw = defs ? (Array.isArray(defs.CFAssociationGroupings) ? defs.CFAssociationGroupings : []) : []
@@ -340,6 +343,7 @@ export function normalizeCasePackageResponse(res: unknown): CasePackageSnapshot
       statusEndDate: asString(doc.statusEndDate),
       lastChangeDateTime: asString(doc.lastChangeDateTime),
       licenseURI,
+      publicAccess,
     },
     items,
     associations,
diff --git a/apps/editor/src/application/framework/mappers/case/toCasePackage.test.ts b/apps/editor/src/application/framework/mappers/case/toCasePackage.test.ts
index 4b1334b..63fd241 100644
--- a/apps/editor/src/application/framework/mappers/case/toCasePackage.test.ts
+++ b/apps/editor/src/application/framework/mappers/case/toCasePackage.test.ts
@@ -31,3 +31,32 @@ describe('frameworkToCfPackage — version', () => {
     expect(second.CFDocument.version).toBe('2.0')
   })
 })
+
+describe('frameworkToCfPackage — public access', () => {
+  it('writes public access into ext:opencase only when enabled', () => {
+    const pub = frameworkToCfPackage({
+      framework: { ...makeFramework(), metadata: { title: 'Test Framework', publicAccess: true } },
+      caseVersion: '1.1',
+    })
+    const pubExt = pub.CFDocument.extensions?.['ext:opencase'] as { publicAccess?: boolean } | undefined
+    expect(pubExt?.publicAccess).toBe(true)
+    expect(pub.CFDocument.publicAccess).toBeUndefined()
+
+    const priv = frameworkToCfPackage({
+      framework: {
+        ...makeFramework(),
+        metadata: {
+          title: 'Test Framework',
+          licenseURI: {
+            identifier: 'c0c0c0c0-0000-4000-a000-000000000001',
+            uri: '/ims/case/v1p1/CFLicenses/c0c0c0c0-0000-4000-a000-000000000001',
+            title: 'Public Domain (CC0 1.0)',
+          },
+        },
+      },
+      caseVersion: '1.1',
+    })
+    const privExt = priv.CFDocument.extensions?.['ext:opencase'] as { publicAccess?: boolean } | undefined
+    expect(privExt?.publicAccess).toBeUndefined()
+  })
+})
diff --git a/apps/editor/src/application/framework/mappers/case/toCasePackage.ts b/apps/editor/src/application/framework/mappers/case/toCasePackage.ts
index a1ed9d6..ecc4b7a 100644
--- a/apps/editor/src/application/framework/mappers/case/toCasePackage.ts
+++ b/apps/editor/src/application/framework/mappers/case/toCasePackage.ts
@@ -88,6 +88,7 @@ type OpencaseExtension = {
   colorBand?: string
   linkedFrameworks?: unknown[]
   remoteItemLinks?: unknown[]
+  publicAccess?: boolean
 }
 
 /**
@@ -101,7 +102,7 @@ function mergeOpencaseExtension(
   const extensions = { ...base }
   
   // Only add if there's data to store
-  if (opencaseData.layout || opencaseData.notes || opencaseData.originHandle || opencaseData.destinationHandle || opencaseData.edgeType || opencaseData.colorBand || opencaseData.linkedFrameworks || opencaseData.remoteItemLinks) {
+  if (opencaseData.layout || opencaseData.notes || opencaseData.originHandle || opencaseData.destinationHandle || opencaseData.edgeType || opencaseData.colorBand || opencaseData.linkedFrameworks || opencaseData.remoteItemLinks || opencaseData.publicAccess) {
     const existing = (extensions[OPENCASE_EXT_KEY] as OpencaseExtension | undefined) ?? {}
     extensions[OPENCASE_EXT_KEY] = {
       ...existing,
@@ -154,12 +155,13 @@ function frameworkToCfDocument(
       title: docTitle,
       identifier: fwId,
     },
-    extensions: (layout || options?.edgeType || options?.linkedFrameworks || options?.remoteItemLinks)
+    extensions: (layout || options?.edgeType || options?.linkedFrameworks || options?.remoteItemLinks || meta.publicAccess === true)
       ? mergeOpencaseExtension(undefined, {
           layout,
           edgeType: options?.edgeType,
           linkedFrameworks: options?.linkedFrameworks,
           remoteItemLinks: options?.remoteItemLinks,
+          ...(meta.publicAccess === true ? { publicAccess: true } : {}),
         })
       : undefined,
   }
diff --git a/apps/editor/src/domain/case/types.ts b/apps/editor/src/domain/case/types.ts
index 2df75a6..f9d24a6 100644
--- a/apps/editor/src/domain/case/types.ts
+++ b/apps/editor/src/domain/case/types.ts
@@ -68,6 +68,12 @@ export interface CFDocument {
   /** licensing */
   licenseURI?: LinkURI
 
+  /**
+   * Editor-only: when true, the CASE API serves this framework without authentication.
+   * Persisted in `ext:opencase.publicAccess`. Absent means sign-in is required.
+   */
+  publicAccess?: boolean
+
   lastChangeDateTime: string
 
   /** Link back to containing package */
diff --git a/apps/editor/src/domain/framework/hasFrameworkDataChanged.test.ts b/apps/editor/src/domain/framework/hasFrameworkDataChanged.test.ts
index fd1e2df..2aff875 100644
--- a/apps/editor/src/domain/framework/hasFrameworkDataChanged.test.ts
+++ b/apps/editor/src/domain/framework/hasFrameworkDataChanged.test.ts
@@ -48,6 +48,13 @@ describe('hasFrameworkDataChanged', () => {
     expect(hasFrameworkDataChanged(a, b)).toBe(false)
   })
 
+  it('ignores toggling public read access', () => {
+    const a = baseFramework()
+    const b = clone(a)
+    b.metadata = { ...b.metadata, publicAccess: true }
+    expect(hasFrameworkDataChanged(a, b)).toBe(false)
+  })
+
   it('ignores canvas-only changes nested under metadata["ext:opencase"]', () => {
     const a = baseFramework()
     const b = clone(a)
diff --git a/apps/editor/src/domain/framework/hasFrameworkDataChanged.ts b/apps/editor/src/domain/framework/hasFrameworkDataChanged.ts
index 0ad1f83..4363843 100644
--- a/apps/editor/src/domain/framework/hasFrameworkDataChanged.ts
+++ b/apps/editor/src/domain/framework/hasFrameworkDataChanged.ts
@@ -49,8 +49,16 @@ function sortedNormalizedEntries<K extends string, V>(map: Map<K, V>, normalize:
  * handle anchors), since those don't affect a mirrored framework's CASE-spec
  * content and shouldn't be treated as a forking change.
  */
+function comparableDocumentMetadata(metadata: Framework['metadata']): Framework['metadata'] {
+  if (!metadata) return {}
+  // Public read access is an OpenCASE server setting, not CASE content.
+  // Toggling it must not fork a mirrored framework.
+  const { publicAccess: _publicAccess, ...rest } = metadata
+  return rest
+}
+
 export function hasFrameworkDataChanged(baseline: Framework, current: Framework): boolean {
-  if (JSON.stringify(baseline.metadata) !== JSON.stringify(current.metadata)) return true
+  if (JSON.stringify(comparableDocumentMetadata(baseline.metadata)) !== JSON.stringify(comparableDocumentMetadata(current.metadata))) return true
 
   if (JSON.stringify(sortedNormalizedEntries(baseline.items, normalizeItem)) !==
       JSON.stringify(sortedNormalizedEntries(current.items, normalizeItem))) {
diff --git a/apps/editor/src/domain/framework/model/types.ts b/apps/editor/src/domain/framework/model/types.ts
index 16085dc..502f419 100644
--- a/apps/editor/src/domain/framework/model/types.ts
+++ b/apps/editor/src/domain/framework/model/types.ts
@@ -40,6 +40,11 @@ export type FrameworkMetadata = {
   lastChangeDateTime?: string
   /** CASE licenseURI — link to the CFLicense governing this framework */
   licenseURI?: { title?: string; identifier?: string; uri: string }
+  /**
+   * When true, the CASE API serves this framework without authentication.
+   * Persisted as `ext:opencase.publicAccess`. Absent means sign-in is required.
+   */
+  publicAccess?: boolean
 }
 
 export type ItemMetadata = Record<string, unknown>
diff --git a/apps/editor/src/infrastructure/caseApi/CaseApiClient.ts b/apps/editor/src/infrastructure/caseApi/CaseApiClient.ts
index 27d15d8..aea4646 100644
--- a/apps/editor/src/infrastructure/caseApi/CaseApiClient.ts
+++ b/apps/editor/src/infrastructure/caseApi/CaseApiClient.ts
@@ -16,6 +16,8 @@ export type OpenCaseListExtensions = {
   sourcePackageURI?: string
   isModifiedFromSource?: boolean
   alignmentParticipants?: Array<{ identifier?: string; uri: string }>
+  /** When true, the CASE API serves this framework without authentication. */
+  publicAccess?: boolean
 }
 
 export type AlignmentFrameworkSummary = {
diff --git a/apps/editor/src/ui/editor/components/NodePropertiesPanel.tsx b/apps/editor/src/ui/editor/components/NodePropertiesPanel.tsx
index 18df491..da168d6 100644
--- a/apps/editor/src/ui/editor/components/NodePropertiesPanel.tsx
+++ b/apps/editor/src/ui/editor/components/NodePropertiesPanel.tsx
@@ -628,9 +628,32 @@ export default memo(function NodePropertiesPanel({
               </SidebarSection>
             ) : null}
 
+            {/* ── Access (framework only) ── */}
+            {isFramework ? (
+              <SidebarSection title="Access" subtitle="Who can read this framework from the API." accentColor={accentColor} defaultOpen>
+                <div className="rounded-xl border border-black/10 bg-white p-3">
+                  <div className="flex items-start gap-3">
+                    <Checkbox
+                      id="node-fw-public"
+                      checked={cfDocument?.publicAccess === true}
+                      onCheckedChange={(v: CheckedState) => updateDocument({ publicAccess: v === true ? true : undefined })}
+                    />
+                    <div className="grid gap-1">
+                      <Label htmlFor="node-fw-public" className="text-sm font-medium text-slate-900">
+                        Make public
+                      </Label>
+                      <div className={HINT_CLS}>
+                        Off by default, so readers must sign in. Turn this on and save to let anyone read the framework without signing in.
+                      </div>
+                    </div>
+                  </div>
+                </div>
+              </SidebarSection>
+            ) : null}
+
             {/* ── License (framework only) ── */}
             {isFramework && availableLicenses && availableLicenses.length > 0 ? (
-              <SidebarSection title="License" subtitle="Choose who can use this framework and how." accentColor={accentColor} defaultOpen>
+              <SidebarSection title="License" subtitle="Legal terms for how this framework may be used." accentColor={accentColor} defaultOpen>
                 <div className="space-y-3">
                   <select
                     id="node-license"
diff --git a/apps/editor/src/ui/editor/reactflow/mapping/fromEditorGraph.ts b/apps/editor/src/ui/editor/reactflow/mapping/fromEditorGraph.ts
index 947c8ee..a68ce14 100644
--- a/apps/editor/src/ui/editor/reactflow/mapping/fromEditorGraph.ts
+++ b/apps/editor/src/ui/editor/reactflow/mapping/fromEditorGraph.ts
@@ -72,6 +72,7 @@ export function fromEditorGraph(params: { graph: EditorGraph }): { framework: Fr
     statusEndDate: doc?.statusEndDate,
     lastChangeDateTime: doc?.lastChangeDateTime,
     licenseURI: doc?.licenseURI,
+    publicAccess: doc?.publicAccess === true ? true : undefined,
   }
 
   const items: Framework['items'] = new Map()
diff --git a/apps/editor/src/ui/editor/reactflow/mapping/toReactFlow.ts b/apps/editor/src/ui/editor/reactflow/mapping/toReactFlow.ts
index b86a027..1cabb68 100644
--- a/apps/editor/src/ui/editor/reactflow/mapping/toReactFlow.ts
+++ b/apps/editor/src/ui/editor/reactflow/mapping/toReactFlow.ts
@@ -107,6 +107,7 @@ function mapDomainFrameworkToCfDocument(framework: Framework): CFDocument {
     lastChangeDateTime: meta.lastChangeDateTime ?? nowIso(),
     CFPackageURI: { uri: `urn:case:package:${id}` },
     licenseURI: meta.licenseURI,
+    publicAccess: meta.publicAccess === true ? true : undefined,
   }
 }
 
diff --git a/apps/editor/src/ui/home/HomeScreen.tsx b/apps/editor/src/ui/home/HomeScreen.tsx
index 0ce0cd1..081e3a7 100644
--- a/apps/editor/src/ui/home/HomeScreen.tsx
+++ b/apps/editor/src/ui/home/HomeScreen.tsx
@@ -838,6 +838,7 @@ export default function HomeScreen({
                         sourcePackageURI={doc.extensions?.['ext:opencase']?.sourcePackageURI}
                         isModifiedFromSource={doc.extensions?.['ext:opencase']?.isModifiedFromSource}
                         readOnly={doc.readOnly === true}
+                        publicAccess={doc.extensions?.['ext:opencase']?.publicAccess === true}
                         rightHint={isArchiving ? 'Archiving' : hint}
                         lastChanged={doc.lastChangeDateTime}
                         onClick={() => openRemote(doc.identifier)}
@@ -904,6 +905,7 @@ export default function HomeScreen({
                         sourcePackageURI={doc.extensions?.['ext:opencase']?.sourcePackageURI}
                         isModifiedFromSource={doc.extensions?.['ext:opencase']?.isModifiedFromSource}
                         readOnly
+                        publicAccess={doc.extensions?.['ext:opencase']?.publicAccess === true}
                         rightHint={isArchiving ? 'Archiving' : hint}
                         lastChanged={doc.lastChangeDateTime}
                         onClick={() => openRemote(doc.identifier)}
@@ -956,6 +958,7 @@ export default function HomeScreen({
                         sourcePackageURI={doc.extensions?.['ext:opencase']?.sourcePackageURI}
                         isModifiedFromSource={doc.extensions?.['ext:opencase']?.isModifiedFromSource}
                         readOnly={doc.readOnly === true}
+                        publicAccess={doc.extensions?.['ext:opencase']?.publicAccess === true}
                         rightHint={isDeleting ? 'Deleting' : (isRestoring ? 'Restoring' : undefined)}
                         lastChanged={doc.lastChangeDateTime}
                         onDelete={tenantId ? () => handleHardDeleteRequest(doc.identifier, title) : undefined}
diff --git a/apps/editor/src/ui/home/frameworkStore.ts b/apps/editor/src/ui/home/frameworkStore.ts
index 7a16e0f..57f8455 100644
--- a/apps/editor/src/ui/home/frameworkStore.ts
+++ b/apps/editor/src/ui/home/frameworkStore.ts
@@ -114,6 +114,7 @@ function createCfDocumentFromFramework(framework: Framework): CFDocument {
     lastChangeDateTime: meta.lastChangeDateTime ?? new Date().toISOString(),
     CFPackageURI: { uri: `urn:case:package:${id}` },
     licenseURI: meta.licenseURI,
+    publicAccess: meta.publicAccess === true ? true : undefined,
   }
 }
 
diff --git a/apps/editor/src/ui/shared/components/FrameworkCard.tsx b/apps/editor/src/ui/shared/components/FrameworkCard.tsx
index 4608927..d3192e6 100644
--- a/apps/editor/src/ui/shared/components/FrameworkCard.tsx
+++ b/apps/editor/src/ui/shared/components/FrameworkCard.tsx
@@ -74,6 +74,8 @@ type Props = {
   isModifiedFromSource?: boolean
   /** Read-only cached remote framework (CGE cache) */
   readOnly?: boolean
+  /** CASE API readable without signing in */
+  publicAccess?: boolean
 }
 
 export function FrameworkCard({
@@ -95,6 +97,7 @@ export function FrameworkCard({
   sourcePackageURI,
   isModifiedFromSource,
   readOnly,
+  publicAccess,
 }: Readonly<Props>) {
   const title = cfDocument.title ?? 'Untitled framework'
   const frameworkType = (cfDocument as { frameworkType?: string }).frameworkType
@@ -218,6 +221,11 @@ export function FrameworkCard({
                 Read-only
               </span>
             ) : null}
+            {publicAccess ? (
+              <span className="rounded-full bg-emerald-100 px-2.5 py-1 text-xs font-semibold text-emerald-800" title="Anyone can read this framework without signing in">
+                Public
+              </span>
+            ) : null}
             {isModifiedFromSource !== undefined ? (
               <span
                 className={cn(
diff --git a/apps/opencase/README.md b/apps/opencase/README.md
index 8bb287e..bad579f 100644
--- a/apps/opencase/README.md
+++ b/apps/opencase/README.md
@@ -47,4 +47,4 @@ Framework data is stored as versioned files rather than in a traditional databas
 | [API Endpoint Reference](FRAMEWORK_MANAGEMENT_GUIDE.md) | Complete endpoint reference for building integrations |
 | [Data Model](docs/DataModel.md) | Official CASE v1.1 data model specification |
 | [REST Bindings](docs/RESTBindings.md) | Official CASE v1.1 REST binding specification |
-| [Licensing](docs/Licensing.md) | Framework-level licensing and public access controls |
+| [Licensing](docs/Licensing.md) | Framework licenses, and a separate public-read switch |
diff --git a/apps/opencase/docs/Licensing.md b/apps/opencase/docs/Licensing.md
index d7da75a..8fc5a7d 100644
--- a/apps/opencase/docs/Licensing.md
+++ b/apps/opencase/docs/Licensing.md
@@ -2,34 +2,26 @@
 
 ## Overview
 
-OpenCASE implements a framework-level licensing system that controls two things:
+A framework has two independent settings:
 
-1. **Rights-to-use** — what consumers of a framework are allowed to do with it.
-2. **Public access** — whether the framework can be read from the CASE Provider API without authentication.
+1. **License** — the legal terms for how the framework may be used. Stored as `licenseURI` on the `CFDocument`.
+2. **Access** — whether the CASE Provider API requires a sign-in to read the framework. Stored as `extensions['ext:opencase'].publicAccess`.
 
-The license is set by the framework author in the CASE Editor and stored as a `licenseURI` on the `CFDocument`. OpenCASE uses the license to decide, at request time, whether an unauthenticated caller can access the framework.
+Sign-in is required unless **Make public** is turned on. Choosing an open license does not make the framework readable without authentication.
 
 ## Available Licenses
 
 Every tenant is seeded with five licenses covering the spectrum from fully open to fully private:
 
-| License | Based On | Public Access? |
-|---|---|---|
-| **Public Domain (CC0 1.0)** | Creative Commons Zero | Yes |
-| **Open — Credit Required (CC BY 4.0)** | Creative Commons Attribution | Yes |
-| **Educational Use (CC BY-NC-SA 4.0)** | Creative Commons Attribution-NonCommercial-ShareAlike | Yes |
-| **View and Share Only (CC BY-NC-ND 4.0)** | Creative Commons Attribution-NonCommercial-NoDerivatives | No |
-| **Private — All Rights Reserved** | Standard copyright | No |
-
-Licenses are stored as `CFLicense` definition records. Each has a stable UUID that is consistent across all tenants.
-
-### What "Public Access" Means
-
-The first three licenses (CC0, CC BY, CC BY-NC-SA) grant **unauthenticated read access** to the framework via the CASE Provider API. Anyone can fetch the CFPackage, CFDocument, CFItems, CFAssociations, etc. without a bearer token.
-
-The remaining two licenses (CC BY-NC-ND and All Rights Reserved) require authentication. Unauthenticated requests receive a `401 Unauthorized` response.
+| License | Based On |
+|---|---|
+| **Public Domain (CC0 1.0)** | Creative Commons Zero |
+| **Open — Credit Required (CC BY 4.0)** | Creative Commons Attribution |
+| **Educational Use (CC BY-NC-SA 4.0)** | Creative Commons Attribution-NonCommercial-ShareAlike |
+| **View and Share Only (CC BY-NC-ND 4.0)** | Creative Commons Attribution-NonCommercial-NoDerivatives |
+| **Private — All Rights Reserved** | Standard copyright |
 
-A framework with **no license set** is treated as private.
+Licenses are stored as `CFLicense` definition records. Each has a stable UUID that is consistent across all tenants. A framework with no license set still has a license of “none”; that does not change who can read it.
 
 ## How It Works
 
@@ -39,9 +31,9 @@ In the CASE Editor, the license is selected on the framework node's side panel:
 
 1. Open a framework in the editor.
 2. Click the framework (root) node.
-3. In the properties panel on the right, find the **License** dropdown.
+3. In the properties panel on the right, find the **License** section.
 4. Select a license. A description of the selected license is shown below the dropdown.
-5. Save or publish the framework.
+5. Save the framework.
 
 The selection is stored as a `licenseURI` on the `CFDocument`:
 
@@ -70,6 +62,30 @@ UI dropdown selection
           → POST to OpenCASE Management API
 ```
 
+### Make public (CASE Editor)
+
+Access is a separate control on the same framework properties panel:
+
+1. Open the framework node.
+2. In **Access**, turn on **Make public**.
+3. Save the framework.
+
+The flag is stored on the document, not on the license:
+
+```json
+{
+  "extensions": {
+    "ext:opencase": {
+      "publicAccess": true
+    }
+  }
+}
+```
+
+Leaving it off (the default) omits the flag. Readers must sign in. Home-screen cards show a **Public** badge after a public framework is saved.
+
+Frameworks that were previously readable because of an open license stay private until **Make public** is turned on and saved.
+
 ### Access Control (OpenCASE API)
 
 The CASE Provider API (`/ims/case/v1p0/*` and `/ims/case/v1p1/*`) uses **optional authentication**. Every request passes through middleware that:
@@ -77,7 +93,7 @@ The CASE Provider API (`/ims/case/v1p0/*` and `/ims/case/v1p1/*`) uses **optiona
 - If a valid bearer token is present: sets `req.isAuthenticated = true` and extracts the `tenantId` from the JWT.
 - If no token (or invalid token): sets `req.isAuthenticated = false` and proceeds without a `tenantId`.
 
-Controllers then check the framework's license before returning data:
+Controllers then check the framework's access flag before returning data:
 
 ```
 Request arrives at GET /ims/case/v1p1/CFPackages/{id}
@@ -85,7 +101,7 @@ Request arrives at GET /ims/case/v1p1/CFPackages/{id}
   → If not found → 404
   → If request is unauthenticated:
       → Check isDocumentPublic(tenantId, version, docId)
-      → If the framework's license is NOT in the public set → 401
+      → If publicAccess is not true → 401
   → If authenticated or public → return the CFPackage
 ```
 
@@ -93,22 +109,20 @@ This check happens on every entity endpoint (CFPackages, CFDocuments, CFItems, C
 
 ### How Public/Private Is Determined
 
-The `FileFrameworkStore` maintains a `licenseIdentifier` in each document's metadata index. When a framework is published, the license identifier from `CFDocument.licenseURI` is stored alongside it.
+When a framework is saved, `FileFrameworkStore` copies `extensions['ext:opencase'].publicAccess` into the document index.
 
-At request time, `isDocumentPublic()` checks if the stored license identifier is in the `PUBLIC_LICENSE_IDS` set:
+At request time, `isDocumentPublic()` is true only when that flag is `true`:
 
 ```
-Public Domain (CC0 1.0)           → public
-Open — Credit Required (CC BY 4.0) → public
-Educational Use (CC BY-NC-SA 4.0)  → public
-View and Share Only (CC BY-NC-ND 4.0) → private (requires auth)
-Private — All Rights Reserved      → private (requires auth)
-No license set                     → private (requires auth)
+Make public on   → readable without signing in
+Make public off  → sign-in required
+No flag set      → sign-in required
+Any license      → does not change the above
 ```
 
 ### Management API
 
-The Management API (`/management/*`) always requires authentication regardless of the framework's license. Licenses only affect the read-only CASE Provider API.
+The Management API (`/management/*`) always requires authentication. **Make public** only affects the read-only CASE Provider API.
 
 ## License in the CFPackage Response
 
@@ -186,8 +200,8 @@ The `licenseText` field contains the human-readable license terms. For Creative
 
 | Action | Result |
 |---|---|
-| Set license to CC0, CC BY, or CC BY-NC-SA | Framework is publicly accessible without auth |
-| Set license to CC BY-NC-ND or All Rights Reserved | Framework requires authentication to read |
-| Set no license | Framework requires authentication to read |
-| Change license and re-publish | Access control updates immediately |
-| Authenticated user | Can always read any framework in their tenant |
+| Leave **Make public** off (default) | Framework requires authentication to read |
+| Turn **Make public** on and save | Framework is readable without signing in |
+| Turn **Make public** off and save | Sign-in is required again |
+| Change the license | Legal terms change; who can read the framework stays the same |
+| Authenticated user | Can read frameworks in their tenant whether or not they are public |
diff --git a/apps/opencase/src/domain/case/seed/defaultLicenses.ts b/apps/opencase/src/domain/case/seed/defaultLicenses.ts
index a23f2fe..8c9e3f0 100644
--- a/apps/opencase/src/domain/case/seed/defaultLicenses.ts
+++ b/apps/opencase/src/domain/case/seed/defaultLicenses.ts
@@ -116,24 +116,6 @@ export const DEFAULT_LICENSES: SeedCFLicense[] = [
   },
 ]
 
-/**
- * License identifiers that grant unauthenticated (public) access
- * to frameworks via the CASE Provider API.
- */
-export const PUBLIC_LICENSE_IDS = new Set([
-  'c0c0c0c0-0000-4000-a000-000000000001', // Public Domain (CC0 1.0)
-  'c0c0c0c0-0000-4000-a000-000000000002', // Open — Credit Required (CC BY 4.0)
-  'c0c0c0c0-0000-4000-a000-000000000003', // Educational Use (CC BY-NC-SA 4.0)
-])
-
-/**
- * Returns true if the given license identifier allows unauthenticated access.
- * No license (undefined) is treated as private.
- */
-export function isPublicLicense (licenseId: string | undefined): boolean {
-  return !!licenseId && PUBLIC_LICENSE_IDS.has(licenseId)
-}
-
 import {
   DEFAULT_CONCEPTS,
   DEFAULT_SUBJECTS,
diff --git a/apps/opencase/src/infrastructure/persistence/file/FileFrameworkStore.ts b/apps/opencase/src/infrastructure/persistence/file/FileFrameworkStore.ts
index d196088..ff5d9b5 100644
--- a/apps/opencase/src/infrastructure/persistence/file/FileFrameworkStore.ts
+++ b/apps/opencase/src/infrastructure/persistence/file/FileFrameworkStore.ts
@@ -2,7 +2,7 @@ import fs from 'node:fs/promises'
 import path from 'node:path'
 import { type CaseVersion, type TenantId } from '../../../domain/case/value-objects/Identifiers'
 import { logger } from '../../logging/Logger'
-import { DEFAULT_LICENSES, isPublicLicense } from '../../../domain/case/seed/defaultLicenses'
+import { DEFAULT_LICENSES } from '../../../domain/case/seed/defaultLicenses'
 import { DEFAULT_CONCEPTS, DEFAULT_SUBJECTS, DEFAULT_ITEM_TYPES, DEFAULT_ASSOCIATION_GROUPINGS } from '../../../domain/case/seed/defaultDefinitions'
 
 export interface FileFrameworkStoreConfig {
@@ -21,7 +21,7 @@ export interface DocumentMetadata {
   lastChangeDateTime: Date
   currentFile: string // relative to tenant/version root
   adoptionStatus?: string // CASE domain field — NOT used for server-level archive filtering
-  licenseIdentifier?: string // UUID of the assigned CFLicense (for public-access checks)
+  licenseIdentifier?: string // UUID of the assigned CFLicense
   /** Server-level archive flag — independent of CASE adoptionStatus */
   archived?: boolean
   /** When true, framework is a cached remote reference and cannot be mutated. */
@@ -59,6 +59,14 @@ export function getOpenCaseSourcePackageURI (meta: DocumentMetadata | undefined
   return typeof v === 'string' ? v : undefined
 }
 
+/**
+ * True when the CASE Provider API should serve this framework without authentication.
+ * Absent or false means sign-in is required. Independent of the framework's license.
+ */
+export function getOpenCasePublicAccess (meta: DocumentMetadata | undefined | null): boolean {
+  return meta?.openCaseExtensions?.publicAccess === true
+}
+
 export interface DocumentVersionInfo {
   file: string
   lastChangeDateTime: Date
@@ -889,13 +897,13 @@ export class FileFrameworkStore {
   }
 
   /**
-   * Returns true if the framework has a license that allows unauthenticated access.
-   * Frameworks with no license or a private license return false.
+   * Returns true when the framework is explicitly marked public.
+   * Sign-in is required unless `publicAccess` is true — license does not affect this.
    */
   isDocumentPublic (tenantId: TenantId, version: CaseVersion, storageKey: string): boolean {
     const meta = this.getDocumentMetadata(tenantId, version, storageKey)
     if (!meta) return false
-    return isPublicLicense(meta.licenseIdentifier)
+    return getOpenCasePublicAccess(meta)
   }
 
   itemExists (tenantId: TenantId, version: CaseVersion, itemId: string): boolean {
@@ -1070,12 +1078,12 @@ export class FileFrameworkStore {
   }
 
   /**
-   * Check whether a globally-unique document ID has a public license, searching all tenants.
+   * Check whether a globally-unique document ID is marked public, searching all tenants.
    */
   isDocumentPublicGlobal (docId: string): boolean {
     const resolved = this.resolveDocumentGlobal(docId)
     if (!resolved) return false
-    return isPublicLicense(resolved.metadata.licenseIdentifier)
+    return getOpenCasePublicAccess(resolved.metadata)
   }
 
   // Public methods for index management (used by management endpoints)
diff --git a/apps/opencase/src/infrastructure/persistence/file/__tests__/FileFrameworkStore.publicAccess.test.ts b/apps/opencase/src/infrastructure/persistence/file/__tests__/FileFrameworkStore.publicAccess.test.ts
new file mode 100644
index 0000000..62bcec0
--- /dev/null
+++ b/apps/opencase/src/infrastructure/persistence/file/__tests__/FileFrameworkStore.publicAccess.test.ts
@@ -0,0 +1,53 @@
+import { FileFrameworkStore } from '../FileFrameworkStore'
+
+describe('FileFrameworkStore — public access is independent of license', () => {
+  const tenantId = 'test-tenant'
+  const version = '1.1' as const
+  const publicLicenseId = 'c0c0c0c0-0000-4000-a000-000000000001'
+
+  const doc = (identifier: string, extra: Record<string, unknown> = {}) => ({
+    sourcedId: identifier,
+    title: 'A framework',
+    lastChangeDateTime: '2024-01-01T00:00:00Z',
+    ...extra,
+  })
+
+  function index (store: FileFrameworkStore, storageKey: string, document: Record<string, unknown>) {
+    const updateDocIndex = (store as unknown as {
+      updateInMemoryDocumentIndex: (...args: unknown[]) => void
+    }).updateInMemoryDocumentIndex.bind(store)
+    updateDocIndex(tenantId, version, storageKey, document, `frameworks/${storageKey}/v1.json`)
+  }
+
+  it('requires authentication unless publicAccess is explicitly true', () => {
+    const store = new FileFrameworkStore({ baseDataDir: '/tmp' })
+
+    index(store, 'storage-licensed', doc('doc-licensed', {
+      licenseURI: { identifier: publicLicenseId, uri: '/licenses/cc0', title: 'CC0' },
+    }))
+    index(store, 'storage-public', doc('doc-public', {
+      licenseURI: { identifier: 'c0c0c0c0-0000-4000-a000-000000000005', uri: '/licenses/private', title: 'All rights reserved' },
+      extensions: { 'ext:opencase': { publicAccess: true } },
+    }))
+    index(store, 'storage-private', doc('doc-private'))
+
+    expect(store.isDocumentPublic(tenantId, version, 'storage-licensed')).toBe(false)
+    expect(store.isDocumentPublic(tenantId, version, 'storage-public')).toBe(true)
+    expect(store.isDocumentPublic(tenantId, version, 'storage-private')).toBe(false)
+    expect(store.isDocumentPublicGlobal('doc-licensed')).toBe(false)
+    expect(store.isDocumentPublicGlobal('doc-public')).toBe(true)
+  })
+
+  it('clears public access when a later save omits the flag', () => {
+    const store = new FileFrameworkStore({ baseDataDir: '/tmp' })
+    index(store, 'storage-a', doc('doc-a', {
+      extensions: { 'ext:opencase': { publicAccess: true } },
+    }))
+    expect(store.isDocumentPublic(tenantId, version, 'storage-a')).toBe(true)
+
+    index(store, 'storage-a', doc('doc-a', {
+      extensions: { 'ext:opencase': { sourcePackageURI: 'https://example.test/pkg' } },
+    }))
+    expect(store.isDocumentPublic(tenantId, version, 'storage-a')).toBe(false)
+  })
+})
diff --git a/apps/opencase/src/interfaces/http/server.ts b/apps/opencase/src/interfaces/http/server.ts
index 7d6bb05..314c376 100644
--- a/apps/opencase/src/interfaces/http/server.ts
+++ b/apps/opencase/src/interfaces/http/server.ts
@@ -37,7 +37,7 @@ export function createServer (container: Container): express.Express {
     tenantLookupController: container.controllers.public.tenantLookup
   })
 
-  // CASE Provider API — optional auth (public-licensed frameworks accessible without auth)
+  // CASE Provider API — optional auth (frameworks marked public are readable without auth)
   // IDs are globally unique so no tenantId is needed for read endpoints.
   const optionalAuthMiddleware = makeOptionalAuthMiddleware(container.jwtVerifier)
   app.use('/ims/case', optionalAuthMiddleware)