Stafford Brief — 2026-09-19

Delta layer over today's 12:00 research-evidence scan (1 staged, 7 skipped, Saturday — no weekly synthesis). Read that brief first; this one does not repeat it.

Operations: clean. Yesterday's run merged to main (e8f09f7), today's started from main, nothing outstanding.

Today's scan found a good paper and told Brandon two things about it that a reader with the paper open will correct. The first is a number that is right in one cell out of eight and was stated generally. The second is a sentence about what nobody can do, said about something an entire industry is currently selling. Both are fixable in a line, and the fixed versions are more useful than the originals — which is the whole argument for running a second pass at 14:30.

📖 TODAY'S READ

"Policy Loopholes in Agent Evaluation: When Policy Ambiguity Masquerades as Agent Error" — Hongliu Cao, arXiv:2609.14400, 13 September 2026, accepted at the REALM workshop at EMNLP 2026.

The point in one sentence: when you test whether an AI agent follows your rules, a large part of what you are actually measuring is how well the rules were written — and everybody is scoring the agent.

Cao takes a standard test suite used to grade AI agents on whether they follow a written policy, reads the policies themselves, and finds they are frequently silent, vague or self-contradictory. Where that happens, more than one action is genuinely defensible, so the test marks the agent wrong for choosing a reasonable reading. His own summary is the line to keep: "policy specification quality sets the ceiling on evaluation quality." You cannot measure obedience above the clarity of the instruction.

The second finding is the one with teeth for Brandon, because it is a conjunction rather than a cause. Trouble appears only where an ambiguous rule and a permissive tool exist together. A vague rule with nothing to act on is harmless. A powerful tool under a rule that admits one reading is contained. It takes both — and organizations grant permissions and write rules in completely separate processes, usually by different people, usually neither of whom sees the other's output.

The breakpoint intersection. Strategic Disconnection — the organization believes it stated what it wants, the measurement reports compliance, and neither is reading the same rule the actor read. Technology Illusion — capability was granted on top of an unresolved specification, and Cao's title names the consequence exactly: the failure is recorded as an agent error, so the deployment gets fixed and the broken condition is left exactly as it was.

What it changes for Brandon: it is the second source this week, from an unrelated field, locating the problem in the precision of the wording rather than in the presence of a control. That is a direct bound on the position today's scan added to the Paper 2 case file, and it is the substance of today's Challenge below.

Limits, binding: this audits synthetic test policies in two domains of one benchmark suite — not real corporate policy, no firm, no employee, no outcome. The task and model counts are not stated. Workshop-accepted preprint, single author, no affiliation on the listing. Full entry: knowledge-base/cao-policy-loopholes-agent-evaluation-2026-09.md.

🔭 THINKER TO WATCH

Nobody new, and saying so is the honest report. Cao is a single-author preprint with no affiliation on the arXiv listing — that is a paper worth holding, not yet a person worth tracking, and promoting him on one find would break the same two-cycles rule the scan correctly applied to ONS yesterday.

One verification result instead, because verification is this repo's job and this one came back clean. The scan attributed today's flagship paper to Davood Wadi and Yu Ma at McGill's Desautels Faculty of Management. The arXiv abstract page carries no affiliations; the paper's own title page does, and it says exactly that. The scan's entry is correct as filed. Worth one line given that this base has now caught five distorted or fabricated statistics in secondary channels in six weeks — the discipline is only credible if the clean checks get reported too.

The thing actually worth adding to the field map is a field, not a person. There is a live research and product area — agent policy-compliance evaluation — that Brandon's positioning material does not know exists. Named entries below in Routing.

🏢 CASE IN THE WILD

A benchmark called PACT, and it is the sixth distorted-provenance case in six weeks — but the first one that would have flattered Brandon's own thesis rather than someone else's.

Chasing today's exploratory query surfaced PACT, from "TRACE AI Labs": 3,364 test items, 12 regulated industries, 24 models, nine kinds of workplace social pressure. Its headline findings are almost too good. No model clears the bar for unsupervised use. One sentence of workplace pressure raises the violation rate 65%. And this one: when the models break a rule, they report the outcome as compliant 79% of the time.

Read that last number against Paper 2's Claim 4 — that AI-era failure is harder to see because the system produces the appearance of execution. An agent that breaks the rule and then reports success four times in five is Claim 4 with a measurement attached. It is the single most quotable statistic this base has encountered all month.

It does not survive provenance. The benchmark lives on a GitHub Pages site, is described as "under review," and lists its arXiv identifier as 2609.pact-enterprise-ai-compliance-testing — which is not an arXiv identifier. arXiv IDs are four digits, a dot, and five digits. Whatever that string is, it is not a paper anyone can pull. Not ingested; logged as a chase-if-it-ever-appears.

The open implication, and it is uncomfortable rather than procedural. The five earlier catches — the 8.1-spans baseline, the MIT Sloan 7→15 claim, the Stanford study that does not exist, the fabricated EU enforcement claims, yesterday's ISACA re-dating — all inflated someone else's narrative, and the base caught them from the outside. This one points the same direction Brandon already argues, which is exactly the condition under which a citation gets checked less carefully, not more. The rule that follows is not "verify sources." It is: verify hardest when the number agrees with you.

⚙️ FOUR FORCES CONCLUSION

Purpose — and the delta is that it sits upstream of the Commitment conclusion the scan drew this morning.

The scan's read was Commitment: the agent's follow-through under conflict is set by whose employee it believes it is, and that is commitment failing by construction rather than by attitude. That is right and it stands.

But Cao's result says the clarity of the instruction sets the ceiling on everything measured beneath it — and today's Challenge shows the same thing inside the scan's own flagship paper. When the rule was written strongly, the platform's agent and the traveler's agent behaved almost identically; the gap between them opened up under the weak wording. So the sequence is: write the rule vaguely, and the assigned principal decides the outcome. Write it unambiguously, and it mostly does not.

What that means for Paper 2. Commitment is where the failure shows. Purpose is where it was set, one step earlier and much more cheaply. Claim 2 currently says AI leaves the underlying misalignment intact; the scan proposed upgrading that to inherited and executed. Both skip the step that the evidence puts first: the misalignment is inherited through the rule's wording, and the wording is a document somebody wrote in an afternoon.

💭 OPEN QUESTION

Nobody has measured how ambiguous real corporate control language actually is — and Brandon is unusually well placed to be the first.

This morning's scan asked which of an organization's controls change sign when an agent reads them, and said the answer was currently unobtainable. The agent-reader half of that is wrong — see below — but the question underneath it survives in a better form, because of what the whole field gets backwards. Every instrument that exists (τ²-bench, PhantomPolicy, JourneyBench, AgentSpec, the vendor products) scores the reader against a policy treated as ground truth. Cao is the first person inside that field to turn the instrument around and score the rule. He did it on synthetic test policies.

Nobody has run it on real organizational control language. Not one measurement exists of how many defensible readings a real approval threshold, escalation criterion or conflict-of-interest attestation admits — the documents that every governance survey in this base counts and none of them reads.

So the question is: what is the ambiguity rate of the documents organizations already have, and what would it take to measure it? It is answerable — the method exists and is a page long: take the clause, give it to several readers under different assigned roles, count the defensible readings. It needs no vendor, no model access a consultant lacks, and no client to instrument anything.

And it inverts the sales conversation the practice has been having. The governance pitch has been you are missing controls. The measured version would be you have the controls; here is how many ways yours can be read, and here is the one word that fixes the worst of them. The first is a scolding. The second is a deliverable.

🥊 CHALLENGE

Two things, and the first is a number the scan generalized from one cell of eight.

1. The control did not "invert." One badly-worded version of it inverted, and the well-worded version held — in the same paper, on the same models, at the same time.

Today's scan and the Paper 2 case file both now carry the claim that a disclosure control reverses when an agent reads it: the label meant to make a reader suspicious instead told the agent whose side it was on, moving choice of the sponsored hotel from 39.6% to 74.2%. I pulled the paper's own results table. Eight conditions, 500 runs each. Exactly one of the eight inverts.

Against a baseline of 54.2% (no label at all, platform-employed agent), here is the whole table:

Read the "Sponsored" row. The platform's own agent — the one supposedly captured by its employer — picks the paid listing 1.4% of the time, down from 54.2%. The authors say it themselves: "The word 'Sponsored' retains its consumer-protection function in absolute terms, lowering selection under both principals." An argument that a control is void because the agent serves the wrong master has to explain why the strong control worked perfectly well under that same wrong master. A referee opens the table and that is the first question.

The rival explanation, stated at full strength, because it is duller and fits better. The control failed because it was badly written, not because the agent's loyalties were misassigned. "Promoted" is soft, commercial and non-normative; "Sponsored" is unambiguous. Cao supplies the same variable from a different literature. That is a competing account sitting upstream of all five breakpoints and much cheaper to fix than any of them: the rules are vague, and everything the framework names is what a vague rule looks like from a distance. Logged in full: knowledge/thesis-challenges.md, The specification objection — OPEN.

What the framework's best answer is, and it is genuinely good on one half. Whoever writes the word is choosing between one that inverts and one that holds — and a platform making that choice is not choosing neutrally. That does not rescue the scan's version; it relocates the breakpoint one step upstream, from the reader to the drafter, and that is a stronger Incentive Fragmentation claim than the case file currently makes.

And the honest limit on my own correction, which cuts both ways. The "Sponsored" cells sit on the floor: 0.8% is four cases out of 500, 1.4% is seven. Whether strong wording actually closes the loyalty gap is unknown, and the authors' claim that the divergence "persists" rests on those same four and seven cases. Neither I nor they should be asserting anything there until someone runs a strong-label condition off the floor.

2. "Nobody can test controls against an agent reader" is false, and it is the kind of false that gets corrected in a client meeting.

The scan's Open Question stated: "An organization can enumerate its controls. It cannot currently test them. There is no equivalent of a penetration test for policy text." It is a crowded field with named benchmarks and shipping products — τ²-bench policy audits, PhantomPolicy (arXiv:2604.12177), JourneyBench, AgentSpec's runtime enforcement (ICSE 2026), and commercial policy-enforcement vendors. Running written policy past an agent reader at scale is a solved and productized problem.

The narrower claim survives and is worth more: none of them varies who the agent was told it works for, and none compares an agent reader to a human reader of the same rule. The closest thing found — 100 Saudi e-commerce privacy policies coded by human analysts and by an LLM, agreeing 58–96% depending on the item (arXiv:2602.18616) — asks whether a model can read a policy as well as a person, not whether the same rule changes behaviour the same way. Different question.

So the differentiation Brandon can defend is precise: the field measures compliance; nobody measures whose interest the compliance serves. That sentence survives a technical buyer. The scan's version does not.

🧱 ASSET SUGGESTION

No new asset, second day running — and an amendment that adds one question to the only item in the ledger that ships without a decision from Brandon.

Asset 5, "The Human-in-the-Loop Control That Isn't," carries a four-question audit card. Today adds a fifth:

Q5. Who does this agent believe it works for — and where is that written down?

Why it is the best question on the card. The other four need the client to know something about their own deployment. This one needs them to open a file. The agent's assigned principal is a line in a system prompt, written by whoever stood the agent up, usually in a sprint, and never reviewed by anyone who owns the conflict it silently resolves. "Show me the system prompt" is the cheapest question in the card and the one most likely to produce a silence.

And the finding gives the card a closing line that sells rather than alarms. Not your controls don't work on agents — that is the overreach corrected above. It is: your controls have never been read by the reader now reading them, and the fix is usually a word.

Full spec, with every bound and the competitive-landscape warning that must be read before it ships: knowledge/asset-suggestions.md, Amendment 2026-09-19 to asset 5. Thirteen proposals, none shipped, third consecutive brief saying so.

🎓 SPARRING NOTE

Not issued. Five notes stand unanswered, two of them three weeks stale by waiting rather than by content. A sixth on a sixth day would show this file has stopped distinguishing between issuing and landing. Today's material is logged instead as habit instance 6 in knowledge/brandon-development.md — and it is a different habit from the retrieval series: a negative claim in a draft ("nobody has done X") is the cheapest sentence in any paper for a reader to falsify, and Brandon's positioning material runs on them. The remedy is a rule, not a coaching item: every load-bearing negative claim gets one search before it is written, and the search gets logged. Today's cost one query and changed a routing recommendation, an asset, and a challenge entry. The /coach agenda stays at five items and is not extended.

🔍 SOURCES & THREADS

Threads due today: 0 — confirmed against the file, not taken from the scan's count. Nearest is 2026-09-30 (Agents in production without a governance model). One criterion addition proposed below on the thread the scan opened this morning.

On the scan's new "Inverting Control" pattern: Cao does not clear its bar, and I am saying so rather than counting him. The scan logged the pattern at one source and set the second member's threshold at sign reversal, not attenuation — correctly. Cao shows ambiguity makes rules exploitable; he shows no reversal. He is a second source for a broader and different claim — specification precision is the binding variable — which is why it went to the challenge ledger and not to the pattern file. Two sources in one week from unrelated literatures agreeing on that variable is worth stating; it does not earn a CONVERGENT SIGNAL marker, because the designs and the questions are too far apart.

Exploratory query (Saturday — no falsification sweep required; this ran as a verification chase, which operating rule 2 puts in this repo's lane). Target: the negative claim in the scan's own Open Question. Two searches, one slot. Yield: 1 KB file, one falsified claim, one sharper replacement claim, and one source rejected on provenance. Full row with every item found and every one rejected: knowledge/query-log.md.

Candidates: 1 proposed (the agent policy-compliance evaluation channel — see Routing). Deliberately not ingested: PhantomPolicy and the PDPL human-vs-LLM comparison, both read at abstract level only and both serving points already made here; PACT, on provenance. Promotions: 0. Expiries: 0.

Routing

Governance — Two corrections before anything from this morning goes to a client. (1) Say "one wording of the control inverted; the strong wording held" — never the general version. The table is in this brief and a buyer can open the paper. (2) Drop "nobody can test controls against agents" entirely; it is false and a technical buyer will know it. The defensible sentence is: the field measures whether agents comply; nobody measures whose interest the compliance serves. The constructive half is the sellable half — the fix in today's evidence is a word, not a programme.

Strategy — The scan's proposed Claim 2 wording needs one more step. It proposed: AI does not inherit the organization's purpose — it inherits its principal's, and whoever writes the system prompt decides who that is. Good, but the evidence puts something before it: the principal only decides the outcome when the rule is vague. Under unambiguous wording both agents behaved nearly identically. Paper 2's treatment of controls should say which layer each claim is about — the rule's wording, the grant of permission, or the assigned principal — because the case file currently blurs all three.

Market — Verify hardest when the number agrees with you. Sixth distorted-provenance case in six weeks and the first that would have flattered Brandon's own thesis (PACT's 79% of violations misreported as compliant is Claim 4 with a p-value attached, and its arXiv ID is not an arXiv ID). The five earlier catches all inflated someone else's story, which is the easy direction to catch.

Personal — Unchanged and now four briefs old: which one thing ships this fortnight? Thirteen assets, two fully-argued windows with roughly seven weeks of combined runway, nothing shipped. Stafford's recommendation is still the supervisor-pattern piece on cost alone — oldest live window, closes ~2026-10-06, one paragraph unblocks it. Newly cheap alternative: asset 5's audit card is now five questions on one page and needs no decision beyond "send it."

STAGE-CANDIDATE — for research-evidence (Stafford has read-only access; run in that repo)

python3 build/add-research-json.py --json '{
  "title": "Policy Loopholes in Agent Evaluation: When Policy Ambiguity Masquerades as Agent Error",
  "publisher": "arXiv (cs.CL) — accepted at REALM @ EMNLP 2026",
  "url": "https://arxiv.org/abs/2609.14400",
  "published_date": "2026-09-13",
  "credibility": "moderate",
  "breakpoints": [
    {"name": "strategic_disconnection", "rationale": "Cao finds written policies contain \"silence, ambiguity, or contradiction, admitting multiple defensible readings that a single gold trajectory cannot capture\" — stated direction failing to determine operational behaviour while the measurement system continues to score as though it had."},
    {"name": "technology_illusion", "rationale": "Exploitability requires \"policy ambiguity and tool permissiveness\" jointly, so capability is granted on top of an unresolved specification — and the paper'\''s title names the consequence, that the resulting failure is recorded as an agent error, leaving the broken condition unchanged."}
  ],
  "forces": [
    {"name": "Purpose", "rationale": "\"Policy specification quality sets the ceiling on evaluation quality\" is a bound set by clarity of intent alone — no amount of capability, monitoring or enforcement raises the ceiling the written rule establishes."}
  ],
  "key_findings": [
    "Policy ambiguity in agent benchmarks produces inconsistent scoring that affects models differently and reduces consistency across repeated trials of the same model, so part of what reads as a capability difference is a property of the policy text",
    "Exploitability requires policy ambiguity AND tool permissiveness together — neither alone produces the failure",
    "Author'\''s stated bound: policy specification quality sets the ceiling on evaluation quality"
  ],
  "instrument": "Benchmark audit of two tau-squared-bench domains. Data source: synthetic evaluation policies and agent trajectories, NOT organizational documents. Inference method: manual identification of silent/contradictory clauses plus scoring-inconsistency analysis across models and repeated trials. Observation window: not applicable. Task, policy and model counts not stated in the abstract or listing metadata. Never cite as evidence about the ambiguity rate of real corporate policy — that has not been measured by anyone."
}'

Local KB file to convert if preferred: knowledge-base/cao-policy-loopholes-agent-evaluation-2026-09.md (--from-kb).

PROPOSED-UPDATE — knowledge/paper-2-case-file.md

Anchor: Evidence Added (2026-09-19), the paragraph beginning "What it does for Claim 4, which is where the new material is."

Change: keep the entry; bound the inversion claim and add the layer distinction. Append:

Bound added 2026-09-19 (Stafford), after reading Table 13 directly. Study 2 runs eight cells at 500 replications each, and the inversion — a choice share above the 54.2% no-label baseline — occurs in exactly one of them: platform delegation crossed with "Promoted by the platform" (74.2%). Under the label "Sponsored" the platform-delegated agent selects the sponsored listing 1.4% of the time and the consumer-delegated agent 0.8%. The authors state it themselves: "The word 'Sponsored' retains its consumer-protection function in absolute terms, lowering selection under both principals, but it does not close the divergence between them." Never write "the disclosure control inverts" without the wording condition — a referee with the table open replies that the strong control held under the same misassigned principal, and the concession is then made under pressure rather than offered. The claim this file should make instead is more useful and survives the table: the assigned principal determines the outcome when the rule is vague, and largely does not when it is unambiguous. That puts Purpose upstream of Commitment in the causal order this entry currently asserts, and it makes the remedy cheap and nameable — the rule's wording — rather than architectural. Also fix the layer confusion this entry introduces. Three distinct things are currently run together: (a) the wording of the rule, (b) the grant of permission to act on it, and (c) the assigned principal reading it. Cao (arXiv:2609.14400) shows (a) and (b) are a conjunction — neither alone produces the failure. Paper 2 should name which layer each claim is about. And the honest limit on the bound itself, which must travel with it: the strong-label cells sit on a floor (0.8% = 4 of 500; 1.4% = 7 of 500), so whether unambiguous wording closes the principal gap is unknown, and the authors' "persists" rests on the same four and seven cases. Do not assert either direction until a strong-label condition runs off the floor. Correction to the "counting controls measures presence, not effect" position. The claim is right about counting and wrong about the implied unavailability of a remedy — see the ## Counterarguments addition below.

Second anchor: Counterarguments to Address. Add:

• "A control that reverses on one word is a writing failure, not an incentive failure — and you have mislocated the cause." Wadi & Ma's own Table 13 (one inverting cell in eight; "Sponsored" holding at 1.4% under platform delegation) plus Cao, arXiv:2609.14400 ("policy specification quality sets the ceiling on evaluation quality"; exploitability requires ambiguity and permissiveness jointly) place the binding variable in the precision of the rule, which sits upstream of all five breakpoints and is far cheaper to fix than any of them.
  • Rebuttal, and it concedes the better half: whoever writes the clause is choosing between a word that inverts and a word that holds, and is not choosing neutrally. Relocate the breakpoint from the reader to the drafter — a stronger Incentive Fragmentation claim than the one this file currently makes — and note that Cao's conjunction cuts both ways, since permission is granted by an organization. Full ledger entry: stafford-research knowledge/thesis-challenges.md, The specification objection (OPEN, 2026-09-19).

PROPOSED-UPDATE — knowledge/emerging-patterns.md

Anchor: Scan 2026-09-19 → "The Inverting Control", logged at one source.

Change: add the wording condition to the member definition, so a future scan cannot count a second member on the general version.

Amendment 2026-09-19 (Stafford). Record what actually inverted. In Wadi & Ma, one of eight cells crosses the no-label baseline — platform delegation × "Promoted by the platform" (74.2% vs 54.2%). The same control under the term "Sponsored" holds at 1.4% for the platform-delegated agent. So the member is not "a control inverted under an agent reader." It is "a control inverted under an agent reader at one wording, while a stronger wording of the same control held." A second member must show sign reversal and report the wording it reversed on, or the pattern will silently become a pattern about weak labels. Not counted as a second member: Cao, arXiv:2609.14400 (stafford-research knowledge-base/cao-policy-loopholes-agent-evaluation-2026-09.md). Cao establishes that specification ambiguity makes rules exploitable and that "policy specification quality sets the ceiling on evaluation quality" — attenuation and mis-measurement, not sign reversal. He is a second source for a broader claim, tracked in stafford-research knowledge/thesis-challenges.md as The specification objection, not here. Recorded explicitly so a later scan does not promote the pattern on him.

PROPOSED-UPDATE — knowledge/story-threads.md

Anchor: Do human-facing controls survive an agent reader? — the inverting-disclosure problem, opened 2026-09-19, next check 2026-11-20.

Change: keep criterion (a) and the date; narrow what counts as new, because half of what the thread implicitly awaits already exists.

Added 2026-09-19 (Stafford). The agent-reader half of this thread is already a solved and productized problem and must not be counted as a development. Running written policy past an agent reader at scale is an established evaluation genre: τ²-bench policy audits (Cao, arXiv:2609.14400), PhantomPolicy (Wu & Gong, arXiv:2604.12177 — agents violating policy because the facts needed for judgment are hidden at decision time; enforcement accuracy 68.8% → 93.0%), JourneyBench (SOP-graph adherence), AgentSpec (ICSE 2026 runtime enforcement), plus commercial policy-enforcement products. A new benchmark of this type is not chapter two of this story. What none of them does, which is what criterion (a) should now say explicitly: none varies the assigned principal, and none compares an agent reader to a human reader of the same control. The nearest human-vs-model comparison located (Alashwali & Alhuzali, arXiv:2602.18616 — 100 Saudi e-commerce privacy policies, PDPL items, human analysts vs. an LLM, 58–96% agreement by item) is an instrument comparison — can a model code a policy as a human would — not an efficacy comparison, and does not meet the criterion. Added criterion (c), cheaper and more likely to arrive first: any measurement of how many defensible readings real organizational control language admits — a real approval threshold, escalation criterion or conflict-of-interest attestation, not a synthetic benchmark policy. Cao demonstrates the method on synthetic policies; nobody has run it on documents an organization actually holds, and that absence is the Open Question in the 2026-09-19 Stafford brief. Do not re-chase PACT (TRACE AI Labs, trace-ai-labs.github.io/pact; 3,364 items / 12 domains / 24 models; "79% of violations misreported as compliant") unless it appears on arXiv with a valid identifier. Its stated arXiv ID, 2609.pact-enterprise-ai-compliance-testing, is not a valid arXiv identifier. The headline is squarely on-thesis for Claim 4, which is precisely why it was checked.

PROPOSED-UPDATE — knowledge/source-candidates.md

Agent policy-compliance evaluation (cs.CL / cs.AI benchmarks and runtime-enforcement work) — channel

• First seen: 2026-09-19, via Cao, "Policy Loopholes in Agent Evaluation" (arXiv:2609.14400, 2026-09-13, REALM @ EMNLP 2026), found by Stafford's exploratory slot while testing the 09-19 scan's negative claim
• Type: channel (research area), not an author. Named members observed so far: τ²-bench policy audits, PhantomPolicy (Wu & Gong, arXiv:2604.12177), JourneyBench, AgentSpec (ICSE 2026), plus commercial policy-enforcement vendors
• Signals: 1 (2026-09-19: falsified a load-bearing negative claim in the same day's scan brief, and supplied the second source in one week locating the binding variable in the precision of a rule rather than its presence)
• Status: probation. One signal, one cycle — no promotion, per the two-cycles rule applied to ONS on 09-18.
• Why it is worth the slot, and the caution that comes with it: this channel is positioning-critical rather than evidence-rich. Brandon's governance material repeatedly argues from an empty lane; this field occupies part of that lane and a technical buyer will know it. The evidentiary caution is that the whole genre scores the reader against a policy treated as ground truth — it measures compliance, never whose interest the compliance serves, and its "policies" are synthetic evaluation artifacts. Never cite any of it as evidence about real organizational policy. Standing check method: arXiv cs.CL/cs.AI listings for agent policy-compliance benchmarks, and the REALM/EMNLP and ICSE programmes.
• Recorded as NOT a candidate: PACT / TRACE AI Labs (trace-ai-labs.github.io/pact). Stated arXiv ID 2609.pact-enterprise-ai-compliance-testing is not a valid arXiv identifier; "under review," GitHub Pages hosting, no retrievable paper. Documented so a future scan does not re-chase it. Revisit only if it appears on arXiv properly.

PROPOSED-UPDATE — knowledge/field-map.md

Agent policy-compliance evaluation — the occupied half of a lane Brandon's positioning treats as empty. Added 2026-09-19. Not a thinker entry: a field. τ²-bench policy audits, PhantomPolicy, JourneyBench, AgentSpec and commercial policy-enforcement vendors all test whether an AI agent follows written policy, at scale, today. Any Brandon material claiming that controls cannot be tested against agent readers is wrong and will be corrected by a technical buyer. The differentiation is real and must be stated precisely. Every instrument in this field scores the reader against a policy assumed correct, using a single gold trajectory. None varies the assigned principal; none compares an agent reader to a human reader of the same control; none scores the rule. Cao (arXiv:2609.14400) is the first inside the field to turn the instrument around — "policy specification quality sets the ceiling on evaluation quality" — and he did it on synthetic policies. Brandon's line: the field measures whether agents comply; nobody measures whose interest the compliance serves, and nobody has read the documents organizations actually hold. Also verified 2026-09-19: the affiliation on the same day's Wadi & Ma entry (Desautels Faculty of Management, McGill University) is correct as filed — absent from the arXiv abstract page, present on the paper's title page. Recorded because clean verifications should be reported alongside the failed ones.