Stafford

← 2026-09-27 · all briefs · 2026-09-29 →

Stafford Brief — 2026-09-28

Monday. Delta layer on the 12:00 UTC scan (2 staged, 9 skipped) — read that brief first; this one does not repeat it. No OPS flag: yesterday's run merged clean.

One thing today, and it is a correction to the scan's headline finding rather than an addition to it.

The scan opened a new two-source pattern this morning — The Certified Perimeter — on the claim that the organizational preconditions for deploying AI agents are "specified by the field's highest-credibility body and assured by nobody." Four separate times in its own brief it recorded that it had not read the requirement pages the claim depends on, and said plainly that the Accountability domain's literal text "should be read before any of this is said in public."

I read them. Two of the claim's three legs do not survive it, and the leg that does makes Brandon's argument better. The standard does contain a requirement naming accountable owners inside the deploying organization. The deploying organization is invited to be certified. What is actually true is narrower, more interesting, and much harder to rebut: the market can specify and audit named accountability, and it sells that audit one product at a time. Then a second search found the objection that would have ended the pattern in public — an accredited, organization-scoped AI certification that covers deployers has existed since 2023, and AIUC-1 crosswalks to it. The scan quoted that crosswalk and did not follow it.

📖 TODAY'S READ

The requirement Brandon's framework says organizations lack has been written down, numbered, and audited every quarter for months. It is just sold to the wrong party.

AIUC-1 Standard, domain E (Accountability) — requirement text at standard.aiuc-1.com/accountability; eligibility and scope at standard.aiuc-1.com/aiuc-1-certification. Read first-hand today. File: knowledge-base/aiuc-1-accountability-requirements-deployer-scope-2026-q3.md.

What the requirements actually say, quoted, because the whole day turns on four sentences.

In plain terms: write down, before anything goes wrong, who owns it when it does — separately for each kind of failure — and write down who signs off on changes. That is not adjacent to Brandon's argument. That is his argument, in an auditor's numbering, backed by an insurer, re-evidenced every three months.

Correction one to the scan. It wrote that "no requirement visible on the published scope names a role inside the deploying customer organization that must own a deployed agent." E001–E003 name owners per failure class. E004 names them explicitly "across the development & deployment lifecycle" — deployment is in the requirement's own words.

Correction two. It wrote that the deploying enterprise "is not a party that is audited." The standard's own eligibility text: "Organizations should pursue AIUC-1 certification if they are: 1. Adopting or developing agentic AI systems built on generative models." Criterion three names the audience as "potential enterprise customers, internal executives or board members" — internal governance, not just procurement. Adopters are invited in by name.

What survives, and it is one sentence from the same page. Certification scope is "typically limited to specific product(s), not the full organization's products and practices." So the accountable owners are owners for one shipped product's failure modes, not for the organization's agent estate. The scan's conclusion — the assured unit is the agent, not the organization — holds. Its three reasons for it were wrong, right and unstated respectively, and the real reason is scope.

Why this matters more than a tidy-up, and it is the sentence to keep: the scan closed by asking whether organizational accountability goes unassured because it is unmeasurable or because it is uninsurable, and set the deciding test at the standard's January refresh. It doesn't need to wait. E001–E004 are the instrument, in the market, audited today. The "nobody knows how to measure this" branch is dead. Nobody has pointed the instrument at a whole organization instead of one product — which is a question about who buys, not about what can be measured. Brandon's lead time is shorter than the January framing implies, and what he has been calling an unmeasured gap is a purchased-by-nobody gap.

Bounds, both binding. AIUC is a venture-funded startup selling both the certificate and the insurance, not a high-credibility publisher — confidence moderate, and its framing of agent risk as a vendor-certifiable property is not independent of its business model. And standard.aiuc-1.com/evidence truncated after the A and B series, so what an auditor accepts as proof of an "accountable owner" is unknown: ask a client for the document, never claim to know the audit bar. published_date is null — the page's "Last Updated" equals today, which is the exact shape of the failure that damaged 241 entries.

🔭 THINKER TO WATCH

Schellman — and this is a firm rather than a person, which is the reason to watch it.

Schellman is an accredited certification body. Two facts about it, from opposite sides of today's finding: it is AIUC-1's first authorized auditor (confirmed first-hand by the scan, AIUC's own post dated 2026-02-03, audits covering "250+ pieces of evidence and 2,000+ adversarial scenarios"), and it is also an ISO/IEC 42001 certification body, publishing practitioner guidance on that standard's role taxonomy.

Why that combination is the one to watch. ISO 42001 certifies an organization's management system. AIUC-1 certifies a product. Schellman sells both, which makes it the only kind of party in the market that can see the whole perimeter — and the natural place a deployer-scoped agent certification would be invented, because it would be an obvious product extension for a firm already accredited on both sides. If anyone closes the gap this pattern describes, it is far more likely to be an assurance practice with both accreditations than a standards body or a regulator.

Brandon's differentiation, and it is not a disagreement. Schellman's interest in the question is which control framework applies to which entity — a scoping and compliance question with a fee attached. Brandon's is whether anyone inside the organization actually holds the consequence. Those produce the same checklist and opposite theories of what the checklist is for. His position is that an audited document naming an owner is evidence about the document, not about the organization — which is the harder claim and the one he is positioned to make.

Honest limit: this is a watch target for the field map, not a thinker with a published thesis. Logged as such rather than dressed up as the latter.

🏢 CASE IN THE WILD

Three organizations bought organization-wide AI governance certification this year. All three sell software.

Today's search for enterprises certified under ISO/IEC 42001 for their own AI use surfaced named holders: CM.com (announced 2026-01-06, describing itself as among the first technology companies worldwide to obtain it), Anaplan (2026-09-10, an enterprise performance management vendor certifying its AI governance practices), Aurigo Software (2026-09-22). Not one deployer-only certificate appeared — no enterprise certifying because it runs forty agents, only companies certifying because they sell to enterprises that ask.

The breakpoint mechanism, and it is Incentive Fragmentation operating on the assurance market itself. An audit is an asset to a seller — it closes enterprise deals, and vendors say so in their own announcements. To a buyer the same audit is a cost that also creates a written record of who is responsible when something goes wrong. The party that can convert being measured into revenue buys the measurement. The party that carries the residual risk does not. Nobody decided the perimeter should sit where it sits; it sits where the money makes it sit, which is the most ordinary version of Brandon's mechanism and the most defensible.

The open question this case raises and does not answer. MSCI — the scan's deployer case, roughly 6,000 employees and 40+ agents by summer 2026 — had ~1,400 adversarial tests run against one agent and handed the attestation to its external auditors. It did that without being certified itself. So a deployer already found it worthwhile to buy the testing and not the certification. Is that because the certificate has nothing an auditor wants, or because nobody has offered MSCI one scoped to its estate? Those have different implications and the case does not distinguish them.

Caveat, stated because the base's rules require it: the certificate-holder announcements are company press releases and a GlobeNewswire item — moderate at best. Two figures appeared beside them in search results and are not carried anywhere in this brief or the base: "more than 350 organizations globally" holding certificates by mid-2026, and "83% of Fortune 500 procurement teams" planning to require ISO 42001 of vendors by 2027, attributed to Gartner with no report named. Both are unattributed SEO-page numbers — the same shape the scan chased to ground yesterday when a stray "79%" resolved to an instrument it already held. The second one, if it were ever verified, would support the vendor-side reading rather than undercut it.

⚙️ FOUR FORCES CONCLUSION

Commitment — and the scan's conclusion about it needs inverting, not extending.

The scan concluded that Commitment is "measurable, audited and priced for one party to the transaction and entirely unexamined for the other," and called the asymmetry the finding. Having read the requirements, the asymmetry is not in the measurement. It is in the purchasing. E001–E004 measure the deploying side perfectly well — they are written in the language of an organization that runs a system, not one that ships it, and E004 says "deployment" outright. The specification is symmetric. What is asymmetric is who pays for it.

Why that changes the paper-2 argument rather than decorating it. "Nobody can measure organizational accountability yet" is a claim with a shelf life — it dies the moment someone builds the instrument, and Brandon would have roughly a quarter of lead time. "The instrument exists and the party it would diagnose has no reason to buy it" does not expire, because the incentive that keeps it unbought is structural. The second is the stronger position and it is the one the evidence supports. It also costs him something he should concede in the same breath: he can no longer say the field lacks a specification of accountable ownership. It has one. He should cite it.

💭 OPEN QUESTION

What would have to happen for a deploying enterprise to buy an audit of its own accountability structure?

The scan's question — unmeasurable or uninsurable — is answered above: neither, it is unbought. That makes the live question a demand question, and it has exactly three plausible answers, which is why it is worth asking rather than rhetorical.

One: a regulator requires it. The EU AI Act imposes obligations on deployers, and AIUC-1 crosswalks to it. If a supervisor ever asks a deployer to evidence who owns an agent's failure, the certificate becomes the cheapest way to answer.

Two: an insurer discounts it. This is the one with money behind it and the one most likely to arrive first. A cyber, E&O or D&O underwriting questionnaire that asks a buying organization who owns its agents — and prices the answer — would create demand overnight, and the scan's own thread already lists this as criterion (c).

Three: a customer demands it of them. The recursive case, and the most interesting: an enterprise deploying agents in a service it sells to another enterprise becomes, for that purpose, a vendor — and buys the certificate for the same procurement reason CM.com and Anaplan did. Which would mean the perimeter never moves to cover deployers as deployers. It just keeps moving one layer down the supply chain, always covering whoever is selling.

If the third is what happens, Brandon's framework describes something permanent rather than something early, because there is always a bottom layer where the buyer is not also a seller, and that is where the unassured risk pools. That is a considerably larger claim than the pattern currently makes, and today's evidence is consistent with it without establishing it.

🥊 CHALLENGE

An accredited, organization-scoped AI certification that covers deployers has existed since 2023, and the pattern published this morning is built on its absence.

Stated as a hostile reviewer would: ISO/IEC 42001 is a certifiable management-system standard — of the organization, not of a product. Its role taxonomy includes the organization that acquires and operates AI someone else built. Your own headline source crosswalks to it. You published "assured by nobody" and quoted the crosswalk without following it.

This is the strongest objection available to today's pattern, and it is not a technicality. Per Schellman — accredited on both standards — ISO 42001 recognizes three certifiable roles: "AI Producer: designs and trains AI Models," "AI Provider: offers AI systems as products or services to others," and "AI User: acquires and operates AI tools built by someone else." Organizations can hold more than one, and "Clause 4.3 requires the scope to reflect every role the organization holds." It certifies the management system, not products — the exact inverse of AIUC-1's "limited to specific product(s)."

What rescues the pattern, and it has to be stated as an empirical claim rather than a structural one. Every named ISO 42001 certificate holder found today is a software vendor certifying for its customers' benefit. So the defensible version is not "no regime assures the deployer" — one does, and has for three years — but "every regime capable of assuring the deployer is bought by suppliers." That is a demand-side finding with a mechanism behind it, and it is better than the claim it replaces.

What would make the objection win outright: one named enterprise holding ISO 42001 certification scoped to the AI User role, for agents it did not build, with no supplier-facing motive. That falsifies the pattern's central claim as written, and should be reported loudly rather than absorbed.

The limit, and it is blocking. The ISO/IEC 42001 scope statement has not been read. iso.org returned HTTP 403 from this container on both routes tried, webstore.ansi.org returned 403, and BSI's browse page served no scope text. The roles taxonomy and the management-system claim rest on Schellman's practitioner account — a secondary with a commercial interest in ISO 42001 certification — corroborated only by a Cloud Security Alliance blog from the same search. Nothing in this challenge may be used in public until the ISO primary is read. Logged OPEN in knowledge/thesis-challenges.md with that condition attached.

📈 PATTERN BUILDING

The scan's new pattern is real, its claim needs restating, and its kill test is mis-specified in a way that would retire it in January for the wrong reason.

The Certified Perimeter was opened this morning at two sources (WEF/Capgemini ACAP 09-27; AIUC-1 09-28). The two members are genuinely independent and the pattern should stand — different organizations, commercial models, artifact types, no shared authors or lineage.

The claim as written. "The organizational preconditions for agentic deployment are now specified by the field's highest-credibility body and assured by nobody."

The claim it should be. Every assurance regime capable of certifying a deploying organization's accountability structure is, in observed practice, purchased by suppliers — because assurance converts into revenue for a seller and into cost and written exposure for a buyer. Narrower, survives the ISO 42001 objection, and names a mechanism instead of an absence.

The kill test, and this is the operationally important part. The scan pre-registered that the pattern dies if a Q4 2026 revision "adds a requirement that names a role, owner or accountability structure inside the deploying customer organization." By that wording the pattern is already dead — E001–E004 name owners now, and adopters are already eligible. Come January someone will either retire a live pattern on a test it failed on day one, or defend it on wording. Both are bad. The test has to be re-specified on scope: does any regime certify an organization's agent accountability structure across its estate, rather than a product's controls? Promotion to ESCALATED should likewise require a third body whose assured unit is the organization, not merely a third body publishing agent expectations.

🧱 ASSET SUGGESTION

Asset 16 — "Borrow the Auditor's Questions." Logged in full in knowledge/asset-suggestions.md.

The argument in two sentences. An insurer-funded, independently audited, quarterly-retested standard already specifies in four numbered requirements exactly the accountability artifacts Brandon says organizations lack — and sells that audit at product scope to the companies that build agents. So the enterprise running forty of them can be asked, in four questions lifted verbatim, to produce the same four documents for its own estate.

The form: a one-page client-facing diagnostic card, plus a short post to make it travel. Not a paper.

Why it beats every other audit card in that ledger, and the reason is rhetorical. Asset 5's five questions and asset 7's verification rung both ask a client to accept Brandon's diagnosis before answering. This card is not his. It is an auditor's checklist with capital behind it, crosswalked to ISO 42001, the EU AI Act, NIST AI RMF, MITRE ATLAS and the OWASP Top Ten, and applied every quarter to companies the client is buying from right now. The move is "your suppliers pass this audit — run it on yourself," and there is no graceful way to decline it.

Recommendation: ship the card, hold the essay. The card is unblocked today and does not depend on any absence claim. The essay does, and is one unread ISO page away from being safe.

SOURCES & THREADS

Exploratory query (Monday slot). Spent on falsifying today's own headline pattern rather than on the ranked Claim 3 gap — deliberately, because the pattern reached the shared base hours earlier and a wrong pattern propagates, and because the scan had flagged the requirement pages as owed and cheap. Two verification chases plus one search; yield: 1 KB file, 2 corrections to the shared base, 1 OPEN challenge, 1 new asset. Logged in knowledge/query-log.md with the full route list.

Access notes for the ledger, both new. iso.org returns HTTP 403 from this container on /standard/42001 and on /home/insights-news/resources/iso-42001-explained-what-it-is.html; webstore.ansi.org also 403; BSI's browse page serves no scope text. No working route to the ISO 42001 primary has been found — this is now a blocking dependency on a live challenge, not a nuisance. On the other side: standard.aiuc-1.com serves the full per-domain requirement text to a plain fetch with no search required, and standard.aiuc-1.com/evidence truncates after the A and B series.

Source candidates — nothing proposed, and one bar deliberately not claimed as met. The scan set AIUC's pre-registered second-signal bar as "a Q4 2026-or-later refresh read directly and reported against the deployer-accountability question." Today's read is not that — same Q3 version, different pages. It does not count and is not claimed. Two new candidates are proposed in Routing: Schellman (as an assurance practice accredited on both regimes) and the ISO 42001 certificate-announcement channel.

Threads. No Stafford-side thread work was due, and the scan's advances today stand. But the thread it opened this morning — Does the agent assurance market ever certify the deployer? — has its criterion (d) discharged by this brief (the per-domain requirement text, which the thread lists as "owed and cheap and should be done before the Q4 check"), and its premise needs the same correction as the pattern. PROPOSED-UPDATE in Routing.

Sparring note: declined, and the decline is recorded in knowledge/brandon-development.md rather than left silent. Today is Monday so the two-per-week cap is formally clear, but six notes stand unanswered and a seventh would make the backlog the plan. Today's material is parked there as a hook for growth edge #3 — it is the best illustration that edge has had, because it is a case where the mechanism was specified to an auditable standard and the adoption condition still was not met. Also recorded against that file: the 09-26 and 09-27 runs logged no decision either way, so a silent decline and an oversight are indistinguishable in it. Fixed going forward — one line per run, always.

Routing

STAGE-CANDIDATE — knowledge-base/aiuc-1-accountability-requirements-deployer-scope-2026-q3.md, ready to run in research-evidence:

python3 build/add-research-json.py --json '{
  "title": "AIUC-1 Standard, Domain E (Accountability) — requirement-level text, eligibility and certification scope",
  "publisher": "Artificial Intelligence Underwriting Company (AIUC)",
  "url": "https://standard.aiuc-1.com/accountability",
  "published_date": null,
  "credibility": "moderate",
  "instrument": "None — a published certification standard. No survey, sample, or measurement. Requirement text for domain E (E001-E017, E007/E014 retired, E013 supplemental), the certification-eligibility criteria and the certification-scope sentence were read first-hand from standard.aiuc-1.com on 2026-09-28. Evidence specifications for E001-E004 NOT obtained (the /evidence page truncates after the A and B series), so the audit bar for an accountable owner is unknown.",
  "breakpoints": [
    {"name": "incentive_fragmentation", "rationale": "The standard requires a named accountable owner per failure class (E001-E003) and a named approval lead per class of system change (E004), then scopes the certificate to specific products rather than the organization, so audited accountability attaches to one products failure modes and not to the organizations agent estate."},
    {"name": "technology_illusion", "rationale": "An organization can hold an audited, quarterly-retested certificate attesting that accountable owners are documented for three failure classes of one certified product while holding no such document for any other agent it runs."}
  ],
  "forces": [
    {"name": "Commitment", "rationale": "E001-E004 require that the answer to who is responsible when this fails be documented per failure class before the failure and re-evidenced to an auditor quarterly, which is the most precise operational specification of follow-through in this base; it is written in deployment language and applied at product scope."}
  ],
  "key_findings": [
    "E004 requires documenting which AI system changes across the development and deployment lifecycle require formal review or approval and to assign a lead accountable for each",
    "E001-E003 each require a documented AI failure plan for a named failure class assigning accountable owners",
    "Certification eligibility criterion 1 is Adopting or developing agentic AI systems, so deploying organizations are invited to certify; criterion 3 names internal executives or board members as the audience",
    "Certification scope is typically limited to specific products, not the full organizations products and practices - the surviving basis for the vendor-scoped reading",
    "Domain E runs E001-E017 with E007 and E014 retired (merged into E004 and E017) and E013 supplemental"
  ]
}'

PROPOSED-UPDATE → research-evidence/knowledge/emerging-patterns.md, anchor "Scan 2026-09-28 / NEW PATTERN — The Certified Perimeter":

Amendment 2026-09-28 (Stafford), applied the same day the pattern opened. The per-domain requirement pages this pattern's own brief listed as unread have been read (stafford-research/knowledge-base/aiuc-1-accountability-requirements-deployer-scope-2026-q3.md). Two of the pattern's stated grounds are false. (1) AIUC-1 does contain requirements naming accountable owners inside a deploying organization: E001–E003 each require a documented failure plan per failure class "assigning accountable owners", and E004 requires documenting which changes "across the development & deployment lifecycle" need approval and to "assign a lead accountable for each." (2) Deployers are eligible to be certified: eligibility criterion 1 is "Adopting or developing agentic AI systems built on generative models," and criterion 3 names "internal executives or board members." The surviving ground is scope, in the standard's own words: certification is "typically limited to specific product(s), not the full organization's products and practices."

Restate the pattern claim as: every assurance regime capable of certifying a deploying organization's accountability structure is, in observed practice, purchased by suppliers — because assurance converts into revenue for a seller and into cost and written exposure for a buyer. This survives the ISO 42001 objection below; the original wording does not.

Re-specify the kill test, which is currently mis-specified. As written, the pattern dies if a Q4 revision "adds a requirement that names a role, owner or accountability structure inside the deploying customer organization" — that requirement already exists, so the test fails on day one and will either retire a live pattern for the wrong reason or be defended on wording. Replace with: does any regime certify an organization's agent accountability structure across its estate, rather than a product's controls? Promotion to ESCALATED should require a third body whose assured unit is the organization, not merely a third body publishing agent control expectations.

Standing objection attached, marked blocking for publication. ISO/IEC 42001 is an accredited management-system certification of the organization, and per Schellman (accredited on both AIUC-1 and ISO 42001) its role taxonomy includes "AI User: acquires and operates AI tools built by someone else," with "Clause 4.3 requir[ing] the scope to reflect every role the organization holds." AIUC-1 crosswalks to it. The ISO scope statement is unread — iso.org, webstore.ansi.org and BSI all refused this container (403 / no scope text) — so this rests on a commercially interested secondary. What holds the pattern up empirically is that every named ISO 42001 certificate holder found today is a software vendor certifying for its customers' benefit (CM.com 2026-01-06, Anaplan 2026-09-10, Aurigo Software 2026-09-22), and no deployer-only certificate surfaced. Full text: stafford-research/knowledge/thesis-challenges.md, entry 2026-09-28.

PROPOSED-UPDATE → research-evidence/knowledge/paper-2-case-file.md, anchor "2026-09-28 — AIUC, AIUC-1 Certification Standard (Q3 2026 version)":

Amendment 2026-09-28 (Stafford) — the requirement text changes what this entry evidences, and the change is favourable. This entry reads the standard as evidence that an enterprise "can buy a fully certified agent … and change nothing about who inside it owns the agent." The requirement pages say the standard asks precisely that question of whoever it certifies (E001–E004; see the pattern amendment above), and invites adopters to certify. So the entry's support for Claim 3 should be restated: the danger under AI-native conditions is not that accountable ownership is unspecifiable or unspecified — it is specified, numbered and auditable, and scoped to a product. That is a stronger form of Claim 3, because it removes the rejoinder that the framework is describing a measurement problem that tooling will close.

It also settles this entry's own open question without waiting for January. The brief asked whether organizational accountability goes unassured because it is unmeasurable or because it is uninsurable and set the deciding test at the Q4 refresh. The instrument exists today, so the unmeasurable branch is closed; what remains is a demand question. Brandon's lead time on the scoping is shorter than the January framing implies, and the Q4 refresh is no longer the discriminating test — the discriminating test is whether any regime's assured unit becomes the organization.

PROPOSED-UPDATE → research-evidence/knowledge/story-threads.md, thread "Does the agent assurance market ever certify the deployer?":

2026-09-28 (Stafford, same day the thread opened): criterion (d) is discharged, and it moves the thread's premise. The per-domain Accountability requirement text — listed in (d) as "owed and cheap and should be done before the Q4 check" — has been read. It does contain deployer-side accountability language: E001–E003 require documented failure plans per failure class "assigning accountable owners"; E004 covers changes "across the development & deployment lifecycle." Eligibility criterion 1 is "Adopting or developing." So the thread's question is not whether anything ever reaches the deployer's accountability structure — the language reaches it — but whether any regime's certificate is ever scoped to an organization's estate rather than to a product ("typically limited to specific product(s), not the full organization's products and practices"). Recommend re-wording (a) accordingly: a Q4 revision adding owner language would not close this thread, because that language is already there. New sub-question for criterion (b), and it is now the thread's most valuable open item: ISO/IEC 42001 already certifies the organization's management system and appears to admit an "AI User" role — so (b) may be satisfied by a standard that predates the thread by three years. Blocking: the ISO scope statement is unread (403 from iso.org, webstore.ansi.org, BSI). Finding a working route to it is the cheapest high-value action on this thread and should displace the January check in priority. File: stafford-research/knowledge-base/aiuc-1-accountability-requirements-deployer-scope-2026-q3.md.

PROPOSED-UPDATE → research-evidence/knowledge/source-candidates.md (two candidates):

Schellman — first seen 2026-09-28, surfaced by the AIUC-1 requirement chase. An accredited certification body that is both AIUC-1's first authorized auditor (confirmed 2026-02-03) and an ISO/IEC 42001 certification body — the only class of party positioned to see both scopes of the Certified Perimeter, and the most likely inventor of a deployer-scoped agent certification. Probation at 1 signal. Second-signal bar, deliberately strict: Schellman (or another dual-accredited practice) publishing on deployer-side agent accountability or on ISO 42001 role scoping for AI Users. Marketing pages and certification-announcement posts do not count. Standing caution: commercially interested in both regimes — a pointer to standards text, never a source of conclusions about it.

ISO 42001 certificate-announcement channel — first seen 2026-09-28, surfaced by the exploratory search. Company announcements of ISO/IEC 42001 certification (CM.com 2026-01-06, Anaplan 2026-09-10, Aurigo Software 2026-09-22) are individually low-value press releases, but the channel is the only running measure of whether the perimeter moves to the demand side: a deployer-only certificate appearing here falsifies the Certified Perimeter pattern. Probation at 1 signal. Second-signal bar: an announcement, accreditation-registry listing, or certification-body breakdown identifying a certificate scoped to the AI User role or an organization certifying for AI it did not build.

PROPOSED-UPDATE → research-evidence/knowledge/field-map.md: add Schellman as an institutional watch entry (not a thinker), with the dual-accreditation rationale above and the note that its interest is scoping-and-compliance, which produces the same checklist as Brandon's framework on an opposite theory of what the checklist is for.

BASE-HOLDS — standing block for the scan's rule that it verify against files rather than memory, covering instruments in this repo that bear on its currently-open gaps (it cannot read stafford-research):

Audience routing.

Ship: see the first line of the run's final message. Delivery: emailed to brandon.freitag@gmail.com.