Stafford

← 2026-09-30 · all briefs · 2026-10-02 →

Stafford Brief — 2026-10-01

Thursday. Delta layer on the 12:00 UTC scan (2 staged, 10 skipped) — read that brief first; this one does not repeat it. No merge OPS flag: yesterday's run landed clean (5007e0a, promoted in cd4498e).

Three things today, and the first is a decision that expires tomorrow.

The supervisor-pattern piece must be written tomorrow or formally killed. The scan called today's recording "an obituary unless it is written," which is the third consecutive time it has said so — and it said so because it still believes the piece is blocked on a paragraph I wrote on 29 September. It isn't blocked. It hasn't been for three days. The scan cannot see my repo, so it is reporting a dead blocker as live for the fourth day running. So what: nothing needs acquiring, nothing needs reporting, the concession paragraph is drafted in knowledge/asset-suggestions.md and the window shuts around 6 October. Tomorrow is write-or-close, and "close" is a legitimate answer I would rather you give deliberately than by default.

I chased the citation the scan deliberately didn't, and it points the opposite way from what the scan feared. The scan logged "KPMG / University of Texas AI amplifiers" as a chase target and warned that if it were real it would be the third piece of evidence for the strongest objection to your whole argument — that AI outcomes are decided by individual skill, not by how the organization is built. I found the study. On its own numbers, individual skill predicted nothing. Below.

And I went looking for whether anyone has ever shown that naming an accountable owner actually helps. Nobody has. But I found the nearest attempt, and it fails in a way that tells you the question the scan wants you to ask Gravitee is the wrong question — and what the right one is. That matters because the scan recommended you send that email.

📖 TODAY'S READ

Nine out of ten times an AI system caused real documented harm, there was no one on the record who was responsible for it.

This morning's scan gave you the input side of that: Gravitee asked 750 senior technology leaders whether anyone is formally accountable for what their AI agents do, and 7.2% said yes. The obvious next question is whether that absence shows up when things actually go wrong. It does, and someone has counted it.

Three researchers took the AI Incident Database — a public register of AI failures — screened 1,365 records down to 480 real incidents between 2020 and 2026, and read each one against the governance obligations in the EU AI Act, the US NIST risk framework and GDPR. In 91.5% of those incidents, no accountability structure was present. Not "the company says it doesn't have one" — this is reading the record of a failure that already happened and finding nobody identifiable who owned it. Alongside that: 77.1% show no sign of anyone monitoring the system after it went live, which is the specific obligation that exists precisely because you cannot know how these systems will behave on the day you switch them on.

Why this is worth more than any of the dozen governance surveys in the base. Every one of them — Schellman, Workiva, Grant Thornton, Gravitee — asks the same person both how good their governance is and how confident they feel about it. This doesn't ask anyone anything. It is third-party documentation of failures that already happened, coded by authors with nothing to sell. It is the first accountability number in this base that a client cannot answer with "that's not us."

One number in this paper you must never use, and it is the best sentence in it. The authors report that only 5% of these incidents were caught by the organization's own monitoring; the other 95% were found by journalists, users, researchers or lawyers. That reads like a devastating fact about detection. It isn't — it is a fact about the register. Incidents a company catches and fixes quietly never become public, so they never enter the database at all. The authors say this themselves in their limitations. This base has already watched a Gravitee figure get laundered into a fake "88.4% breach rate" by exactly this mistake. So what: cite 91.5% and 77.1%, which are honest statements about documented incidents. Leave the 5% alone.

File: knowledge-base/mumtaz-noor-mumtaz-post-deployment-accountability-ai-incidents-2026-04.md.

🥊 CHALLENGE

The scan's own best question today has a confound in it, and asking Gravitee the question as posed would waste the only ask you get.

The scan noticed — correctly, and to its credit, against its own interest — that 7.2% measures an input. Naming an owner is rare. Nobody has shown naming an owner helps. Gravitee holds ownership status, monitoring coverage and incident rates on the same 750 people and never crossed them. The scan's recommendation: email them for the cross-tab, "one email," and it decides whether you have a finding or just a statistic.

The cross-tab as described would not decide anything, and today's other paper shows you why in advance. Those researchers ran the closest thing to it that exists — governance input against governance outcome, on 480 incidents — and got a gigantic result: incidents caught internally looked compliant 87.5% of the time, incidents caught by outsiders 5.3%. Then they shot it themselves, in one line: the internally-detected group "may reflect broader organisational capacity rather than monitoring alone." In plain terms: companies that catch their own problems are companies that are good at things generally. You cannot tell the monitoring apart from the competence.

That objection lands on the Gravitee cross-tab before it is even run. Organizations that name an owner are organizations that do governance. A table showing named-owner firms with better coverage would show you that and nothing else, and it would be the most quotable misleading number you have ever had.

The version to ask for instead, and it costs the same email. Don't ask for ownership against how much coverage they have. Ask for ownership against the gap between what they believe and what they have — the distance between a respondent's confidence in their agent visibility (which rose from 82.6% to 91.8% in four months) and their actual coverage (flat, averaging 52%). Because that gap is one person's belief minus that same person's substrate, "being good at things generally" cancels out of it. And the question it answers is the one your framework actually predicts: not that owners produce better numbers, but that a system nobody owns is a system nobody is obliged to look at honestly.

So what: send the email, change the ask. Logged in full as a new OPEN challenge in knowledge/thesis-challenges.md.

And one thing the scan missed about its own files. The question it asked today — does clarity of individual accountability predict any AI outcome? — is word-for-word criterion (a) of a story thread the scan itself opened on 21 September (the personal-liability turn), where it was written as "the cross-tab this survey creates the opening for and does not run." That was the Veeam survey. Today it is Gravitee. Two instruments, nineteen weeks apart, create the identical opening and neither runs it, and the thread that exists to catch exactly this has its next check seven weeks away. Proposal in Routing to pull it forward.

🔭 THINKER TO WATCH

Ashish Agarwal, Anitesh Barua, Wen Wen and Fangchen Song (UT Austin, McCombs) with Anu Puvvada (KPMG) — and the reason to watch them is that they ran the study the scan was afraid of and got the opposite answer.

The study. 523 KPMG professionals, all under 18 months in the job, doing work that mirrored real client assignments with an AI agent. The researchers first had the agent do the same work alone, to set a baseline. Then: half the people (50.1%) beat the agent. A quarter (25.8%) matched it. A quarter (24.1%) did worse than if they had not been involved at all.

The finding, in their words: "Those who outperformed AI looked nearly identical on paper to those who didn't." Critical thinking, AI literacy, domain knowledge — none of it sorted people into the three groups. Sharper still: the below-baseline quarter scored as high as the top group on every foundational skill, and higher than the middle group. What separated the top group was behaviour during the work — framing the problem, directing the agent, checking its output, going round again.

Why this matters to you specifically. Your most dangerous critic says: the gap isn't organizational, it's individual — some people are just better at this, so train or hire differently. That objection currently rests on two studies which this base has been treating as agreeing with each other. They don't. Sarkar's Cursor telemetry says experience is what matters (+52% for experienced workforces against +23%). Idan & Anand say prior knowledge and grades predict nothing. This new study, ten times their sample and on working professionals, lands hard on the "knowledge doesn't matter" side. The objection has been tested three times on the trait version — are the good people better educated or more expert — and got a yes once.

How your position differs, stated honestly rather than favourably. This does not vindicate you. The thing that did predict performance is still a property of the person — just a practice rather than a trait. Your claim has to be that practices are produced by how work is organized, and that is an argument you have not yet evidenced. The nearest thing to evidence is inside the objection's own data: Idan & Anand handed people a written scaffold — a standard procedure — and it raised the average and cut the spread, helping least the people who were already good. A document substituted for the talent. That is the shape of the argument; it has not been run on professionals against a business outcome by anybody.

Three bounds, and the first is the one that would embarrass you. Every participant works at KPMG. One employer, one training programme, one toolset — the organizational variable has no variance at all, so this study cannot settle organization-versus-person in either direction. That is precisely the objection you logged against someone else's work on 26 September, and it applies here to a find that helps you. Second: the 24.1% "worse than the AI" figure depends entirely on how hard the researchers made the unaided agent try, and nobody outside can check that. Third: KPMG sponsored it, supplied the sample from its own staff, and has a co-author on it.

File: knowledge-base/agarwal-barua-wen-song-puvvada-kpmg-mccombs-ai-amplifiers-2026-07.md. Also honest: this was published in July and the base met it twice second-hand before anyone opened it.

🏢 CASE IN THE WILD

Nothing today, and I am not going to invent one. The scan's telecoms read (67.3% incident incidence, highest of any sector, against a population growing more confident) is the day's case and it is a good one. I have nothing to add to it that would not be padding.

⚙️ FOUR FORCES CONCLUSION

Commitment now has a number from the failure side, and it is the Force this base has never been able to see.

Commitment is follow-through — whether anyone actually acts on the stated direction when it costs them. It has always been the hardest Force to evidence, because you cannot observe follow-through from outside an organization. Today's scan gave the input measure: 7.2% have a named accountable person. Today's paper gives the matching outcome measure: in 91.5% of 480 documented failures, no accountable party was on the record. Two completely different kinds of evidence — one a survey of what people say, one a coded register of what happened — arriving at the same shape.

What that is worth, precisely, and it is less than it looks. They agree on prevalence, not on consequence. Neither one shows that the 7.2% with an owner do better. The Challenge section above is why that gap will not be closed by the obvious test. So what for paper 2: Claim 2 can now say the absence is real, common, and still there when things break — in two independent data genres. It cannot yet say it is the cause.

💭 OPEN QUESTION

If the thing that separates people who gain from AI from people who lose by it is a practice rather than a trait — who is supposed to install the practice?

Today's KPMG study says the difference is framing, directing, checking, iterating. Those are not personality. They are the things a well-run team teaches on day one and a badly-run team never mentions. But nobody in this literature measures where the practice comes from. Every study treats it as a property of the individual and stops.

That is a gap you could own, and it is adjacent to a problem you logged yesterday. The 09-30 challenge — the framework has no theory of who holds the remedy — asks who has the authority to fix a diagnosed breakpoint. This is the same question one level down: a quarter of early-career professionals are actively destroying value with an AI agent, their managers cannot tell which quarter because they look identical on paper, and nothing in the organization is set up to notice. Who notices? On what signal? The honest answer today is nobody and none, which is Momentum Mirage at the level of the individual desk.

📈 PATTERN BUILDING

Do not escalate Confidence Without Substrate on today's find, even though it looks like exactly what the pattern has been waiting for.

The pattern has four members and has been held unescalated four times on one written condition: a disinterested publisher, or a substrate verified independently rather than asked about. Today's paper is a disinterested publisher measuring a substrate nobody was asked about. It is tempting.

It does not meet the condition, and the reason is a real one rather than pedantry. The pattern is about confidence and substrate measured on the same organizations. This paper has no confidence side at all and no organizational denominator — it reads failures, not firms. It supplies an independently verified substrate for a different population. Pairing it with Gravitee's confidence figures would be assembling a gap out of two unrelated samples, which is the exact methodological move the pattern exists to criticise in other people's work. Recurrence stays 4. Condition stays open. Surfaced so the temptation is recorded and refused in writing rather than quietly skipped.

🧱 ASSET SUGGESTION

Asset 16's accountability card has been all stick and no evidence; it now has a cost side, and the cost side is the right genre.

"Borrow the Auditor's Questions" is four questions lifted verbatim from an insurer-funded audit standard, and its whole persuasive design is that the questions are somebody else's rather than Brandon's. The honest objection a client can make today is "so what — nobody can show the document changes anything." One line fixes it: in 480 documented AI incidents, 91.5% had no accountability structure in place. These four questions are what having one looks like." A survey number would have broken the card's design — a client can always say a survey isn't about them. A coded register of things that actually went wrong cannot be answered that way.

Full amendment, with the two citation bounds, in knowledge/asset-suggestions.md. Status and recommendation unchanged: ship the card, hold the essay. No seventeenth asset opened, deliberately — this ledger's own review named itself the system's bottleneck.

🎓 SPARRING NOTE

Declined, seventh consecutive run, and the reason is unchanged: six notes stand unanswered and a seventh would make the backlog the plan. Today's hook is parked against growth edge #2 (the readiness instrument) and it is the best fit that edge has had — write the cross-tab request to Gravitee yourself, in one paragraph, and say which comparison you want and why not the obvious one. Logged in knowledge/brandon-development.md. The standing recommendation is a /coach session: pick the 09-17 note, answer it, retire the rest.

SOURCES & THREADS

Stafford's own searching today: one exploratory query, one chase, both yielding. Logged in knowledge/query-log.md.

Routing

OPS — the handoff is still broken, and it got worse by two files today. Yesterday's audit found 2 of 34 September KB files had reached research-evidence. Re-run this morning against the whole base: 44 of this repo's 48 knowledge-base files are not in research-evidence, and today's two make it 46 of 50. The concrete cost is visible in the scan's own brief this morning, which recorded the supervisor-pattern window as blocked on a paragraph that has existed since 29 September. I have no write access and cannot fix this. Only you can. The decision I asked for yesterday stands unanswered, and it is the cheapest high-value decision in front of you.

PROPOSED-UPDATE → research-evidence/knowledge/story-threads.md

Anchor: thread The personal-liability turn — does executive accountability law produce design change or a defensive crouch?, Log section.

  • 2026-10-01 (proposed by Stafford): Criterion (a) met in the negative, and the thread should have been the one to notice it. Criterion (a) asks for "any instrument cross-tabulating clarity of individual accountability against an AI governance or deployment outcome." Today's Gravitee instrument creates that opening for the second time — ownership status, control coverage, pre-deployment governance and incident incidence on the same 750 respondents, uncrossed — nineteen weeks after Veeam created it the first time. Two instruments, identical unrun cross-tab, and today's 12:00 brief posed it as a fresh Open Question without connecting it to this thread. A search for any existing instrument running this design returned null (Stafford exploratory slot, 2026-10-01, logged). Criterion (a) is additionally now bounded rather than merely open: Mumtaz, Noor & Mumtaz (arXiv:2605.16281) run the nearest available design — governance input against governance outcome across 480 coded AI incidents — and disqualify their own result in their limitations as "a classic selection-on-observables concern." Any future find meeting criterion (a) must therefore be checked for the same confound, and a simple ownership-by-coverage table does not meet it. The qualifying design is ownership against a within-respondent difference, such as the confidence-minus-coverage gap. Next check pulled forward 2026-11-21 → 2026-10-20, to coincide with the Project OT check, on the grounds that the criterion is now specified rather than open-ended and the cheapest route to meeting it is a direct request to Gravitee.

PROPOSED-UPDATE → research-evidence/knowledge/field-map.md

Anchor: new entry.

Ashish Agarwal, Anitesh Barua, Wen Wen, Fangchen Song — Information, Risk and Operations Management, McCombs School of Business, UT Austin. First seen 2026-10-01 (publication 2026-07-23, HBR, with KPMG LLP). Why tracked: they run AI-collaboration field studies inside a real employer against a constructed AI-only baseline — a design almost nobody uses, and the only instrument in this base measuring working professionals' output relative to the agent working alone. Their headline result is that foundational individual capability did not predict who beat the baseline. Relevance to the thesis: contests the expertise arm of the person-level-moderator counterargument. Caution: sponsor-supplied single-employer samples; a KPMG co-author on the published work.

PROPOSED-UPDATE → research-evidence/knowledge/emerging-patterns.md

Anchor: Confidence Without Substrate, promotion-condition note.

2026-10-01 (proposed by Stafford): an independently verified substrate arrived today and deliberately was not recruited. Mumtaz, Noor & Mumtaz (arXiv:2605.16281) is a disinterested publisher measuring governance substrate from a coded incident register rather than by asking (91.5% of 480 documented AI incidents show accountability structures absent; 77.1% no post-market monitoring). It does not meet the promotion condition, because the condition requires confidence and substrate on the same units and this instrument has no confidence side and no organizational denominator. Pairing it with Gravitee's confidence series would construct the gap from two unrelated samples — the precise error this pattern exists to name. Recurrence stays 4; condition stays open. Recorded so a later run does not recruit it by count.

STAGE-CANDIDATE 1 → run in research-evidence

python3 build/add-research-json.py --json '{
  "title": "Post-Deployment Accountability in AI Governance: A Cross-Regulatory Empirical Analysis of AI Incidents",
  "publisher": "arXiv (Mumtaz, Noor & Mumtaz)",
  "url": "https://arxiv.org/abs/2605.16281",
  "published_date": "2026-04-10",
  "credibility": "moderate",
  "instrument": "Data source: AI Incident Database public register, snapshot of 1365 records. Inference method: automated content analysis of incident report texts and structured metadata, coded against nine post-deployment provisions of the EU AI Act, NIST AI RMF and GDPR; four-level classification per provision, assessed only where applicable. Observation window: incidents dated 2020-2026. Screening: 1365 to 1123 (regex) to 568 (conceptual, excluding malicious misuse and pure misinformation) to 480 (manual, removing scams, impersonation, copyright/IP). KNOWN BIAS, stated by the authors: the register captures publicly documented failures and underrepresents internally detected and resolved incidents, biasing the sample toward externally detected cases; the internally detected subset may reflect broader organisational capacity rather than monitoring alone (selection on observables). No organizational denominator - all figures are properties of documented incidents, never of firms.",
  "breakpoints": [
    {"name": "incentive_fragmentation", "rationale": "91.5% of 480 publicly documented AI incidents show accountability structures absent under NIST GOVERN 4 - when an AI system caused documented harm, no identifiable party was on the record as responsible in nine cases out of ten."},
    {"name": "technology_illusion", "rationale": "77.1% of incidents show no evidence of EU AI Act post-market monitoring - the systems were deployed on the assumption that the capacity to observe them in production existed, and in three cases out of four the record shows it did not."}
  ],
  "forces": [
    {"name": "Commitment", "rationale": "Accountability structures absent in 91.5% of coded incidents is a direct measure of no party being on the hook for follow-through at the point of failure."},
    {"name": "Capability", "rationale": "77.1% lacking post-market monitoring evidence is an absence of organizational capacity to observe a deployed system, independent of intent to govern it."}
  ],
  "key_findings": [
    "91.5% of 480 coded AI incidents (2020-2026) show accountability structures absent under NIST GOVERN 4",
    "77.1% of incidents lack evidence of EU AI Act post-market monitoring; 99.6% lack documented DPIA evidence",
    "9.8% of incidents are simultaneously non-compliant under two or more regulatory regimes",
    "24 of 480 incidents (5.0%) were detected by internal monitoring - DO NOT CITE as a detection rate; authors state the register underrepresents internally resolved incidents"
  ],
  "sample_size": 480
}'

STAGE-CANDIDATE 2 → run in research-evidence

python3 build/add-research-json.py --json '{
  "title": "Research: Why Some Junior Employees Work Well with AI - and Others Dont (KPMG x UT Austin McCombs field study)",
  "publisher": "Harvard Business Review",
  "url": "https://hbr.org/2026/07/research-why-some-junior-employees-work-well-with-ai-and-others-dont",
  "published_date": "2026-07-23",
  "credibility": "high",
  "instrument": "Data source: field study of 523 US-based early-career professionals employed at KPMG LLP, all under 18 months tenure, performing work assignments with an AI agent mirroring real client work in their own focus area. Inference method: each participants collaborative output scored against an AI-only baseline constructed by the researchers having the agents complete the same work unaided; participants sorted into three profiles by position relative to that baseline. Observation window: not disclosed; published 2026-07-23. Researchers: Agarwal, Barua, Wen and Song (McCombs, UT Austin) with Puvvada (KPMG). CAUTIONS: single employer, so organizational variance is zero by construction and the design cannot adjudicate organizational against person-level explanations in either direction; the 24.1% below-baseline share is a function of how hard the unaided agent was made to try and is not externally auditable; early-career only; KPMG sponsored the study, supplied the sample and holds a named co-authorship.",
  "breakpoints": [
    {"name": "technology_illusion", "rationale": "24.1% of participants produced work below the AI-only baseline - worse than if they had not been involved - and no foundational skill measure predicted who, so any adoption metric counts that quarter as successful deployment while they subtract value."}
  ],
  "forces": [
    {"name": "Capability", "rationale": "The trait version of Capability did not predict performance - the below-baseline group matched the top group on every foundational skill and scored higher than the middle group - while the practice version (framing, directing, evaluating, iterating) did."}
  ],
  "key_findings": [
    "AI Amplifiers 50.1% beat the AI-only baseline; AI Delegators 25.8% matched it; AI Apprentices 24.1% performed below it",
    "Traditional measures of capability did not explain the gap - those who outperformed AI looked nearly identical on paper to those who did not",
    "AI Apprentices matched Amplifiers and scored higher than Delegators on every foundational skill, yet landed below the AI baseline",
    "Predictive behaviours were orchestrating the workflow, framing problems, anchoring work in domain frameworks, and refining results across multiple rounds"
  ],
  "sample_size": 523
}'

PROPOSED-UPDATE → research-evidence/knowledge/source-candidates.md

Anchor: the KPMG / University of Texas "AI amplifiers" chase target opened 2026-10-01.

2026-10-01 (proposed by Stafford, same day): chase target closed, resolved, same day it was opened. The citation is real: Agarwal, Barua, Wen & Song (McCombs) with Puvvada (KPMG), published HBR 2026-07-23, verified against the KPMG newsroom release and the McCombs research page, consistent on sample (n=523), design (AI-only baseline) and all three profile percentages. It is not the third member of the person-level-moderator rival that this slot anticipated. On its own measurements, foundational capability did not predict outcome — the below-baseline group outscored the middle group on every foundational skill — which contests the expertise arm of that objection (Sarkar) while replicating the interaction-competence arm (Idan & Anand) at ten times the sample on working professionals. Filed in stafford-research as agarwal-barua-wen-song-puvvada-kpmg-mccombs-ai-amplifiers-2026-07.md; staged above. Separately: the "1.4 million interactions" KPMG × UT analysis is a different, earlier collaboration, unverified, and should not be cited as part of this finding.