Access and capability
Capability envelopes are explicit; absent permission is denial. Public content excludes credentials and private infrastructure details.
Security architecture
Fail closed. Preserve evidence. Separate authority.
Deny-by-default capability, controlled identity and authority, immutable evidence, containment state, and deterministic recovery.
Evidence and replay
Qualification and replay evidence support the current boundary while operational certification remains incomplete.
Separation of duties
AI-DATABASE owns governed authority and evidence state. AI-DATASET, Market AI, and AICC have separate bounded roles.
Certification boundary
No SOC 2, ISO 27001, FedRAMP, HIPAA, PCI DSS, penetration-test completion, third-party security certification, or operational AI safety certification is claimed.