apol/agency-transfer-policy-atlas huggingface dataset:
Claim (Mechanism): Root-purpose provenance across multi-agent handoffs targets Bind every delegated subtask, tool call, generated artifact, and terminal action to a signed root-purpose record, with explicit scope changes and controller identity. at Capability → controller → delegated vector; expected agency domain: Executive; decisional; collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Project — confirmatory mechanism
Epistemic status: Established evidence
Directness: Direct
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Makes harmful composition inspectable and prevents local compliance from substituting for end-to-end purpose review.
Endpoint: Control effectiveness
Evidence origin: Project — confirmatory mechanism
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Mechanism): Workflow-level global guard before consequential completion targets Evaluate the cumulative plan, intermediate artifacts, recipient, scale, target, and foreseeable downstream use immediately before a consequential action is executed. at Vector → target → consequential action; expected agency domain: Executive; decisional.
Endpoint: Mechanism / agency
Evidence origin: Project — confirmatory mechanism
Epistemic status: Established evidence
Directness: Direct
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Restores end-to-end review at the point where reversible assistance becomes real-world harm.
Endpoint: Control effectiveness
Evidence origin: Project — confirmatory mechanism
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Mechanism): Machine-readable authorization boundaries and least privilege for agents targets Express purpose, permitted tools, targets, data, spend, duration, audience, and escalation conditions as enforceable grants; require renewed confirmation for high-impact deviations. at Controller → vector; expected agency domain: Executive; decisional; institutional.
Endpoint: Mechanism / agency
Evidence origin: Project — exploratory
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Preserves meaningful delegation while preventing quiet expansion of an agent's authority.
Endpoint: Control effectiveness
Evidence origin: Project — exploratory
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Mechanism): Tamper-evident workflow traces and election evidence preservation targets Record model/version, controller, root purpose, tool permissions, consequential actions, delivery endpoints, and intervention events in privacy-preserving tamper-evident logs with legal hold and researcher-access paths. at Change → agency transfer → accountability; expected agency domain: Collective / institutional; epistemic.
Endpoint: Mechanism / agency
Evidence origin: Project — exploratory
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): Indirect / mixed. Expected effect if the control works: Makes investigation, remedy, independent audit, and policy learning possible after fast-moving incidents.
Endpoint: Control effectiveness
Evidence origin: Project — exploratory
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Do not upgrade this claim from Strong inference because a legal duty or risk mechanism exists.
Claim (Mechanism): Longitudinal APE–MASK–manipulation evaluation suite targets Run a staged evaluation from harmful-persuasion propensity and pressured deception to contextual efficacy, adaptive attacks, agent scaffolds, personalization, and 7-, 30-, and 90-day agency outcomes. at Capability → vector → target → change; expected agency domain: Evaluative; decisional; relational.
Endpoint: Model behavior / capability
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Separates propensity, deception, efficacy, durability, safeguard robustness, and deployment scale.
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Mechanism): Manipulation capability–reach threshold tied to release and deployment decisions targets Combine validated manipulation capability, safeguard robustness, release reversibility, personalization, tool access, likely reach, and election timing into graduated obligations. at Capability → controller → vector → scale; expected agency domain: Evaluative; decisional; collective / institutional.
Endpoint: Model behavior / capability
Evidence origin: Normative proposal
Epistemic status: Open question
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Connects research evidence to consequential policy action while scaling controls to actual risk and reversibility.
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Mechanism): Election access-risk observatory for frontier and open-weight releases targets Track release dates, access modality, derivatives, safeguard state, language coverage, campaign tooling, election windows, and incident signals without publishing reproducible misuse pathways. at Capability → controller → vector → target; expected agency domain: Collective / institutional; epistemic.
Endpoint: Mechanism / agency
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Identifies when a capability change should trigger tabletop exercises, platform contacts, monitoring, or independent tests.
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Mechanism): Official-source grounding for verifiable election-administration facts targets Ground answers about registration, eligibility, polling places, voting procedures and certified results in current authoritative election sources, with citations and escalation when sources conflict. at Vector → target → belief or behavior change; expected agency domain: Epistemic; decisional; collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Normative proposal
Epistemic status: Established evidence
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): In preregistered online survey experiments in the United States and Brazil, assignment to factual messages about election-security procedures generally improved self-reported election confidence and factual accuracy and reduced election-fraud beliefs immediately after exposure; persistence was mixed.
Endpoint: Self-reported election confidence, perceived prevalence and effects of election fraud, and accuracy or discernment for election-procedure statements.
Evidence origin: External empirical
Epistemic status: Established evidence
Directness: Direct
As of: 2026-08-13
Notes: Bounded to static forced-exposure messages and survey outcomes; no evidence on assistant grounding, voting-access errors, turnout, abstention, administrative disenfranchisement, correction reach, or electoral behaviour.
Claim (Mechanism): Proposed capability-plus-reach systemic-risk trigger targets Propose a second policy screen combining measured capability with reach, tool access, scalability and release modality; do not treat this as the current AI Act Article 51 rule. at capability growth → frontier provider → model or API → population and institutions → scalable influence → agency transfer to provider or operator; expected agency domain: Executive; Collective / institutional.
Endpoint: Model behavior / capability
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Avoids relying only on FLOP thresholds and can capture highly persuasive, agentic or widely distributed models below a compute threshold
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Harmful manipulation as a specified systemic-risk domain is coded Voluntary / private / Operational voluntary. Scope: implemented through AI Act compliance practice
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Harmful manipulation as a specified systemic-risk domain targets Require identification and assessment of persuasion, deception and personalised targeting in multi-turn, high-stakes contexts at persuasive capability → provider or malicious user → personalised dialogue → voter or decision-maker → covert belief or behaviour change → agency transfer → democratic harm; expected agency domain: Epistemic; Evaluative; Decisional; Collective / institutional.
Endpoint: Model behavior / capability
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): Indirect / mixed. Expected effect if the control works: Makes manipulation a first-class frontier risk rather than treating it only as misinformation or content safety
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Do not upgrade this claim from Strong inference because a legal duty or risk mechanism exists.
Claim (Mechanism): APE-style harmful-persuasion propensity diagnostic — not a release gate targets Test whether a model attempts persuasion on harmful and election-relevant objectives across direct, indirect and multi-turn prompts at instruction following → campaign or influence actor → generated persuasive dialogue → voter → attempted preference shaping → agency transfer; expected agency domain: Evaluative; Decisional; Collective / institutional.
Endpoint: Model behavior / capability
Evidence origin: External empirical
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Detects willingness to persuade where generic harmful-content benchmarks and direct-request refusal tests miss risk
Endpoint: Control effectiveness
Evidence origin: External empirical
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Context-specific manipulation efficacy evaluation is coded Voluntary / private / Operational voluntary. Scope: implemented by Google DeepMind; recommended as common requirement
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Context-specific manipulation efficacy evaluation targets Measure both manipulative tactics and actual belief or behaviour change in controlled high-stakes interactions across locales at manipulative capability → provider or operator → contextual dialogue → person → belief or behavioural change → loss of reflective agency; expected agency domain: Epistemic; Evaluative.
Endpoint: Human persistence / low-cost behavior
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Separates propensity from efficacy and tests process and outcome harms in contexts where manipulation may actually work
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Mechanism): MASK-style honesty and pressured-deception diagnostic — not a manipulation gate targets Test whether a model knowingly contradicts its represented beliefs when instructed, incentivised or pressured to deceive at deceptive propensity → model or agent controller → trusted answer or recommendation → user or official → false belief under asymmetric trust → agency transfer; expected agency domain: Epistemic; Decisional; Executive; Relational.
Endpoint: Model behavior / capability
Evidence origin: External empirical
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Adds intentional or pressure-induced deception to manipulation evaluation instead of conflating honesty with factual accuracy
Endpoint: Control effectiveness
Evidence origin: External empirical
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Adaptive jailbreak, fine-tuning and abliteration robustness testing is coded Mixed / Applicable. Scope: Article 55 duties bind systemic-risk GPAI providers; NIST/Code testing methods remain voluntary compliance choices.
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Adaptive jailbreak, fine-tuning and abliteration robustness testing targets Evaluate mitigations under adaptive prompting, safety-removal fine-tunes, altered system prompts, scaffolds and abliterated checkpoints at latent capability → adversarial modifier → safeguard removal → influence campaign → harmful persuasion at scale → agency transfer; expected agency domain: Evaluative.
Endpoint: Mechanism / agency
Evidence origin: Project — exploratory
Epistemic status: Established evidence
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — legal existence only. Expected effect if the control works: Tests the actual threat model demonstrated by open weights and Part 1 rather than relying on default-chat refusals
Endpoint: Control effectiveness
Evidence origin: Project — exploratory
Epistemic status: Open question
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Open question because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Agent-scaffold and tool-access evaluation is coded Voluntary / private / Operational voluntary. Scope: evaluation infrastructure implemented; policy gate recommended
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Agent-scaffold and tool-access evaluation targets Test models with realistic memory, browsing, tools, parallelism, long horizons and campaign-like scaffolding at agentic capability → operator → tools and persistent workflow → target population → adaptive repeated influence → agency transfer at scale; expected agency domain: Evaluative; Executive.
Endpoint: Mechanism / agency
Evidence origin: Project — exploratory
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Reveals capabilities hidden by single-turn model tests and measures end-to-end campaign assistance
Endpoint: Control effectiveness
Evidence origin: Project — exploratory
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Mechanism): Independent evaluator access to capable and minimally mitigated models targets Give qualified external evaluators timely access to the strongest model, relevant internals and the version with the fewest safeguards at provider information asymmetry → independent testing → credible risk evidence → constrained release decision → reduced agency concentration; expected agency domain: Epistemic; Decisional; Relational; Collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Reduces self-assessment bias and permits realistic APE, MASK and red-team testing before irreversible release
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Mechanism): Pre-release safety case and Safety and Security Model Report targets For signatories, document systemic-risk reasoning in the Safety and Security Model Report; a regulator-filed pre-release safety case or release condition is a further proposal. at capability evidence → provider decision → release modality → public exposure → residual manipulation risk → accountability for agency transfer; expected agency domain: Evaluative; Decisional; Collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Forces evaluation results, assumptions, mitigations, uncertainty and release reasoning into one auditable decision record
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Continuous post-deployment re-evaluation is coded Binding — limited scope / Applicable. Scope: Binding Article 55 duties for GPAI with systemic risk; monitoring methods remain under development.
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Continuous post-deployment re-evaluation targets Repeat risk assessment after post-training, new tools, higher inference compute, new integrations, incidents or observed drift at deployment change → provider or integrator → altered model affordances → users → emergent influence or dependency → agency transfer; expected agency domain: Executive; Relational.
Endpoint: Mechanism / agency
Evidence origin: Legal / operational precedent
Epistemic status: Established evidence
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — legal existence only. Expected effect if the control works: Addresses risks that static pre-release benchmarks cannot observe, including adaptive relationships and integration effects
Endpoint: Control effectiveness
Evidence origin: Legal / operational precedent
Epistemic status: Open question
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Open question because a legal duty or risk mechanism exists.
Claim (Mechanism): Serious-incident reporting plus a proposed manipulation near-miss register targets Report serious incidents under the binding AI Act duty; separately pilot protected reporting of manipulation near misses, safeguard bypass and deceptive agent behaviour. at deployed model → operator or autonomous agent → harmful influence event → affected public → detected agency loss → corrective action; expected agency domain: Evaluative; Executive; Collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): Indirect / mixed. Expected effect if the control works: Creates feedback between real misuse and model evaluation, safeguards and regulatory thresholds
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Do not upgrade this claim from Strong inference because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Independent systemic-risk executive and board accountability is coded Voluntary / private / Partial / verify. Scope: Code commitment for signatories; not a standalone statutory governance duty
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Independent systemic-risk executive and board accountability targets Assign risk oversight to an executive independent of core capability and product functions, with documented escalation at commercial pressure → provider governance → release decision → public exposure → unchecked influence capability → concentrated power; expected agency domain: Decisional; Relational; Collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): Indirect / mixed. Expected effect if the control works: Reduces conflicts between model release incentives and manipulation-risk findings
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Do not upgrade this claim from Strong inference because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Frontier-safety whistleblower protection is coded Binding / Applicable. Scope: implemented
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Frontier-safety whistleblower protection targets Protect employees reporting concealed risk, misleading safety claims or framework noncompliance and provide anonymous channels at internal risk knowledge → employee disclosure → regulator or board action → constrained unsafe release → reduced provider power asymmetry; expected agency domain: Multiple / context-dependent.
Endpoint: Mechanism / agency
Evidence origin: Legal / operational precedent
Epistemic status: Established evidence
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — legal existence only. Expected effect if the control works: Improves detection of suppressed evaluation failures and misleading public safety claims
Endpoint: Control effectiveness
Evidence origin: Legal / operational precedent
Epistemic status: Open question
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Open question because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Staged and differential model access is coded Voluntary / private / Operational voluntary. Scope: implemented by some providers and recognised in EU Code
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Staged and differential model access targets Begin with limited, vetted API access and expand only after monitoring; withhold downloadable weights where residual risk is unacceptable at capability → provider-controlled access → vetted operator → bounded influence vector → reduced scale of agency transfer; expected agency domain: Multiple / context-dependent.
Endpoint: Model behavior / capability
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Preserves monitoring, rate limiting, intervention and withdrawal options while uncertainty is high
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Mechanism): Risk-tiered API identity and campaign-account verification targets Verify high-volume or high-risk customers, beneficial ownership and resellers; retain privacy-preserving attribution records at API capability → campaign or intermediary → high-volume generation → targeted electorate → adaptive manipulation → attributable operator; expected agency domain: Evaluative.
Endpoint: Mechanism / agency
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): Indirect / mixed. Expected effect if the control works: Raises the cost of anonymous industrial-scale abuse and improves incident investigation
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Do not upgrade this claim from Strong inference because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Technical enforcement for Article 5-qualified manipulative practices is coded Binding / Applicable. Scope: Binding prohibition applicable; model- and service-layer implementation uneven
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Established evidence
Directness: Direct
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Technical enforcement for Article 5-qualified manipulative practices targets Build classifiers, account controls, rate limits and escalation for uses that satisfy the Article 5 conjunctive test; do not encode a general prohibition on political persuasion. at model capability → political operator → deceptive or vulnerability-exploiting interaction → voter → significant harm and agency loss; expected agency domain: Evaluative; Decisional.
Endpoint: Human immediate outcome
Evidence origin: Legal / operational precedent
Epistemic status: Established evidence
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — legal existence only. Expected effect if the control works: Connects abstract prohibition to detectable provider-side abuse patterns
Endpoint: Control effectiveness
Evidence origin: Legal / operational precedent
Epistemic status: Open question
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Open question because a legal duty or risk mechanism exists.
Claim (Mechanism): Release-modality safety case for open-weight models targets Pilot pre-release assessment and independent review based on capability, modifiability, reach, reversibility and residual risk before irreversible weight release. at frontier capability → weight publisher → unrestricted modifier → abliterated or fine-tuned model → scalable manipulation → irreversible agency transfer capacity; expected agency domain: Evaluative; Relational.
Endpoint: Model behavior / capability
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Moves risk assessment before the point at which safeguards, monitoring and withdrawal become impossible
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Open-weight ecosystem monitoring and release registry is coded Voluntary / private / Operational voluntary. Scope: recommended by NTIA; fragmented implementation
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Open-weight ecosystem monitoring and release registry targets Maintain a registry of weight releases, derivatives, capability evaluations, licences, hashes and observed misuse or safeguard removal at weight release → distributed modifiers → derivative models → opaque deployment → public influence → reduced supervisory visibility; expected agency domain: Collective / institutional.
Endpoint: Model behavior / capability
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): Indirect / mixed. Expected effect if the control works: Improves visibility without immediately prohibiting open-weight development
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Do not upgrade this claim from Strong inference because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Frontier model-weight cybersecurity standard is coded Mixed / Applicable. Scope: Binding cybersecurity duty for GPAI with systemic risk; Code methods are voluntary; California scope is separate.
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Frontier model-weight cybersecurity standard targets Protect unreleased weights with least privilege, strong identity controls, hardened interfaces, encryption, confidential computing and exfiltration testing at frontier weights → theft or insider → uncontrolled deployment → malicious actor → scalable harmful capability → loss of provider control; expected agency domain: Multiple / context-dependent.
Endpoint: Model behavior / capability
Evidence origin: Legal / operational precedent
Epistemic status: Established evidence
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — legal existence only. Expected effect if the control works: Reduces unauthorised conversion of controlled models into unmonitored or abliterated deployments
Endpoint: Control effectiveness
Evidence origin: Legal / operational precedent
Epistemic status: Open question
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Open question because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Mandatory downstream model documentation is coded Binding / Applicable. Scope: implemented
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Mandatory downstream model documentation targets Provide integrators with current information on capabilities, limitations, intended uses, evaluation results and safeguard assumptions at provider knowledge → downstream integrator → assistant or agent design → user → hidden model limits → preventable agency transfer; expected agency domain: Epistemic; Executive.
Endpoint: Model behavior / capability
Evidence origin: Legal / operational precedent
Epistemic status: Established evidence
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — legal existence only. Expected effect if the control works: Lets downstream systems implement context-specific manipulation, memory and tool controls
Endpoint: Control effectiveness
Evidence origin: Legal / operational precedent
Epistemic status: Open question
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Open question because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Machine-readable provenance for synthetic outputs is coded Binding / Applicable. Scope: implemented from 2026-08-02 in EU and 2025-09-01 in China
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Machine-readable provenance for synthetic outputs targets Embed robust, interoperable and detectable markers in generated text, audio, image and video, with visible labels for covered content at generation capability → model provider → synthetic political content → public → mistaken authenticity → epistemic agency transfer; expected agency domain: Epistemic; Collective / institutional.
Endpoint: Model behavior / capability
Evidence origin: Legal / operational precedent
Epistemic status: Established evidence
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — legal existence only. Expected effect if the control works: Improves attribution and detection of synthetic campaign material
Endpoint: Control effectiveness
Evidence origin: Legal / operational precedent
Epistemic status: Open question
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Open question because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Agent identity, least privilege and high-impact confirmation is coded Voluntary / private / Operational voluntary. Scope: standards initiative implemented; controls under development
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Agent identity, least privilege and high-impact confirmation targets Give agents verifiable identities, scoped permissions, short-lived credentials and mandatory human confirmation for consequential actions at agentic model → delegated tools → communication or account action → citizen or institution → autonomous influence → agency transfer; expected agency domain: Executive; Collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Project — exploratory
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): Indirect / mixed. Expected effect if the control works: Constrains agents from autonomously escalating persuasion campaigns, impersonating users or acting beyond delegated intent
Endpoint: Control effectiveness
Evidence origin: Project — exploratory
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Do not upgrade this claim from Strong inference because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Long-horizon agency and dependency monitoring is coded Voluntary / private / Operational voluntary. Scope: recommended; methods nascent
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Long-horizon agency and dependency monitoring targets Audit persistent memory, repeated recommendations, emotional cues, reliance and preference drift over extended interactions at memory and personalisation → assistant provider → repeated intimate interaction → user → dependency and preference shaping → cumulative agency transfer; expected agency domain: Evaluative; Decisional; Executive; Relational.
Endpoint: Human persistence / low-cost behavior
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Targets the project’s central risk that manipulation becomes relational infrastructure rather than a single persuasive message
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Threshold-triggered notification for GPAI systemic-risk classification is coded Binding — limited scope / Applicable. Scope: Article 52 notification is threshold-triggered; no general advance notification of training runs.
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Established evidence
Directness: Direct
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Threshold-triggered notification for GPAI systemic-risk classification targets Notify the Commission without delay and within two weeks when Article 51 high-impact capability is met or expected to be met; do not treat this as general pre-training notification. at planned capability scale-up → developer → regulator notice → early evaluation → deployment constraints before public exposure; expected agency domain: Collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Legal / operational precedent
Epistemic status: Established evidence
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — legal existence only. Expected effect if the control works: Gives regulators time to commission manipulation and agentic testing before launch
Endpoint: Control effectiveness
Evidence origin: Legal / operational precedent
Epistemic status: Open question
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Open question because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Regulator model-access, evaluation, mitigation and recall powers is coded Binding / Applicable. Scope: implemented
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Regulator model-access, evaluation, mitigation and recall powers targets Allow the regulator to demand information, run evaluations, order mitigations and withdraw or recall a non-compliant model at provider-controlled evidence → independent regulator → enforceable finding → release or access change → reduced public exposure; expected agency domain: Epistemic; Relational; Collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Legal / operational precedent
Epistemic status: Established evidence
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — legal existence only. Expected effect if the control works: Turns safety reports and manipulation evaluations into potentially consequential oversight
Endpoint: Control effectiveness
Evidence origin: Legal / operational precedent
Epistemic status: Open question
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Open question because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Certified AI management system as procurement or licensing condition is coded Voluntary / private / Operational voluntary. Scope: standard implemented; mandatory use recommended selectively
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Certified AI management system as procurement or licensing condition targets Require an independently audited AI management system with risk ownership, lifecycle controls, monitoring and continual improvement at provider organisation → governance processes → model lifecycle → downstream public systems → reduced unmanaged influence risk; expected agency domain: Relational; Collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): Indirect / mixed. Expected effect if the control works: Provides auditable organisational infrastructure for repeated evaluation and incident response
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Do not upgrade this claim from Strong inference because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Democracy and agency impact assessment is coded Non-binding official guidance / Operational voluntary. Scope: HUDERIA is non-binding; CETS 225 is not yet in force.
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Democracy and agency impact assessment targets Assess scale, scope, likelihood, reversibility and stakeholder impacts on autonomy, opinion formation and democratic processes at model and deployment design → controlling actor → influence environment → affected publics → agency transfer → democratic concentration; expected agency domain: Collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Legal / operational precedent
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): None — mechanism or proposal only. Expected effect if the control works: Captures autonomy and democratic harms omitted by catastrophic-risk frameworks
Endpoint: Control effectiveness
Evidence origin: Legal / operational precedent
Epistemic status: Plausible hypothesis
Directness: None
As of: 2026-08-11
Notes: Do not upgrade this claim from Plausible hypothesis because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, International frontier-risk reporting framework is coded Voluntary / private / Operational voluntary. Scope: implemented
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): International frontier-risk reporting framework targets Standardise voluntary disclosures on risk identification, evaluation, incident management, security and transparency across providers at cross-border providers → comparable reporting → regulator and public scrutiny → convergent controls → reduced jurisdictional arbitrage; expected agency domain: Collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Normative proposal
Epistemic status: Plausible hypothesis
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.
Claim (Control effectiveness): Indirect / mixed. Expected effect if the control works: Creates comparable evidence across providers and jurisdictions without waiting for a global treaty
Endpoint: Control effectiveness
Evidence origin: Normative proposal
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Do not upgrade this claim from Strong inference because a legal duty or risk mechanism exists.
Claim (Legal status / scope): As of 2026-08-11, Security assessment and algorithm filing for socially mobilising generative AI is coded Binding / Applicable. Scope: implemented
Endpoint: Legal existence
Evidence origin: Legal / operational precedent
Epistemic status: Strong inference
Directness: Indirect
As of: 2026-08-11
Notes: Legal status never implies control effectiveness.
Claim (Mechanism): Security assessment and algorithm filing for socially mobilising generative AI targets Require security assessment, algorithm filing and regulatory cooperation for services with public-opinion or social-mobilisation capacity at generative capability → service provider → mass communication → population → opinion mobilisation → state-supervised deployment; expected agency domain: Collective / institutional.
Endpoint: Mechanism / agency
Evidence origin: Legal / operational precedent
Epistemic status: Established evidence
Directness: Conditional
As of: 2026-08-11
Notes: Mechanism claim is distinct from evidence that the control works.