InfoTechCanon reviewed the demand signal separately and accepted option B as
INFO-DEC-2026-001: the CARING section 32 role set now applies wherever a
subject's access is exercised through another party, rather than to non-human
subjects only. CARING moves to canon version 0.4.0-RC2-itc2.
The change is additive and no SecurityCanon declaration moves. The blank cell in
the mapping table stands: InfoTechCanon's access-control model still has no
on-behalf-of relation.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3588@bnt-lap001
Assistant-Session: 24b80f66-e5a7-4e61-99fe-2d422e6d17da
Fifty-two InfoTechCanon files mention authority; twenty are live canon and
thirty-two are preserved assimilation source. The survey separates three senses
of the word already in use — the right itself (itc-org:Authority, ITC-ORG 10.17),
an external body compelling disclosure (CARING 10.7 exposure mode), and the
relationship in which authority is exercised (sec-authority:AuthMode) — and
records, per artifact, how SecurityCanon must reference rather than restate them.
Two corrections follow, applied through the amendment procedure
SECURITY-DEC-2026-003 requires. itc-org:Authority is a live concept that no
owned_concepts declaration lists, so the boundary review's conflict check could
not see it; it becomes a declared import on the existing organization-model
entry, whose pinned hash is unchanged. Environment was listed as
SecurityCanon-owned but CARING 21.5 already defines it, which the decision
forbids; InfoTechCanon owns it, SecurityCanon imports it with a newly pinned
CARING hash, and the RECOVERY value is carried as an upstream value proposal.
The declared import list goes from ten concepts to twelve.
Two findings need no change here. CARING's Authority exposure mode against
itc-org:Authority becomes residual R-3, InfoTechCanon-internal. itc-ident:Realm
against AuthorityRealm owes the disambiguation page a line but no rename.
AuthorityContext, AuthorityProvenance, Activation, EvidenceBoundary and
AccessSituation collide with nothing in the live corpus. No InfoTechCanon file is
changed by this survey.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3588@bnt-lap001
Assistant-Session: 24b80f66-e5a7-4e61-99fe-2d422e6d17da
Publishes sec-authority:ModeOfAuthority v0.2.0 with machine-readable
auth-modes.yaml and dimensions.yaml, and moves the v0.1 draft verbatim to
research/ as provenance — it had been sitting in spec/, which the Repository
Layout Standard reserves for implementation guidance.
Terminology separation decided as SECURITY-DEC-2026-002 / SEC-ADR-002. The
v0.1 Subject dimension becomes AuthorityContext, because InfoTechCanon's
access-control model already owns Actor and Subject and binds them as "Subject
is the access-control view of an actor"; reusing the pair for two distinct
parties would have made one word mean two things across the canons. Operator
versus OPERATE, Build Plane versus CONSTRUCT, Policy Plane versus GOVERN, Audit
Plane versus EvidenceBoundary and Condition versus Activation are separated
rather than merged, and Scope, AccessOperations, Purpose and PrincipalType are
declared imports. Namespace sec-authority: reserved; itc-caring: and itc-access:
stay upstream and are not aliased.
Two of the draft's open questions are closed. CONSTRUCT stays distinct from
GOVERN, the test being the object of authority — the artifact versus the
constraint it must satisfy — which keeps "who may edit the policy" separable
from "who decides what it must say". Substrate authority becomes a DOMINATES
relation between Authority Realms carrying dominance_kind, observable and
evidence_boundary, which makes the relative-sovereignty principle checkable
instead of merely asserted.
Orientation surfaces published: the one-page vocabulary card, the ten-question
design heuristic promoted from the draft's appendix to section 3 of the
artifact, the role/plane/mode disambiguation page, and the cross-layer mapping
to InfoTechCanon with its deliberate blanks where one layer has no equivalent.
Generalising CARING section 32 beyond non-human subjects is deliberately not
bundled in; it is InfoTechCanon's to accept as a demand signal.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUkN13CAqtXWPXuEiEtmJj
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 36656@bnt-lap001
Assistant-Session: 66d6eece-d245-43ca-85e8-68a1b5970a67
