IP-safe project evidence study / R2 V2 / 2 November 2026
The project asked how AI could support continuing vendor oversight. It developed a substantive case analysis, application standards and a proposed service, then checked selected local execution mechanics. The starting point was the Ascension Data & Analytics public record: what permits an organization to rely on a provider handling sensitive information?
The source study examined six retained public documents, including related FTC complaints, the final order, its rule attachment and historical Safeguards Rule texts. Related versions were treated as one case, rather than independent corroboration. The investigation traced policy, contractual protection and assessment scope to the specific outsourcing decision. [C1, C2]
| Question | Evidence examined | Analytical distinction |
|---|---|---|
| Did review govern access? | Complaint paragraphs 7-8, 14-16 | An existing policy can fail to govern the actual transfer. |
| Did contracts require protection? | Complaint paragraphs 17-18 | An agreement can exist with inadequate safeguard terms. |
| Did assessment cover the provider? | Complaint paragraphs 19-21 | A corporate-family report may exclude the relevant exposure. |
The work produced a case monograph, a service-design paper, nine application standards with 45 requirements and proposed acceptance cases, an expert-review workspace, and a methods/execution companion. This document exposes the analytical work and selected observations while retaining proprietary implementation detail for diligence.
The study rejected the easy diagnosis that the organization lacked a vendor policy. The complaint describes an existing policy but alleges that the specified review did not occur before the provider received documents. That directs attention to the transfer decision: evidence of review, approval timing, exceptions and the authority to proceed. Writing an additional policy would not by itself answer those questions. [C1]
The case analysis similarly distinguished an absent agreement from alleged deficiencies in safeguard obligations. A reviewer would need the executed agreement, incorporated schedules, amendments and service description to assess the operative duties. The public record does not contain those complete company records. The supported output is an evidence request and a bounded concern, rather than an invented finding about every contract term.
The complaint describes assessments but alleges that the relevant provider fell outside their scope. Counting reports therefore gives a different answer from examining whether a report covers the actual service and exposure. The study identifies the required comparison: legal entity, provider, information types, systems, locations, assessment period and exclusions.
| Input received | Reasoning step | Review output |
|---|---|---|
| A favorable assessment | Compare its scope with the specific outsourcing relationship | Identify coverage or a documented gap |
| A contract on file | Inspect operative safeguard duties and parties | State supported obligations and missing evidence |
| A completed questionnaire | Determine what was represented and what was tested | Preserve limits on assurance |
The useful output is a reasoned basis for reliance: why this provider may handle this information, which evidence supports that conclusion, and what conditions require reassessment. It remains possible for the review to conclude that more evidence is needed.
The service-design paper considers an approved provider whose assessment is later withdrawn or whose processing location changes. The affected approval depends on the earlier scope and evidence. A review workflow should identify the dependent conclusion, preserve its historical basis and require replacement support before treating it as currently justified. This is a proposed operating scenario, not a customer incident observed in the study. [C3]
| Recorded exercise | Observed result | What it establishes |
|---|---|---|
| Isolated authority exercise | 11 assertions passed; one reference worker dispatched | Selected scope/accounting behaviors in a disposable local setup |
| Supplied acyclic plan | Accepted by validator | The supplied planning representation met selected checks |
| Cyclic successor | Rejected | Cycle refusal on that supplied representation |
| Native review preflight | HOLD; payload did not execute | The selected runtime prerequisites were not satisfied |
The authority exercise included an explicitly supplied unknown settlement. It preserved an unresolved reservation rather than counting the action as complete or automatically refunding it. That unknown was an accounting test input, not evidence that a second external worker failed. The study dispatched one worker. This distinction prevents a synthetic test from becoming an invented operational incident. [C4]
The workflow can prepare permitted evidence requests and review tasks. Disputed interpretations, exceptions and acceptance remain assigned to the actual accountable owner. A plan and a favorable mechanical check cannot establish legal correctness or enlarge an engagement’s permissions.
| Review issue | Repair and consequence |
|---|---|
| Claims implied absent documents | Reframed the case around effectiveness, scope and operative terms. |
| Generic standards risked rebuilding existing controls | Mapped application obligations to the existing HSDLG foundation. |
| Local success could imply a deployed service | Separated specification, inspected code, executed mechanics and operational qualification. |
| Evidence could imply independent assurance | Disclosed producing-assistant semantic review and retained native preflight hold. |
The paper proposes ten selected vendor relationships over four weeks, with at least thirty paired tasks if the permitted event population supports them. These are starting bounds, not a powered trial or a claim that customers have supplied that population. Freeze inputs, reference judgments, issue definitions and effort accounting before inspecting outcomes. [C3]
Competent reviewers should assess correct findings, material misses, unsupported findings and the effort needed to reach an accepted result. Count preparation, integration, model usage, review, correction and administration. A faster initial draft can still increase total effort. Repeated tasks within one vendor should not be counted as independent organizations.
[C1] FTC, Ascension complaint, December 22 2021, paragraphs 7-8 and 14-21: https://www.ftc.gov/system/files/documents/cases/1923126ascension_complaint.pdf
[C2] FTC Decision and Order, same date: https://www.ftc.gov/system/files/documents/cases/1923126c4758ascensionorder.pdf . Allegations and settlement obligations remain distinct; this study does not determine current compliance.
[C3] Making AI-Native Compliance Infrastructure Real, sections on maintained reliance and proposed pilot.
[C4] Research and Review Companion, sections on actual execution and repairs. Both supplied in the original final project archive.