change_id: CHG-2026-014913
risk_class: R2
autonomy_tier: A2
controls: ['TRC-01', 'CHG-04']
data_classification: internal
originator: olaf@freundcloud.com
agent_identity: svc-agent-platform
model_route: gateway/tier-frontier
supersedes: None
Requirements
R1 — Regulatory currency
The EU AI Act citation in §2 is correct as written and was verified at EUR-Lex during this change: Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), published in the Official Journal 24 July 2026, in force 27 July 2026. It is extended, not corrected, with the two facts a compliance reader needs next: Annex I embedded high-risk moves to 2 August 2028, and Article 50 transparency was left in place at 2 August 2026.
Article 4 (AI literacy) is added. In force since 2 February 2025, national enforcement from August 2026, applying to providers and deployers, proportionate to role and risk.
UK is added to §3: BoE/PRA confirmed a technology-agnostic approach on 1 April 2026, AI adoption is a named PRA 2026 supervisory priority, and HM Treasury must designate major AI and cloud providers as critical third parties by end-2026.
R2 — Honest evidence
§2 gains the productivity counter-evidence: METR’s RCT (19% slower, believed 20% faster) and DORA 2026’s J-curve and amplifier findings. §9’s Tier 3 argument is rewritten to rest on the perception gap, which is a stronger foundation than assertion.
Every statistic in the document either gains a primary source or is removed.
R3 — Threat model with identifiers
§8.5’s four paragraphs are mapped onto OWASP ASI01–ASI10, and the four unaddressed risks (ASI07 inter-agent communication, ASI08 cascading failures, ASI09 human-agent trust exploitation, ASI10 rogue agents) are added. ASI09 is the risk the autonomy matrix already manages and never named.
Four named 2026 incidents are attached to the principles they demonstrate: Clinejection, the “Comment and Control” class across three vendors, the LiteLLM PyPI backdoor, and ClawHub. The LiteLLM incident is placed in §5.1 deliberately — it makes the gateway this playbook recommends into a supply-chain target, and omitting it would be advocacy rather than analysis.
R4 — Identity, without a sixth plane
§5.2 absorbs identity: issuance, scoping, rotation and revocation of agent machine identity; SPIFFE/SPIRE and short-lived SVIDs as the mechanism; and the honest limit that SPIFFE is an identity foundation which does not decide authorisation or preserve delegated human authority. §5 keeps five planes. See the intent’s out-of-scope note for why.
R5 — Standards actually used, not just listed
§8.4’s “Maps to” column gains specific references rather than framework names: NIST SP 800-218A, ISO/IEC 5338 (AI system lifecycle processes — the direct analogue of §7), and ISO/IEC 42001 with its practical framing as voluntary but appearing in procurement.
§5.3 gains MCP’s governance position (donated to the Agentic AI Foundation under the Linux Foundation, December 2025) and its registry risk (admission on repo/domain ownership alone; no code review, no scanning; post-adoption modification), plus the NSA/CISA MCP security design guidance of June 2026.
§5.5 gains AI-BOM: CycloneDX 1.6 ML-BOM, SPDX 3.0.1 AI and Dataset profiles, the unratified CycloneDX Agent BOM proposal, and AI Act Art. 11 / Annex IV as the driver.
§6 names spec-driven development and cites GitHub Spec Kit as a portable implementation and AWS Kiro as the counter-example where spec, model and billing share one perimeter.
R6 — Readable without an engineering background
Added, in front of §1: a “Who should read what” table, an “In plain terms” page of roughly 400 words with no acronyms, and one analogy carried through the document — an agent as a fast contractor with no site induction and no site pass, with each plane as the control that would govern such a contractor.
Added throughout: one italic line under each section heading stating that section’s point in plain English. Added as Appendix E: a glossary of the terms the document assumes.
Added to §1: the Substitution Test restated once in board language.
Two diagrams for the five planes and the request path, which currently exist only as prose. They are ASCII inside fenced blocks, matching the chain diagram §6.1 already uses — the site runs kramdown with rouge and no mermaid plugin, so a mermaid block would publish as literal source.
R7 — No claim this repository cannot back
Article 4 literacy and the maintainability metric are organisational controls with no
executable analogue here. They are recorded in docs/playbook-map.md’s Deliberate
departures table. They must not appear in that document’s §8.4 or §9 rows, which assert
what this repository actually runs.
site/build_pages.py hardcodes a v1.0 lede and is updated, so the published site does not
misdescribe its own source.
Policy conflicts
None. No control objective, risk class, autonomy tier or frozen path is changed by this
change. policy/ is deliberately untouched — see the plan’s Rejected section.
Verification
make build test lint gates— TRC-01 in particular, which refuses any path no plan claims.make substitution— must remain 12/12; Appendix C is unchanged by design.python site/build_pages.py— the playbook page renders and its lede matches the version.grep -rn "five planes"— the count is unchanged everywhere, cast included.- Every citation resolves to a primary source.