The seams table, the money controls, the law map by trigger, the governance skeleton, the monitoring cadences, the phases, and the open decisions — tracking the working plan of July 11, 2026 section by section. The plain-words page is the story; this is the machinery. Cybersecurity (authentication mechanics, keys, transport, backups) is a separate plan; the boundary and handshake are §11 below, same as in the plan.
The plan's first move is an audit claim: most of an enterprise FWA program exists here as design facts. Each row is checkable — diligence verifies it.
| Enterprise FWA control | KISOP control | Status |
|---|---|---|
| Access monitoring & DLP | Deny-by-default consent gate; exact-match grants (a grant of class G admits only class G); one append-only log line per access; fail-closed if the log can't be written | ★ BUILT — pna-mcp, 268 tests incl. 90-test independent adversarial suite |
| Insider-snooping detection | The owner reads their own complete access log; C0 (sealed) is absent in text and shape — even to emergency access | ★ BUILT |
| Central-breach exposure | Archives are person-held at the person's chosen rung (binder → laptop → reference build → hardened). No central archive exists. | ★ BUILT (doctrine + running v1) |
| Segregation of duties on funds | Money movement is a blocking human gate: funder pledges, named job owner releases; escrow at an independent fiscal host | ▲ DESIGNED — jobs board rules v1, pre-launch |
| Anti-embezzlement (platform float) | Circle settlement is integer-cent, person-to-person, through_kisop:false. The platform never holds a dollar | ★ BUILT — 143-test exchange engine |
| Expense transparency | Open registers: budgets, compliance, provenance are public surfaces | ▲ DESIGNED — Trust page live, registers fill at launch |
| Records retention & tamper-evidence | Supersede with version chains; nothing is ever deleted; provenance on every item; scheduled hash verification (pna verify) | ★ BUILT |
| Anti-dark-patterns | Time-in-app counts as an anti-metric. No engagement economy exists here. | ★ BUILT (by absence, stated in the PRD) |
| Vendor lock-in abuse | KISOP-compatible clause 5: the archive stays fully usable when any tool is uninstalled or unpaid | ▲ DESIGNED — conformance test of the open standard |
| Scam-contact surface | Sharing is pairing-gated, known-people-only; circle invites are blind; envelopes are utterance-only. A consented sentence travels. The calendar never leaves the archive | ★ BUILT — sharing rail + circles, 400-test suite |
| Background screening | T0–T4 ladder: no screening at application; FCRA-compliant checks at trust roles; individualized assessment; no credit checks ever | ▲ DESIGNED — Screening Policy v1.0, counsel-pending |
| Human-in-the-loop | Gold gates (named human, blocking) on consent, money, publishing, clinical; purple review (logged, append-only) on all agent output | ★ BUILT as doctrine; enforced at the gate where wired |
The inversion: ordinary platforms centralize data and buy fraud detection to guard the pile. KISOP holds no pile. Monitoring runs member-side (§8), and the platform sees only seam metadata. That is the control.
| Participant | Dominant FWA exposure | Primary defense |
|---|---|---|
| Archive owner | Identity theft (classic + medical), scams, coerced consent, record tampering | Identity spine §3; gate + provenance; duress-aware design §6 |
| Seniors / people in decline | Delegate financial exploitation, undue influence over grants | Trusted second contact; decline-mode second eyes; mandated-reporter SOP |
| Minors & teens | Guardian overreach; the majority-transfer seam | Graduated consent; transfer ritual; COPPA/FERPA posture §9 |
| Caregivers / People Circle | Scapegoating; scope-creep accusations | Verb+partition-scoped grants; the log protects the delegate too |
| Community Helpers | Impersonation; false credential or scope claims; kickback-shaped compensation | Helper register + credential labels §3.4; session evidence trail; compensation rules §4 |
| Solution Centers | Funds-touching fraud; accidental-franchise exposure | T4 dual signoff; open budgets; franchise-or-not counsel item |
| Circle members | Organizer/shopper theft, receipt inflation, no-shows | Formation controls (built): blind invite, all-ack-or-cancel, verified savings, local-C1 vouch |
| Funders (backers, donors, sponsors, government) | Non-delivery, diversion, double-funding, sybil pledges | Escrow + milestones + open registers; Other-Support controls §4 |
| Builders | Rigged selection; others' self-dealing | Public selection rationale; no-self-dealing rule |
| Clinicians / credentialed verifiers | Credential spoofing; registry liability | Primary-source license verification (T2); verified-as-of stamps |
| Researchers / the commons (C4) | Fabricated cohorts; re-identification scandal | C4 grant terms; de-id standards; no-re-identification covenant §6 |
| AI agents | Poisoned inputs; blame without logs | Agents propose and people decide; review gates; derived+AI-generated provenance marks |
| The ecosystem (from us) | Platform self-dealing; charter betrayal; family-COI optics | Published promises = FTC-enforceable §4; COI firewall; open registers |
Design premise: identity assurance is proportional to what the identity unlocks, asserted at seams. An empty archive you fill with your own life is worth nothing to steal — so enrollment stays nearly frictionless, and proof concentrates where a claim touches someone else's data, money, or trust. Knowledge-based authentication is banned permanently, because a thief can already find the answers in breached data. Higher tiers use document + liveness proofing per NIST SP 800-63A concepts (rev 4 📋), or identity-by-relationship: pairing and vouching among people who already know each other.
| Seam | What a false identity gets | Control today | Hardening | Phase |
|---|---|---|---|---|
| Enrollment (T0) | An empty archive; a waitlist slot | Email verification + the human sentence | Nothing more, by design — more proof at this step would break the thesis | — |
| Pairing (sharing rail) | A channel to one person | ★ Known-people-only; pairing secrets; dup-secret defect fixed | Pairing-hygiene page ("pair in person or by a voice you recognize") | 0 |
| People Circle grant (C3) | Another person's partitions | ★ Blocking gate; scope in plain language; logged | First-grantee confirmation ritual; genetic-info warning on Family-History shares | 1 |
| Emergency (ICE) invocation | The pre-consented slice; C0 excluded even here | ★ Pre-consent + identified invoker + after-notice | After-notice to a second circle member; 100% break-glass audit | 1 |
| Executor mode (death) | The archive, per the person's designation | ▲ Designed | Death-certificate + instrument verification; RUFADAA mapping — the in-tool designation is the Act's "online tool," which takes precedence over the will 📋 | 1–2 |
| Minor → majority transfer | A whole childhood record | ▲ Graduated-consent design | Transfer ritual verifying the teen-now-adult; the guardian cannot stand in | 2 |
| Host certification (T3) | A trusted seat beside vulnerable people | ▲ Screening ladder v1.0 | Public Host register + ID codes; LEIE/SAM exclusion screening once federal dollars flow | 1–2 |
| Host session start | A living room | ▲ Scoped session access | Member-side verify-your-Host code match before first session | 1 |
| Circle join / organizer / shopper | Neighbors' money (bounded) | ★ Blind invite; all-ack-or-cancel; local-C1 vouch; no-show completion | Small-and-local first runs (norms); organizer rotation default | 0 |
| Funded-job builder selection | Community escrow | ▲ Job-owner gate | Published selection rationale; no-self-dealing rule | 0–1 |
| Pledge / donation | A laundering or chargeback vector | ▲ Fiscal-host rails | Documented reliance on host KYC/AML; structuring-pattern eyes on open registers | 1 |
| Benefits assistance (P7) | A beneficiary's programs | ▲ Human-beside-human flow | Hosts never handle credentials. Training and member education both teach the rule. | 1 |
| Research consent (C4) | A cohort seat | ▲ Class-scoped grants | Founder-authored consent strings; IRB posture before first study | 2 |
| Registry contribution | The commons' trustworthiness | ▲ Publication gate + named owner | Primary-source credential verification; verified-as-of stamps | 1 |
| ACCESS attribution | Medicare money | Not yet live | Rides American Care's enrollment integrity; KISOP-side COI firewall | 2 |
Right-of-access supply lines (45 CFR 164.524 + information-blocking rules 📋) pull institutional records to the person, where a local agent diffs them against lived reality. The recovery runbook, with its legal instruments named:
Detect — local watchdog flags the foreign entry: an EOB line, portal record, or collection notice that doesn't match the archive's timeline.
Preserve — the archive is the evidence locker: provenance chain + append-only log make the person's own timeline credible.
Report — FTC IdentityTheft.gov affidavit; police report; provider and payer SIU letters (template pack, EN/ES).
Correct — HIPAA amendment requests (45 CFR 164.526) to each record holder; accounting-of-disclosures requests (164.528); credit-side FCRA §605B blocks, fraud alerts, freezes 📋.
Follow — stale-marking on each open correction until closed; the countdown pattern from Action Plans applies as-is.
| Seam | Threats | Controls |
|---|---|---|
| Community funds (jobs board) | Sybil pledge-farming; stolen-card pledges → chargebacks; builder non-delivery; rigged selection; self-dealing; wash-funding | Custody at the fiscal host (their KYC, card-network, chargeback machinery — the reliance is documented; we build none of it ourselves); escrow + milestone release behind the job-owner gate; open register of every pledge and release; no-self-dealing rule (owner ≠ builder, ever — staff who build community jobs go through the same public selection as everyone else); published stall policy: time-boxed → re-bid or refund |
| Buying circles | Organizer/shopper theft; receipt inflation; no-shows | The no-cut design (through_kisop:false) keeps money outside the platform, which may avoid money-transmitter licensing 📋 and prevents platform embezzlement. It also limits remediation: we cannot claw back money we never held. Controls at formation include known people, blind invites, all-ack-or-cancel, savings arithmetic verified against real prices, receipts with provenance, local-C1 vouching, and organizer rotation. Counsel must review warehouse-club membership terms before any pilot |
| Hosts & sessions | Ghost sessions; comp that drifts into kickbacks; steering | Session notes deposited to the member's archive with consent = member-confirmed evidence; the content never leaves the archive; comp rules fixed before the first paid Host: flat fair-market session rates, and pay never varies with referrals, enrollment, or vendor choice; Benefits Finder results are compensation-blind (the Anti-Kickback posture and the trust posture are the same sentence); sponsors buy capabilities-for-everyone; steerage is never for sale |
| Government money | False certifications; double-funding; unallowable costs; exclusion violations; beneficiary inducements | SBIR: truthful eligibility/effort certifications; Other-Support disclosure with a written scope line between Kickstarter-funded and SBIR-funded work (the classic small-award False Claims case, pre-empted); allowable-cost books from day one. ACCESS (Jan 2027, via the American Care lane): participation-agreement program-integrity terms verified against the RFA; monthly OIG LEIE + GSA SAM exclusion screening; CMS-style FWA training in that flow; CMP beneficiary-inducement analysis (nominal-value ~$15/$75 limits; promotes-access and financial-need exceptions) 📋 |
| Donations & crowdfunding | Non-delivery claims; laundering; unregistered solicitation | Kickstarter posture: use funds as represented or refund/account publicly (the FTC's first crowdfunding case set the rule 📋); state charitable-solicitation registration before any fiscal-sponsorship ask; written sponsorship agreement; reliance on fiscal-host KYC/AML documented; structuring-pattern eyes on the registers |
| The platform itself | Self-dealing; charter betrayal; family conflicts | Published promises may create FTC Act §5 exposure if broken; dual signoff on community-adjacent spending (T4); open budget register; a standing conflict register covering the founder's brother/American Care (written exclusion from DUA negotiation and an arm's-length FMV services agreement), Kurt/platform work (two-gate reconciliation routed to the founder), and bounded lanes for family hires |
| Waste class | Control | Plain note |
|---|---|---|
| Duplicate builds | Search-what-exists before any funded job starts (feature table + registers) | Live example, named: two consent-gate implementations exist today; reconciliation is a scheduled checkpoint decision |
| Stalled funded jobs | Published stall policy — time-boxed, then re-bid or refund | Escrowed money sleeping is waste; policy makes it a published process |
| Storage & infrastructure | Person-held archives — near-zero platform storage by design | Every proposal to centralize data adds storage cost and breach risk |
| Verification economics | AI drafts (~1 hr), credentialed human verifies — the paid work is judgment | The published ratio is the waste control and the government-sponsorship argument |
| Grant allowability | SBIR cost accounting from day one | Unallowable spend converts to fraud at the next progress report |
| Over-verification friction | No screening at T0–T1; no identity proofing at the door | Wasted reviewer hours and a thesis violation at once |
| Hidden overhead | Platform/fiscal-host fee stated on every funded job | Overhead hidden is overhead abused |
| Pattern | Design answer | Status |
|---|---|---|
| Delegate / elder financial exploitation | Scope minimization stated at grant time (appointments never require Finances); trusted-second-contact designation (the FINRA 2165 pattern 📋); decline-mode second eyes — consent changes notify a second circle member when supported decision-making is active; Host training + state mandated-reporter SOP (Florida's duty is universal — any person; California names care custodians incl. financial abuse 📋) | ▲ Phase 1 |
| Coerced access / intimate-partner surveillance | Traceless grant re-review (revocation review leaves no trace visible to the grantee); revocation-notification designed not to escalate (batched/naturalized); safety-planning resources at the grant surface; Hosts trained to spot third-party-controlled archives; built with DV-advocacy input | ▲ Phase 1, before People-Circle grants are widespread |
| Insider snooping | No member archives held → enterprise-scale snooping structurally impossible; the gate's owner special-case reaches the founder's own archive only. No operator backdoor into anyone else's exists; keep that sentence true forever; when HIPAA attaches, 42 U.S.C. 1320d-6 criminal tiers apply and sanction policy + training become mandatory 📋 | ★ structural today; ▲ BA-grade internals Phase 2 |
| Sponsor / enterprise abuse | No sponsor ever gets exclusivity (charter red line, written into the enterprise proposal as a clause); no sponsor ever sees member data; the KISOP-compatible mark license forbids exclusivity, data hostage-taking, and privacy violation — violation = termination + public register entry | ◇ mark-license design is a counsel item |
| Data abuse (secondary use, re-identification, discrimination) | Exact-match consent (nothing leaks upward); C4 grants carry de-identification standards (expert-determination vs safe-harbor, 45 CFR 164.514 📋) + a no-re-identification covenant with published sanction; GINA-aware share warnings on Family-History partitions toward employment/insurance-adjacent recipients 📋 | ★ exact-match built; ▲ C4 terms Phase 2 |
| Agent abuse | Agents propose. They never decide (blocking gates); all output logged + reviewed append-only; derived/AI-generated provenance marks; document-borne injection is on the standing attack list — the consequence rule here: no agent output becomes a record without a review gate, so a poisoned document cannot commit fraud alone | ★ doctrine + gate; injection hardening tracked on the attack list |
| Element (OIG GCPG 2023 📋) | Here |
|---|---|
| 1 · Written standards | Charter + the FWA plan + Community Guidelines + Screening Policy + Terms (incl. §15 safe harbor) — published in the open compliance register; the standards are themselves public |
| 2 · Named owner | Integrity sits with the founder now; moves to a named board seat when there is a board. All family conflicts route around the owner via the standing COI register — the integrity owner is never inside a conflicted transaction |
| 3 · Training | Host certification includes FWA + scam recognition + mandated reporting + the "never ask" doctrine. The bigger lever: member education — the scam-awareness kit makes members the sensor network |
| 4 · Open lines | The support phone number also serves as the fraud line. Anonymous reports are accepted; non-retaliation is written; every report is logged and answered |
| 5 · Monitoring & auditing | §8 — designed to respect the architecture (member-side detection, seam-level review) |
| 6 · Enforcement & discipline | Published sanctions ladder ◇: members — education first, removal only for cause with due process (a record is one chapter of a person's story — at exit too); Hosts — retraining → suspension → decertification on the register; builders — selection ban; sponsors/tools — mark termination + register entry; staff — sanction policy per counsel (mandatory once HIPAA attaches) |
| 7 · Response & prevention | Incident playbooks as runbooks: identity-theft recovery (§3.3), elder-exploitation response (report/protect/preserve/APS), coerced-access response (safety-first, DV-informed), funds incident (freeze via fiscal host + public register note), breach duties (the HBNR clock, §9). Every incident ends with a one-page "what changed" register entry. Annual risk assessment re-walks §2 and §3 |
The rule: detection runs where the data lives. The platform cannot mine member archives, because by design it cannot see them.
| Cadence | What |
|---|---|
| 100% | Break-glass invocations reviewed (they should be rare) |
| Monthly | Fast-mover legal watchlist; LEIE/SAM exclusion runs once federal money flows |
| Quarterly | Registers walk + sample of Host sessions confirmed against member-side evidence; legal-framework refresh agents re-walk sources |
| Annually | FWA risk assessment; full legal re-verification (retainers); stale-mark audit (stale >1 yr → fund-or-retire); plan re-versioned; the old version is never overwritten |
Every audit is written to the compliance register with a date and a named reviewer.
Register status: every row below is 📋 — based on working knowledge and pending primary-source verification, including a quotation and fetch date for each framework, plus counsel review of the highest-impact rows. This describes the plan's legal analysis; it is not legal advice. The verification queue appears at the end of the page.
| Trigger | Law / rule | The duty, one line |
|---|---|---|
| Offering consumer Personal Neutral Archive (PNA) tools at all | FTC Act §5 (UDAP) | Keep every published promise or it is a deceptive practice — the post-GoodRx enforcement era reaches health promises |
| Same | FTC Health Breach Notification Rule (16 CFR 318, as amended 2024) | As a likely "vendor of personal health records" for hosted rails: unauthorized acquisition or disclosure = breach → individuals ≤60 days, FTC within 10 business days if ≥500. The truly person-held archive may sit outside "vendor" — posture memo for counsel; operate as covered meanwhile |
| Serving California members | CMIA, Cal. Civ. Code §56.06(b) | Consumer software managing medical information makes the business a "provider of health care" under CMIA — full duties + private right of action. Likely the most directly-attaching consumer-lane law |
| Same | CCPA/CPRA sensitive-data rules | Notice, purpose limits, SPI rights |
| WA members / marketing | Washington My Health My Data (RCW 19.373) | Consent for collection/sharing beyond necessity; authorization for sale; private right of action |
| NY members | NY Health Information Privacy Act (2025) | Broad processing-consent regime — verify current status 🔎 |
| Members in other states | CO/CT/VA/TX/OR/MT + 2026-effective laws; NV SB 370 | Maintain the state matrix as a living framework 🔎 |
| Any breach | 50-state breach-notification laws | Parallel state clocks beside HBNR |
| Becoming a Business Associate (enterprise/ACCESS roles) | HIPAA Privacy/Security/Breach + HITECH; criminal 42 U.S.C. 1320d-6 | BAA duties, minimum necessary, sanction policy, breach notification; criminal tiers for workforce snooping/selling |
| Members pulling their own records | HIPAA right of access (164.524) + Cures info-blocking (45 CFR 171) | Duties sit on providers/HIEs/HIT developers — this asymmetry is the PNA's legal foundation; we become an "actor" only if we operate exchange infrastructure |
| SUD-program records in flows we operate | 42 CFR Part 2 | Person-held is the person's right; intermediary/lawful-holder duties flagged before any Part 2-sourced integration |
| Screening Hosts/staff | FCRA + fair-chance laws + state limits | Governed by Screening Policy v1.0 (standalone) |
| Paying Hosts / Benefits Finder / referrals, once federal-program business exists | Anti-Kickback Statute (42 U.S.C. 1320a-7b(b)) | No remuneration to induce federal-program referrals; comp design per §4; safe harbors papered (personal-services FMV; value-based care-coordination) |
| Free/discounted things to Medicare/Medicaid beneficiaries | CMP beneficiary-inducement (42 U.S.C. 1320a-7a(a)(5)) | Nominal-value limits (~$15 / $75 aggregate) unless promotes-access or financial-need exceptions fit — counsel before ACCESS-lane perks |
| Physician arrangements (later) | Stark (42 U.S.C. 1395nn) | Peripheral now; screen any future clinician comp |
| Lab/SUD-facility arrangements (if ever) | EKRA (18 U.S.C. 220) | Broader than AKS, includes private pay — flag-only |
| SBIR application & award | False Claims Act (31 U.S.C. 3729) + NIH policy + 42 CFR 93 + FAR-based cost principles | Truthful certifications, Other Support, real effort, allowable costs, misconduct process |
| ACCESS participation (via American Care) | CMS Innovation Center participation agreement + program-integrity rules + exclusion authorities (42 U.S.C. 1320a-7) | Records access, reporting, beneficiary protections, marketing rules; monthly LEIE/SAM screening; RFA program-integrity section read is queued |
| Retaining any federal overpayment | ACA 60-day rule (42 U.S.C. 1320a-7k(d)) | Identified overpayments returned in 60 days or reverse-false-claim exposure |
| Kickstarter campaign | FTC Act §5 (crowdfunding precedent) + platform ToS + state UDAP | Use funds as represented; deliver or refund/account publicly |
| Soliciting donations (fiscal-sponsorship route) | State charitable-solicitation registration (~40 states) + IRS private-benefit rules | Register before soliciting; written sponsorship agreement; no inurement — family relationships noted |
| Membership auto-renewal | ROSCA (15 U.S.C. 8403) + state auto-renewal laws | Clear terms, express consent, easy cancel; the FTC click-to-cancel rule was vacated on appeal (2025) — ROSCA + states still bite 🔎 |
| Reminder texts/calls | TCPA (47 U.S.C. 227) + CAN-SPAM | Prior express consent with records; healthcare-exemption fit verified before use |
| Under-13 users | COPPA (16 CFR 312, 2025 amendments) | Verifiable parental consent, retention limits; graduated-consent design maps well; school-authorization path verified 🔎 |
| Hosts in schools | FERPA + state student-privacy (e.g., SOPIPA) | Education records stay in the school lane. Nothing commingles without consent. |
| Serving vulnerable adults | State APS mandatory reporting (FL universal; CA care-custodian incl. financial abuse) + Elder Justice Act context | Mandated-reporter matrix + SOP before the first senior-serving Host — FL and CA first |
| Executor mode / death | RUFADAA (~47 states) | The in-tool designation is the Act's "online tool," taking precedence over the will — align records so the designation is provable |
| Accepting POA/guardianship | State POA/guardianship law (UPOAA pattern) | Valid-instrument verification SOP |
| Circles' money mechanics | State money-transmitter laws / BSA | Stay out of the flow of funds (built); boundary memo so no future feature crosses it 🔎 |
| Solution Center expansion | FTC Franchise Rule + state franchise laws | Mark + significant assistance + fee may create an accidental franchise and FDD duties; counsel must distinguish a mark license from a franchise |
| Legal/jurisdiction registry | State UPL rules | Information-vs-advice line; credentialed authorship + verification |
| EU members (Spain first) | GDPR (Art 9; Chapter V) + EU AI Act + Spain AEPD | Explicit-consent basis; residency answered by in-country archive deployment; AI-Act classification review before EU launch 🔎 |
None of these frameworks is law for us. We adopt them anyway, because they harden the seams.
The law map above is a snapshot; the metabolism is the machine that keeps every snapshot current, across jurisdictions. Seven organs, all assembled from parts that already exist here:
| Organ | Mechanics |
|---|---|
| 1 · Sense | Per-framework watch specs (primary sources, cadence, change definition); scheduled refresh agents — quarterly baseline, monthly fast-movers; human sensors (credentialed members, Hosts) with a visible flag route; trackers and firm alerts are tips; only primary sources enter the register |
| 2 · Triage | Materiality gate against the §9.1 trigger table: which duties, seams, runbooks, consent strings, pages — plus the effective date. Severity: 🔴 operate-blocking (handled before the effective date, company fast lane) · 🟠 lane-gating (resolved before that feature/geography advances; outer bound one quarter ◇) · 🟢 routine (next quarterly cycle). Patch management, for law |
| 3 · Verify | Agent drafts the diff — verbatim quote, fetch date, plain-English restatement; a credentialed owner verifies (the paid work is judgment); verified-as-of stamps; bar/license provenance on authors; UPL line held everywhere |
| 4 · Fund | Change-triggered update jobs + annual verification retainers per jurisdiction page + sponsors (governments funding their own jurisdiction's page; diaspora; market-entry). Failure mode is in the open: an unfunded page goes visibly stale. It is never silently wrong |
| 5 · Disseminate | One verified change → five surfaces: public register diff · plain-words "what changed where you live" EN/ES with term IDs (a Tampa member gets the Florida sentence) · re-versioned job aids and glossary strips, print included · Host training deltas — the human last mile · new legal terms into the terms registry |
| 6 · Implement | The published change cycle with a statutory deadline: runbook version bump → consent-string revision (always a blocking human gate) → mechanical enforcement changes as build jobs (🔴 rides the company fast lane; the crowdfund queue never carries it) → acceptance tests re-run → training → publication-gate go-live. Effective-dated versions sit beside each other — the never-overwrite rule matches how statutes actually work |
| 7 · Propagate | Mark-license holders inherit material changes: the register diff is the notice; material-change re-attestation is the license clause ◇ (counsel designs it) |
Two registers, one metabolism: the inward obligations register (our duties: company cost, always; a platform that crowdfunds its own compliance has abdicated it) and the outward Law & Jurisdiction Registry (the commons: community-funded, stale-marking as its trust metric). Jurisdiction is first-class: duties attach by member geography on the regions/counties spine, and company HQ has no bearing; cross-jurisdiction surfaces default to the most protective participant's rule ◇ (counsel per seam); data-location law is answered by in-country archive deployment, conduct law by the registry; "no page, no launch" ◇: a new geography opens with its verified jurisdiction page, funded by its market-entry sponsor.
| Phase | Window | The work (owners: founder / counsel / verification session / build job / infra) |
|---|---|---|
| 0 — before public launch | now → launch | "Never ask" page EN/ES (launch-blocking candidate) · counsel index worked in priority order · HBNR + CMIA posture memo · Kickstarter disclosure block · charitable-solicitation check (slow, start early) · no-self-dealing + stall policy in jobs-board rules v1 · circle-landing safety language · RUFADAA alignment note · the §9 verification sweep → framework folders |
| 1 — first paid trust roles, SBIR window, circles at scale | fall 2026 | Seam hardening marked Phase 1 (§3.2): grant-confirmation ritual, Host register + codes, second-contact after-notices, pairing hygiene · trusted-second-contact + decline-mode second eyes · duress-aware UX review with DV-advocacy input · Host comp rules + compensation-blind Benefits Finder into agreements · SBIR integrity setup on award (cost books, effort, Other-Support memo) · mandated-reporter matrix + APS SOP (FL/CA first) · member-side watchdog v0 (rendering the existing log) · fiscal-host reliance memo · incident playbooks v1 |
| 2 — ACCESS live + enterprise pilot | 2027 | Medicare program-integrity package (RFA-verified register, monthly LEIE/SAM, CMS-style training, CMP/AKS sign-off on comp + perks) · COI firewall documented + auditable in the open register · BA-grade internals when HIPAA attaches (sanction policy, minimum-necessary, 1320d-6 training) — coordinated with the cyber plan's Security Rule work · mark-license FWA clauses live with first ecosystem tools · first annual risk assessment → plan v2.0 beside v1.0; v1.0 is never overwritten |
Cyber owns: authentication mechanics and credential storage, key custody, transport, endpoint/server hardening, backup/restore, log-integrity machinery, network binding of the gate, injection-attack mechanics, availability. This plan owns: identity proofing and assurance policy, authorization policy, money integrity, human-trust abuse, program-fund compliance, sanctions, redress, victim recovery. The handshake: proofed identity (here) hands off to authenticated sessions (cyber) · break-glass policy (here) rides break-glass implementation (cyber) · logs are written by cyber's machinery and reviewed here on §8's cadences · adversarial findings flow both ways — the gate's owner-spoof and timing-compare findings were cyber-shaped; their FWA consequence (impersonation risk) landed in §3. Joint review at each annual assessment.
This page mirrors FWA-PREVENTION-PLAN v1.0 and LEGAL-METABOLISM v0.1 (both July 11, 2026) — working drafts for counsel. No certification exists. Status labels are per-row; Carmen's review of both documents and this page is pending, and the two ◇-heavy sections ship only on her rulings.
The verification queue (next session-class work): every 📋/🔎 row in §9 → primary source + verbatim quote + fetch date into per-framework folders; the ACCESS RFA program-integrity section read; HBNR/CMIA/MHMD applicability memos with counsel; 2026-effective state privacy laws; COPPA compliance dates; NY HIPA status; the Negative-Option-Rule aftermath; NIST 800-63-4 final status; EU AI Act health-AI classification timeline.
Argue with this plan. If you can name a seam we missed, a control that fails under pressure, or a law row that's wrong, that's exactly the review this page exists to invite: on the main site, Write to us → "feedback," or Write to us → "security" for good-faith testing under the Terms §15 safe harbor.