Licence

This pack

Everything in this brief pack — all eight numbered markdown files, 08__source-manifest.csv, sources__docs-diniscruz-ai-risk.json, this file and README.md — is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).

Attribution: Dinis Cruz, with AI co-authorship (Claude, Anthropic). Where a source document names model co-authors, carry those names forward.

CC BY is irrevocable. That is deliberate: the point is that these documents remain readable, quotable and re-mixable by the author, by other people, and by agents, permanently and without asking.

The site this pack commissions

The entire content of risks.sgit.ai — every page, every file under /documents/, /llms.txt, /llms-full.txt, and the admin surfaces — is to be published under CC BY 4.0, consistent with the rest of the *.sgit.ai network. Put the licence in /llms.txt, in the page footer, and as a line at the foot of every raw markdown document:

This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).

Use licence-audit.py (shipped in the graphs.sgit.ai pack, file licence-audit.py) in --check mode as a CI gate so the stamp cannot silently drift.

What this licence does not cover

Three categories carry different regimes. Do not assume CC BY where it does not apply.

Material	Regime	What the site must do
The 8 prior-art articles on `docs.diniscruz.ai` (Feb–Jul 2025, 59,131 words)	CC0 1.0 as published on that site	CC0 is more permissive than CC BY, so republishing under CC BY is legally fine — but attribute anyway, and keep `rel="canonical"` pointing at the original URL plus the recorded `first_published` date. See `sources__docs-diniscruz-ai-risk.json`.
Source PDFs and LinkedIn posts referenced in that JSON	As originally published	Link, do not mirror silently. Record `source_pdf` and `source_linkedin` in front-matter.
Vault contents at `sgit.ai/demos/vaults/`	Per-vault; read keys are publishable, write keys never	Before linking a vault from `risks.sgit.ai`, confirm the write key is escrowed. Publishing a read key for a vault whose write key is lost freezes it permanently. Each vault should carry a `PUBLIC.md`.
Tier-3 rows in the manifest (4 rows)	Internal — commercial terms, competitor naming, investment scenarios	Do not publish, do not quote, do not paraphrase. They are listed so you know they exist and know to skip them.

Third-party names

The corpus names real organisations (two large risk-management vendors [REDACTED · Tier-3 · see PUBLIC.md], AWS, MITRE), real frameworks (EU AI Act Article 26(5), MITRE ATT&CK T1110.004) and real people. Naming a framework or citing a technique is fine. Reproducing a competitor map, or attributing a position to a named company, is not — that material is Tier-3 for exactly this reason. See 06__boundaries-and-house-style.md § redaction watch-list.

This file is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).