The Security-Standards Graph — a dev pack
version v0.1 · 9 September 2026 · status: specified, nothing built
🏠 Vault index ↗ › Packs↗ › Security graph
Every security and AI standard tells you what good looks like. None tells you who has to do it, or where. UnGovr publish 327,138 identified bodies and 398 jurisdiction-keyed laws — the anchor nodes our standards graphs are missing. This pack specifies how to connect them without merging a single vocabulary.
| # | File | Holds |
|---|---|---|
| 00 | Start Here↗ | The argument, the strict order, what is already decided |
| 01 | The anchor-node thesis↗ | Why bridging beats merging, in graphs.sgit.ai's own words |
| 02 | The model↗ | Five node classes, fifteen edges with named inverses, provenance fields |
| 03 | The standards map↗ | What exists as a graph, what does not, and the honest state of each |
| 04 | The worked example↗ | The deliverable. One control, one body, one jurisdiction |
| 05 | Integration↗ | Licence to Operate, AIUC-1 conformance, Risk Mandate, the EU AI Act text |
| 06 | Verification↗ | Thirteen tests, five blockers — one closed — and what would make this wrong |
The cheapest thing to do first — done, 9 September
This said: open AIUC-1's vault and read which thirteen frameworks its 1,126 crosswalks point
at. It was done the same day, and it changed the pack rather than confirming it. All thirteen
are AI-specific — no general security control set among them — four are laws, three of those
sub-national US, and the estate already uses anchor: nodes (489 anchors_to edges), so file 01
was corrected to propose a different axis rather than the mechanism. Blocker S1 is closed and
03↗ carries the working.
The next cheapest thing is S3: compare two UnGovr snapshots and measure whether entity ids are stable. If they churn, the anchor thesis fails, and no amount of the rest of this pack survives it.
Published before the work
Nothing here is built. Five of thirteen acceptance tests pass and all five are inherited from
what this vault already did on the government side — one more is asserted and seven are
unevidenced. The pack ships first so it can be checked against
whatever gets built, which is the method this estate argues for, applied to itself.
This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).