Publications
Controlled public records.
DDCAL intends to publish controlled methodology, quality, and technical documents with explicit revision and status information.
Registry status: Active. Released public assessments are listed with target revision, findings, limitations and disposition.
Assessment reports: Browse the public Reports registry for released worked assessments and their public evidence.
Public assurance report boundary
A public DDCAL assurance report is claim-bounded. Where applicable, the public record identifies the assessed claim, target, scope, exclusions, evidence basis, findings, adverse findings, unresolved findings, limitations, uncertainty, disposition, and any material relationship or conflict declaration needed to understand the result.
Public reporting does not require publication of every internal artifact. A public conclusion must remain supportable by the evidence that is authorized for disclosure, and restricted or hidden implementation material must not be used to justify a broader public claim.
Protected method and publication authority
DDCAL separates transparent assurance conclusions from protected implementation detail. Internal decision logic, thresholds, verifier topology, routing, challenge construction, attack payloads, unpublished vulnerabilities, confidential client material, private repositories, credentials, sensitive infrastructure, recovery mechanisms, detection mechanisms, internal control parameters, and proprietary methods are not public merely because they contributed to an assessment.
Publication authority is explicit. A transparency request, request for a full report, or request for additional evidence does not itself create authority to publish restricted material. Evidence is released only when its disclosure is authorized for the relevant public record and does not violate confidentiality, security, contractual, legal, or protected-method boundaries.
When protected material cannot be published, the public report must narrow the conclusion, describe the limitation at an appropriate level, or record the result as unresolved, INCONCLUSIVE, or NOT ASSESSED rather than relying on undisclosed material to widen the claim.
| Document | ID | Revision | Status | Availability |
|---|---|---|---|---|
| DDCAL-PA-001 — Microsoft Agent Framework FIDES worked assessment | DDCAL-PA-001 | 1.0 | Released — material adverse findings | Full report + evidence |
| DDC Assurance Assessment Execution | DDCAL-TP-002 | 0.1 | Draft for approval | Public methodology summary available on the Methodology page |
| Quality Policy | DDCAL-PL-001 | 0.1 | Draft for approval | Quality commitments summarized on the Quality page |
| AI Assistance and Human Accountability Policy | DDCAL-PL-AI-001 | 0.1 | Draft for approval | AI-assisted work controls summarized on the Quality page |
Revision control
Superseded does not mean erased.
Once the controlled registry is active, superseded and withdrawn documents will retain visible status and revision history rather than being silently replaced.
Report verification
Verification service planned.
A public report-verification registry is planned for controlled DDCAL reports. It will identify report status without exposing confidential assessment evidence.