# ACAM Annex: Conflicts Declaration (A5) **Version 0.1.0-draft** · Status: **draft for review** · License: **CC BY 4.0** · apeiris.ai > Part of the ACAM release unit (`ACAM-SPEC.md` §17 V-1); versions with the standard. > Normative for: `ACAM-SPEC.md` §15.2 (ID-2/ID-3/ID-4) and CAP-23. Machine-readable half: > `acam/acam-conflicts.json` (question set, bright-line rules, aggregation rules as data). > Design of record: `../COVERAGE_ASSESSMENT_PLAN.md` §6 (identity + conflicts shipped > together), §13 (three-model union + bright-line list), §14/B8 (engagement-level > aggregation); round-2 finding Q4 in > `../requirements/VALIDATION-FINDINGS-2026-08-06-acam-round2.md`. > > The A1 drafting discipline applies: every normative clause carries an **Enforcement:** line. > Verifier and schema mechanisms named below are WS-B work (B1/B4) — specified here, not yet > implemented. --- ## 1. Purpose and the pairing rule The conflicts declaration records **what could bias the assessment**, in machine-readable form, inside the signed dossier. It exists because ACAM deleted the word "independence" program-wide: ACAM does not certify anyone independent; it records the facts a relying party needs to judge bias for itself, and it refuses the worst tier outright. - **PAIR-1 (identity binding never ships without conflicts).** Identity binding (ID-1) and the conflicts declaration are one schema release and one validation unit. A dossier that presents assessor identity-binding fields without a complete conflicts declaration fails validation — not merely the unanswered-question case of CAP-23, but the structural absence of the block. Rationale, stated plainly: verified identity without conflicts disclosure is worse than anonymity — a resolvable organizational identity invites trust that the missing declaration cannot support. Enforcement: schema — the identity-binding block and the conflicts block are co-required (`dependentRequired` both directions); the verifier refuses to evaluate ID-1 bindings on a dossier whose conflicts block is absent. - **PAIR-2 (completeness, not vibes).** "Complete" means: every question in §2 present with a well-typed answer. Missing, null, or type-invalid answers are unanswered; an empty list is a valid answer only where the answer type is a list. Unanswered ⇒ **the dossier fails validation** (CAP-23 — a validation failure, never a disclosed gap). Enforcement: schema `required` over the full question set + CAP-23 in the verifier; no partial declarations. **Who declares.** The declaration is made by the **assessor of record** (Assurance Basis `F`), by **every contributor** in a composite dossier (CO-8), and by the organization itself under Tier `S` (where most answers are structurally `self` — that is not a defect; the Assurance Basis discloses self-assessment, and the declaration still binds the answers to signatures). The Apeiris review lane records its own side under RC-5. Enforcement: schema requires one declaration per signing party; the composite partition check (CO-1) cross-references them. ## 2. The question set (CONF-01..CONF-11) The closed question set. Ids, answer types, and enums ship as data in `acam-conflicts.json` (`questions`); the schema generates from that file, so prose and machine form cannot diverge. Enforcement: the JSON is the normative machine form; a schema whose question set differs from it fails the release consistency check (V-3 contract-diff discipline). | Id | Question | Answer type | |---|---|---| | CONF-01 | Role involvement: for each in-scope control family, has the declarant advised on, designed, implemented, or operated any control in that family within the assessment window? | per-family records `{family_prefix, involvement}`; `involvement` ∈ `none · advised · designed · implemented · operated` | | CONF-02 | Prior-period involvement: any CONF-01-class involvement in the lookback period (24 months preceding the assessment window; draft value, decision C-1)? | same per-family shape, over the lookback | | CONF-03 | Fee contingency: does any fee, discount, credit, refund, or referral compensation of the declarant vary with any outcome of the assessment? | boolean | | CONF-04 | Vendor interest: any financial, reseller, referral, or distribution interest in any vendor or product cited in the dossier? | list of `{vendor, interest_type, description}` (empty list = none) | | CONF-05 | Declaration boundary: do these answers cover affiliates and subcontractors participating in the engagement? | `declaration_boundary` ∈ `assessor-only · assessor-and-affiliates · assessor-affiliates-and-subcontractors`, plus the list of participating affiliates/subcontractors | | CONF-06 | Fee concentration: fees from this client group as a share of the declarant's gross assessment revenue, trailing 12 months, with the basis of the figure. | `{percent: 0..100, basis ∈ audited · management-accounts · estimate}` | | CONF-07 | Selection and payment: who selected the declarant and who pays? | `selection_payment` ∈ `subject-selected-subject-paid · subject-selected-third-party-paid · third-party-selected-subject-paid · third-party-selected-third-party-paid`, plus payer identity where a third party pays | | CONF-08 | Assessor dependency on client product: do the declarant's own operations depend on the subject's products or services? | boolean + description when true | | CONF-09 | Partner compensation and reciprocal referrals: any referral fees, revenue shares, or reciprocal engagements between the declarant and the subject or the subject's advisors or cited vendors? | list of `{party, arrangement, contingent_on_outcome}` (empty list = none) | | CONF-10 | Safeguards applied: which safeguards mitigate the disclosed items? | list from the closed enum `team-separation · cooling-off-period-observed · fee-cap-applied · secondary-review · recusal-from-family · disclosure-to-intended-users · other-described`; must be non-empty whenever any of CONF-01/02/04/08/09 is non-clean, and must state `none-required` explicitly otherwise | | CONF-11 | Duty-to-update acknowledgment: the declarant acknowledges the §5 post-signing duty to update. | boolean; must be `true` | Rules bound to the set: - **CQ-1** — a boundary narrower than the actual engagement participants (CONF-05) is a validation failure, not a disclosure: an engagement with participating subcontractors and `declaration_boundary: assessor-only` fails. Enforcement: verifier cross-check of CONF-05 against the composite contribution manifest (CO-5) and the engagement staffing declaration. - **CQ-2** — CONF-10 with an empty safeguard list next to a non-clean disclosure fails validation (the safeguard question may never be silently skipped). Enforcement: schema conditional requirement over the computed "non-clean" predicate (published in `acam-conflicts.json` `non_clean_predicate`). - **CQ-3** — CONF-11 `false` or absent fails validation. Enforcement: schema `const: true`. - **CQ-4** — answers are facts as of the signature date, and every answer travels inside the signed payload; a projection that strips the conflicts block while keeping verdicts is non-conforming (the AB-2 pattern). Enforcement: verifier output carries the declaration digest on the dossier root; rendering conformance tests a stripped projection. ## 3. The bright-line prohibited-conflicts list (refusal, not disclosure) Entries on this list are **grounds for refusal**: a declaration matching a bright line fails validation rather than rendering as a disclosed conflict (ID-3). There is no safeguards-and-proceed path for a bright-line match. The list ships as data (`acam-conflicts.json` `bright_lines`, each a computable predicate over recorded answers). **Scope of the bright lines.** BL-2 and BL-5 apply to external assessors of record and contributors (Assurance Basis `F`, and the Apeiris side of lane `R` per RC-5); they cannot apply under Tier `S`, where the organization assessing itself is the disclosed design of the tier, not a conflict. BL-1, BL-3, BL-4, and BL-6 apply in every lane where the role exists. Enforcement: each bright-line rule in the JSON carries an `applies_to_basis` field; the verifier evaluates only in-scope rules. | Id | Bright line (predicate over answers) | Why refusal | |---|---|---| | BL-1 | **Outcome-contingent economics.** CONF-03 `true`, or any CONF-09 arrangement with `contingent_on_outcome: true`. | Design-of-record invariant 6: no fee, discount, credit, or refund may vary with outcome — in substance, including referral channels. | | BL-2 | **Self-review (Tier F).** The assessor of record, an affiliate, or a participating subcontractor `designed`, `implemented`, or `operated` any in-scope control within the assessment window or the CONF-02 lookback. (`advised` is disclosure + mandatory safeguards, not refusal — draft decision C-2.) | An external assessor evaluating its own build work cannot be cured by disclosure; the evaluation is the review of its own prior conclusions. | | BL-3 | **Engagement fee concentration ≥ 50%** (draft threshold, decision C-3), evaluated against the §4 engagement-level aggregate, never only per-assessor. | Past the threshold the engagement's economics depend on this client; disclosure does not change the dependency. | | BL-4 | **Ownership or control.** Declarant and subject under common control, or the declarant or its engagement personnel hold any direct equity or profit interest in the subject. | A direct interest in the subject's outcomes is the textbook uncurable case. | | BL-5 | **Reciprocal assessment.** The subject (or its affiliate) currently serves as assessor of record on any unexpired dossier of the declarant. | Mutual assessment creates symmetric leverage on both records. | | BL-6 | **False declaration.** Any statement in the conflicts declaration shown false. Before signature: refusal at intake. After signature: the revocation path (§5), and for review records the `unable-to-complete` machinery where discovered mid-engagement. | The declaration is the trust root of the whole block; a false one poisons every answer. | Enforcement, list-wide: the verifier evaluates every in-scope bright-line predicate on every validation run; a match is a validation failure with the rule id in the output; the defective-dossier conformance corpus (B5) contains ≥1 triggering specimen per rule. A bright-line match is never rendered as a disclosed conflict. ## 4. Engagement-level aggregation (composites) Per ID-4 and CO-8: composite engagements evaluate the bright lines and concentration thresholds against the **aggregate across assessors**, because per-assessor views hide engagement-level dependency. Rules (shipped as `aggregation_rules` in `acam-conflicts.json`): - **AGG-1 (aggregate evaluation).** Every bright line evaluates once per declarant AND once at engagement level over the union of declarations. An engagement fails if any evaluation fails. Enforcement: the verifier runs both passes; the composite conformance corpus includes a specimen that is clean per-assessor and failing in aggregate. - **AGG-2 (fee-concentration arithmetic).** The engagement-level fee concentration is the **sum of the per-assessor CONF-06 percentages**: `engagement_fee_concentration = Σ per-assessor percent`. Worked example: three assessors each declaring 25% → engagement level `25 + 25 + 25 = 75%` — ≥ the 50% bright line (BL-3), so the engagement is refused even though no single declaration trips the line. The sum is a deliberate fail-closed proxy: the addends have different denominators (each assessor's own revenue), so the sum overstates rather than understates engagement dependency; a composite that wants a lower figure must decompose into engagements that clear the line individually. Enforcement: pure arithmetic over recorded CONF-06 fields; the verifier computes it; it is never authored. - **AGG-3 (union semantics for involvement).** CONF-01/02/04/09 evaluate at engagement level over the union of all declarants' answers, with each item retaining its declarant of origin. A BL-2 or BL-5 match by any contributor fails the engagement (a conflicted contributor's scope cannot be quietly reassigned after the match — reassignment is a new engagement-level declaration event). Enforcement: verifier set-union pass; the contribution-withdrawal states (CO-6) govern any post-match restructuring. - **AGG-4 (no partial declarations in composites).** CAP-23 applies per declarant: one contributor unanswered ⇒ the composite fails validation. Enforcement: CAP-23 evaluated over every declaration in the contribution manifest. ## 5. Duty to update (post-signing) The declaration speaks as of signature, but conflicts arise afterward; the round-2 finding requires post-signing threats to carry a duty to update. Rules: - **DU-1 (window).** The duty runs from dossier signature until `dossier_expires` (§12.1); for review records, until record expiry or revocation. Enforcement: the window is computed from recorded fields; the verifier evaluates update timeliness against it. - **DU-2 (trigger + deadline).** Any event that would change an answer to CONF-01..CONF-09 must be declared in a signed **`conflicts-update`** record within **10 business days** of the declarant learning of it (draft value, decision C-4). Enforcement: the update record carries `event_date` and `known_date`; the verifier flags a late update as exception class 12 (`disclosure`) in the review lane. - **DU-3 (append-only, rendered alongside).** Updates are append-only sub-records referencing the original declaration; nothing edits or supersedes the signed answers in place (the DOM-3 discipline applied to conflicts). A conforming renderer shows the original declaration and every update together. Enforcement: schema — the declaration has no mutable fields; updates reference it by digest; rendering conformance tests an update-stripped projection. - **DU-4 (post-signing bright-line match).** An update whose facts match a bright line makes the artifact **revocation-eligible**: for review records, the published revocation machinery applies; for dossiers, the verifier reports the match on every subsequent validation run (the dossier does not silently retract, it visibly fails forward). Enforcement: verifier re-evaluates bright lines over declaration + updates on every run. - **DU-5 (failure to update).** A conflict shown to have arisen in-window and gone undeclared past the DU-2 deadline is treated as BL-6 (false declaration by omission). Enforcement: same predicate path as BL-6. ## Annex: draft decisions flagged for founder review - **C-1** — the CONF-02 lookback is 24 months. - **C-2** — `advised` involvement is disclosure + mandatory safeguards (CQ-2), not a BL-2 refusal; `designed`/`implemented`/`operated` are refusal. - **C-3** — the BL-3 engagement-level fee-concentration threshold is 50%. - **C-4** — the DU-2 update deadline is 10 business days from knowledge. - **C-5** — AGG-2 uses straight summation of per-assessor concentrations (the conservative proxy) rather than a fee-weighted engagement denominator.