Sigilith Notes · Research series

The record ofour positions.

Published analysis on institutional AI risk, evidentiary standards, and what it takes for an automated decision to survive review. Every note is dated, classified, and kept, including the ones we would later argue with.

Entries: 14
Extent: 39,867 words
Imprint: Sigilith Research

The catalogue

Classification

014
Folio
FRAMEWORKAUGUST 27, 2026
The Patchwork Has a Pattern: US State AI Laws in 2026, Mapped
Six state regimes now govern automated decisions about people, and no two draw the same lines: Illinois punishes effect, Texas punishes intent, Colorado rewrote its statute with a federal court at its back. A jurisdiction-by-jurisdiction map of US state AI law, verified to August 2026, and the pattern underneath the patchwork: whatever a legislature chose to prohibit, the thing it requires you to produce is paper.
13 min read2,791 words
Retrieve
013
Folio
EXPLAINERAUGUST 27, 2026
Synthetic Identity Fraud: How a Customer Who Never Existed Passes Every Check
The most effective identity fraud does not steal a person; it manufactures one. A plain-language tour of synthetic identity fraud: how a Frankenstein identity is assembled from a real Social Security number and invented details, why a rejected credit application helps bring it to life, why KYC checks keep approving people who do not exist, and what credit washing does to the records everyone else relies on.
13 min read2,911 words
Retrieve
012
Folio
FRAMEWORKAUGUST 27, 2026
Does SR 11-7 Apply to Generative AI? Model Risk Management After SR 26-2
For fifteen years, SR 11-7 told bank model risk teams what a controlled model looks like: inventoried, validated, monitored, documented. In April 2026 the agencies revised the guidance and placed generative AI explicitly outside it. A framework for the interim: which disciplines transfer to large language models, which assumptions break, and the decision-level record-keeping that lets a bank demonstrate control over a system it cannot validate line by line.
13 min read2,927 words
Retrieve
011
Folio
INSIGHT BRIEFAUGUST 27, 2026
Mobile Money Fraud Begins at Onboarding: Two Billion Accounts, One Perimeter
Mobile money passed two billion registered accounts and $2 trillion in annual flows, and every one of those accounts entered through a sign-up: an agent's counter, a phone camera, a registration form. A tour of the public record of remote onboarding fraud (SIM-registration fraud, agent-assisted enrollment, mule-account farming at industrial scale) and of the quieter error on the other side of the same threshold: the first-time applicant wrongly turned away. Onboarding is the perimeter, both of its errors are decisions, and decisions need deciders and records.
13 min read2,837 words
Retrieve
010
Folio
EXPLAINERAUGUST 27, 2026
A Photograph Has No Pulse: How Liveness Detection Decides a Human Is Actually There
Remote onboarding replaced the branch desk with a phone camera, and the camera will faithfully report whatever it is shown: a printout, a replayed video, a silicone mask, an injected deepfake. A plain-language tour of presentation attacks, the countermeasure families that catch them, and how ISO/IEC 30107 measures whether any of it works.
11 min read2,469 words
Retrieve
009
Folio
INSIGHT BRIEFAUGUST 27, 2026
Explainable AI Is Not Evidence: Why XAI Alone Fails Compliance and Audit
Explainable AI answers one question: why might the model have done this. Auditors, regulators, and courts ask another: prove what happened. A tour of what feature attributions and post-hoc rationales can and cannot establish, the documented instability of the methods, what GDPR and the EU AI Act actually require, and why an explanation without a sealed record is testimony without an exhibit.
13 min read2,819 words
Retrieve
008
Folio
CASE STUDYAUGUST 27, 2026
The Dutch Childcare Benefits Scandal, Explained: The Toeslagenaffaire and the Question Nobody Could Answer
A self-learning risk score flagged tens of thousands of Dutch families for fraud investigation, caseworkers acted on scores they could not see into, and when parents asked why, the state had no answer. A case study of the toeslagenaffaire: the largest algorithmic governance failure a democracy has yet produced, and the recordkeeping absence that let it run for seven years.
14 min read3,087 words
Retrieve
007
Folio
CASE STUDYAUGUST 27, 2026
The Arup Deepfake: A $25 Million Video Call, and the Two Controls That Were Missing
In early 2024 an employee in Arup's Hong Kong office joined a video conference in which the CFO and every colleague on screen was AI-generated, then made 15 transfers totaling HK$200 million. A reconstruction of the fraud from police statements and Arup's own confirmation, an account of what the deepfake actually had to defeat, and the two controls (verified live presence, and an authorization gate that seals a record) whose absence the case exposes.
13 min read2,848 words
Retrieve
006
Folio
CASE STUDYAUGUST 27, 2026
The Chatbot Is Not a Separate Legal Entity: Moffatt v. Air Canada and the Liability of Customer-Facing AI
In February 2024, a British Columbia tribunal ordered Air Canada to honor a bereavement refund policy its website chatbot had invented, rejecting the airline's suggestion that the bot was a separate legal entity responsible for its own actions. A close reading of the decision most often searched as the Air Canada chatbot lawsuit: what the tribunal actually held, why every gap in the record resolved against the airline, and the question the ruling leaves for every company whose AI talks to customers.
13 min read2,779 words
Retrieve
005
Folio
FRAMEWORKAUGUST 27, 2026
The First 48 Hours: What a Defensible AI Incident Response Looks Like
Your AI system has produced a harmful, wrong, or unlawful outcome, and the next two days will be examined for years. A framework for the five workstreams that run concurrently after an AI failure: preserve everything, reconstruct the decision, determine reporting duties, communicate without deciding facts, and remediate on the record. And the uncomfortable premise underneath all five: the response is only as good as the records that existed before the incident.
13 min read2,811 words
Retrieve
004
Folio
FRAMEWORKAUGUST 27, 2026
What an AI Decision Record Must Contain to Survive Audit
Auditors, opposing counsel, and internal reviewers all ask the same question of an AI-assisted decision: show me the record. The anatomy of a record that can answer: seven elements, the evidentiary test each one exists to pass, and why the operational logs most organizations rely on fail every test they will actually face.
14 min read3,111 words
Retrieve
003
Folio
FRAMEWORKAUGUST 27, 2026
Who Authorized This Action? Agentic AI Governance and the Missing Approval Record
AI agents no longer draft text for a human to send; they send, pay, file, and provision on their own initiative, across systems that were never designed to ask an algorithm for its credentials. A framework for the question every audit of an agent will eventually reach: who authorized this specific action, under which policy, and where is the record? The answer is an architecture, not a prompt: a policy check before the action leaves, human escalation for consequential actions, and a sealed record of every authorization.
13 min read2,851 words
Retrieve
002
Folio
CASE STUDYAUGUST 7, 2026
1.1 Billion Decisions, No Record: What Mobley v. Workday Reveals About AI Evidence
A federal discovery order in Mobley v. Workday exposed a structural problem: when an AI system helps make a decision, no single party may hold the record needed to explain it. An analysis of what happened, what it costs, and why the compliance deadline just moved away from you while the evidentiary demand did not.
21 min read4,597 words
Retrieve
001
Folio
INSIGHT BRIEFJANUARY 26, 2026
The AI Audit Gap: Why “Logs” Aren’t Evidence
Analysis of the decoupling between Generative AI adoption and institutional recordkeeping standards. Why operational telemetry fails the test of defensible assurance.
5 min read1,029 words
Retrieve

Positions are cheap. Records are not.

If the arguments here describe a problem you already have, the product is the shorter conversation.

See the platform Request access

The record ofour positions.

The Patchwork Has a Pattern: US State AI Laws in 2026, Mapped

Synthetic Identity Fraud: How a Customer Who Never Existed Passes Every Check

Does SR 11-7 Apply to Generative AI? Model Risk Management After SR 26-2

Mobile Money Fraud Begins at Onboarding: Two Billion Accounts, One Perimeter

A Photograph Has No Pulse: How Liveness Detection Decides a Human Is Actually There

Explainable AI Is Not Evidence: Why XAI Alone Fails Compliance and Audit

The Dutch Childcare Benefits Scandal, Explained: The Toeslagenaffaire and the Question Nobody Could Answer

The Arup Deepfake: A $25 Million Video Call, and the Two Controls That Were Missing

The Chatbot Is Not a Separate Legal Entity: Moffatt v. Air Canada and the Liability of Customer-Facing AI

The First 48 Hours: What a Defensible AI Incident Response Looks Like

What an AI Decision Record Must Contain to Survive Audit

Who Authorized This Action? Agentic AI Governance and the Missing Approval Record

1.1 Billion Decisions, No Record: What Mobley v. Workday Reveals About AI Evidence

The AI Audit Gap: Why “Logs” Aren’t Evidence

Positions are cheap. Records are not.