When the Frameworks Are Free

On January 13, 2026, FedRAMP published a request for comment that almost no one outside the federal compliance world noticed. RFC-0024 did something quietly radical: it told every cloud provider in the program that the narrative document — the System Security Plan written in prose, the binder of attestations, the artifact that describes security — was being retired in favor of machine-readable packages. The dates are real: an initial deadline in September 2026, a final one in September 2027. Pair it with FedRAMP 20x, which replaces narrative controls with automatically validated Key Security Indicators, and the message is unambiguous. The government is no longer asking what you have documented. It is asking what you can demonstrate.

That is the whole story, if you know how to read it. And it is not happening only in federal procurement.

Listen to the loudest currents in security and governance right now and they are all, in different dialects, saying the same sentence.

The GRC engineering movement says: stop collecting evidence that a control exists and start proving that it executes. The cyber-risk quantification crowd, FAIR and its descendants, says: stop coloring heatmaps red and amber and start expressing loss exposure in dollars a board can act on. FedRAMP 20x says: stop narrating how you rotate keys and emit the configuration as data. And on the AI side, the EU AI Act, ISO 42001, and the NIST AI Risk Management Framework all say the same thing in regulatory cadence: prove your governance is operating, don't assert that it is.

Strip the vocabulary away and the shift underneath is singular. The era of the well-formatted, auditor-approved, framework-aligned artifact is closing. For three decades the deliverable in this field was a document, and the document was a description of intent. The new deliverable is a demonstration of fact. A paragraph that says "we use complex passwords" is being replaced by a machine-readable log showing the complexity rule that is currently enforced. Description is becoming demonstration, and demonstration is becoming continuous.

This is not a tooling story. It is a story about what counts as proof.

Here is the part that should reorganize how every leader in this space thinks about their moat.

The raw material of compliance — the control catalogs, the relationship maps between frameworks, the threat taxonomies, the exchange formats — is becoming free, public, and machine-readable, all at once.

The control catalogs are public domain. NIST SP 800-53, 800-171, the Cybersecurity Framework, the AI RMF — these are works of the U.S. government, free to use, modify, and build on. NIST distributes them as structured data through its Cybersecurity and Privacy Reference Tool, and expresses the whole authorization lifecycle in the Open Security Controls Assessment Language, OSCAL — a format explicitly designed so that one control, implemented once, can be reused across FedRAMP, CMMC, SOC 2, and the rest.

The crosswalks are public too. NIST's Online Informative References program publishes standardized, typed relationships between frameworks, and its derived-mapping engine lets you bridge any two reference documents that share a common anchor. The threat layer — MITRE ATT&CK for cyber, ATLAS for AI — is offered under a royalty-free license that explicitly permits commercial use and derivative works with attribution. Even the newest AI control guidance, NIST's Control Overlays for Securing AI Systems, is being written in the open, on a public Slack channel, in draft form, right now.

So consider the question this forces. If the frameworks are free, the crosswalks are free, the catalogs are public domain, and the exchange format is an open standard — where, exactly, does the value live?

It does not live in owning a private map of the standards and renting it back to people. That model is not just commercially fragile; it is the very pathology this whole shift is rejecting. When a vendor becomes your "compliance brain" with testing logic you cannot inspect, you have re-created the checkbox audit — the attestation without the assurance, the platform that formed an opinion you were never allowed to question. Building on the public substrate is not a concession. It is the trust position. If the foundation is inspectable, your reasoning is auditable. That is the point.

There is a useful precedent. When Zillow made property data public, real-estate agents lost the information advantage that justified a six-percent commission. The data didn't become worthless — it became table stakes, and the margin migrated to whoever could do something with it that the data alone could not. The information went free; the judgment did not.

The same migration is happening here, and it lands on two layers — but they are not equal, and getting the ranking right is the whole strategic decision.

The first layer is compiled knowledge, and I want to be precise about what it is worth. A pile of public-domain PDFs — 800-53, the AI control overlays, an ATT&CK matrix — is not knowledge. It is raw material. It becomes knowledge only when it is compiled: decomposed into atomic, teachable units; wired together by typed, inspectable relationships into a graph you can actually reason and practice against; kept current as the underlying standards version and the draft overlays settle. The standards are the instruction set. Compilation is the work, and it is real work, because the public sources are vast, overlapping, versioned on different clocks, and silent about how they connect — the gap the public crosswalks only partly close. But compilation is a head start, not a moat. I will say plainly later what I will only flag here: a determined team with good agents can assemble a serviceable version of it in a year. Build it well and you have built table stakes. You have not built defensibility.

The second layer is where defensibility actually lives: verified credentials — and here the AI era changes the requirement entirely. The thing worth certifying is no longer attendance or a multiple-choice score. It is demonstrated judgment, proven against ground truth, and issued to both the human professional and the agent acting on their behalf. In a world where an agent reasons against your compiled substrate on a practitioner's behalf, the human credential and the agent credential have to be grounded in the same source of truth, or they drift apart and neither can be trusted. Agent-personalized, human-credentialed — coherent only because they sit on one verified foundation. This is the layer no public download confers, and the layer the rest of this essay is about.

Both are delivered, increasingly, not as documents to be read but as applications agents can consume — which is why the emerging shape is knowledge and credentials served through open agent interfaces rather than locked in a portal. The substrate the human learns from should be the substrate the agent reasons against. Anything else is two diverging copies of the truth.

The public substrate is free; compiled knowledge is a head start, not a moat; the verified credential is where defensibility lives. The information went free — the judgment did not.

I argued in a previous essay that judgment is not one thing — that the word quietly collapses at least five distinct capacities any honest pedagogy has to hold apart. There is the evaluative call of whether something is adequate. The directive call of what to do next. The expert call of whether a thing is correctly done. The calibration call of when to trust the machine and when to override it. And the accountable call — owning a contestable decision and answering for it after the fact, when the evidence that would have made it easy was never available.

If that disaggregation was right, then the lazy version of the claim I am about to make — "judgment is the layer that doesn't automate" — is not merely imprecise. It is wrong, and wrong in a way that costs money. Because the substrate going public does not threaten these five senses equally. It threatens them in a specific order, and the order is the strategy.

Expert judgment sits closest to the free substrate and erodes first; calibration and accountability are the senses no catalog can supply.

Start with the sense most exposed, because it is the one practitioners are proudest of. Expert judgment — the chain-validated determination that a control is correctly implemented, that the evidence supports the conclusion, that the configuration matches the requirement — sits closest to the compiled substrate. That proximity is precisely the problem. An agent reasoning against a well-built knowledge graph is, almost definitionally, getting better at the expert call every time the graph improves; the expert determination is the thing the substrate was built to support. To be sure, the human expert is still faster and more reliable today. But "today" is doing enormous work in that sentence, and anyone building a credential around the expert call is building on the ground that is eroding fastest. (This is also why compiled knowledge is a head start rather than a moat: the layer it most directly serves is the layer most exposed.)

Evaluative judgment — is this adequate, does it pass — is exposed for the same reason wherever the ground truth is crisp. Where adequacy is genuinely contestable, it holds; where it reduces to "does the artifact satisfy the stated criterion," the machine is closing in. Directive judgment sits in the uneasy middle: deciding what to do next is more exposed in routine situations the substrate has seen and less exposed in novel ones it has not, which is to say its defensibility depends entirely on how much real novelty the work contains — usually less than the practitioner believes, which was the perception gap all along.

Now the two senses that do not erode as the substrate commoditizes, but appreciate.

Calibration judgment — knowing when the machine's confident answer is wrong, and overriding it — becomes more valuable precisely as the machine becomes more capable, because a more capable machine is a more persuasive one, and a persuasive wrong answer is the expensive kind. This is the sense I argued in the prior essay is the rarest and hardest to fake, and the free substrate does nothing to supply it. You cannot download a calibrated trust curve. You can only build one through reps against cases where the machine was confidently wrong and the ground truth proved it. The public catalog makes the machine better; it does not make you better at catching it.

And accountable judgment — the contestable call you own and defend — is the sense the substrate cannot touch at all, for a reason that has nothing to do with capability. This is where I would correct my own earlier framing. The durable claim is not that the machine cannot make the accountable call. Give it another model generation and it may make a better one. The durable claim is that someone has to be answerable for it, and answerability does not transfer to a model. When a control is accepted and the breach happens anyway, when a risk is taken and the loss lands, there must be a party who decided, who can be questioned, credentialed, insured, and — if it comes to it — held liable. That party is not the agent. It is the human the agent reasoned on behalf of. The accountable call is scarce not because it is hard but because it is owned, and ownership is the one property a free substrate can never confer.

This reorders the division of labor everyone is groping toward. The honest version is not "AI does the repetition, humans do the ambiguity" — that line will move every time a model ships, and betting a business on it is betting on the slope of a curve you don't control. The honest version is that AI absorbs the senses the substrate supports — expert, much of evaluative, routine directive — and the scarce human layer collapses to two things: the calibration to catch the confident machine, and the accountability to own the call it cannot answer for. Those are the senses worth certifying, because those are the senses the free catalog leaves untouched.

Which is why this is a gym and not a library. The framework is free; reading it builds nothing. Calibration is built by ruling on the case where the evidence is ambiguous and the machine's answer is plausible and wrong. Accountability is built by making the contestable call, recording the reasoning, and being graded against what actually happened. Neither is seat-time, and neither is a multiple-choice score. The professional comes in to sharpen senses they already half-have; the newcomer comes in to build them from nothing. Both should leave with something a relying party can check — proof they did the reps on the senses that survive — for the human and, on the same verified foundation, for the agent acting in their name. Two credentials, one ground truth, because the moment they diverge, the accountability they were supposed to anchor has nowhere to land.

Systems thinking is what ties the two surviving senses together, and it is not a slogan. Calibration at the level of a single decision is catching one wrong answer; calibration at the level of a system is seeing which feedback loops will manufacture wrong answers faster than anyone can catch them — the vigilance fatigue, the skill erosion, the oversight that quietly stops overseeing. Accountability at the level of a decision is owning one call; at the level of a system it is owning the design that decides which calls get made at all. Seeing the loops rather than the boxes is itself a judgment, and it is the one that commoditizes last, because no catalog has ever been able to describe a system it was not already a part of.

There is a strategic posture implied by all of this that most organizations are missing entirely.

The rules of the AI era are not finished. The NIST AI control overlays are in draft, with open comment periods and a public working channel. The Cybersecurity Framework Profile for AI is circulating for feedback. FedRAMP is publishing RFCs and inviting industry to shape the machine-readable future. The EU AI Act's obligations are phasing in with implementation guidance still being written, and in the United States, state-level law — Texas's responsible-AI act among them — is forming the contours that federal policy hasn't settled.

This is not a landscape to wait out. It is a landscape to participate in. The organizations that will be best positioned three years from now are not the ones with the most polished compliance binder; they are the ones in the comment periods and the working groups, learning where the standards are heading before the standards arrive, and shaping the narrative rather than inheriting it. Engagement is itself a capability. The substrate is public; so is the process of writing it. Both are open to anyone willing to show up.

I left a thread hanging two sections ago, and it is the one that turns this from an observation about value into a recommendation about where to stand.

When accountability becomes the scarce sense — the call a human owns because the machine cannot answer for it — a second thing follows that most of this field has not yet connected. A call that can be owned can be insured. And a call that can be insured is a call that can be procured.

This is the actual blocker in front of every organization trying to put an AI agent into a regulated workflow right now. Not whether the agent is capable — increasingly, it is. The blocker is that no one can say who is answerable when it is wrong, which means no underwriter will price the risk, which means no procurement officer will sign. The agent stalls not on capability but on accountability. Insurability is the gate, and a certifiable, verified judgment — grounded in ground truth, attached to a responsible party, issued to the human and to the agent on the same foundation — is the key that fits it. Certifiable becomes insurable; insurable becomes procurable. That is the chain that turns a stalled pilot into a deployed system.

Capability gets the agent to the procurement gate; the verified credential is the key that opens it.

Which reframes the whole division I have been drawing. Compiled knowledge is table stakes — valuable, worth building well, and, as I keep conceding, assemblable by a determined team with good agents and a year. The moat is not the graph. The moat is the rail that turns practice into a credential a relying party — an auditor, an underwriter, a board — will actually trust, for the two senses the free substrate leaves untouched. The standards are the instruction set. The credential is the thing no download confers, because it certifies the layer that carries the liability.

So here is the honest version of the conclusion, the one that earns the right to make a recommendation.

Almost all of the substrate is free. The standards are public domain. The crosswalks are published. The threat models are licensed for commercial use. The exchange formats are open. And the agents capable of ingesting, structuring, and connecting all of it are now cheap and capable enough that a determined team can compile a serviceable version themselves. You should consider doing exactly that — not because it is a moat, but because the act of compiling it is the fastest way to understand what you are standing on, and the understanding is most of the point.

What you cannot download is the part that comes after compilation: the rails that turn practice into provable judgment — the cases with embedded ground truth, the calibration scenarios where the machine was confidently wrong, the record of a contestable call owned and graded against what actually happened — issued to the professional and to the agent working alongside them, on a foundation you can audit because it was public all along. That is the layer an underwriter can price and a board can trust. That is the layer that does not commoditize when the next model ships, because it is anchored in accountability rather than capability.

If you want to build that yourself with agents, build it — and tell me how it goes; I mean that. If you would rather stand on the compiled knowledge and the verified-credential rails without spending the year assembling them, that is what we built GRID42 to be.

The frameworks are free. The judgment — the calibration to catch the machine, the accountability to own the call it cannot answer for — is not. Everything that matters from here is a decision about which layer you choose to compete on.