The AI Trust Stack — earn the endorsement, then build the console where you watch it think

One line: make the five layers (Triage → Guardrails → Judge → Council → Human) famous — through AWS channels first, endorsement not tolerance — then replace the static presentation with a live single-screen console where someone types a decision and watches the stack think: deterministic triage against the EU AI Act's four risk tiers, a decision tree building left-to-right in real time, a council deliberating in the open, and every layer honest about what it is.

**Gate Zero, recalibrated (Byron's correction: "I am AWS" — an L7 Principal running RAI doesn't petition, he exercises judgment): Gate Zero is not permission-seeking, it's a leader doing the diligence he'd expect of anyone on his team: (1) the partner-collision check** on AllCloud's TrustStack in AWS Marketplace — the critique's gold catch, handled early, before it's a problem rather than after; (2) a conscious read of external-comms policy for the specific artifacts (customer references = public info, fine; a named framework adjacent to a partner's product = the one worth a deliberate call, and where looping in the right colleague is judgment, not permission); (3) erring on the modest side of every claim, always — because the credibility being built is precisely "says only what the evidence says." "Claim it as yours" stays deleted as a strategy — but for a sharper reason than employer risk (see the next section): the parts aren't anyone's to claim. The curation is.

What you actually own — the catalog, not the patterns

Byron's insight, made structural: none of the five layers is AWS's, and none is his — council-style deliberation is Karpathy-and-the-field, LLM-as-judge is commodity, guardrails are a product category, self-correction limits are Huang et al. The ownable move is the one the Gang of Four made with design patterns: they didn't invent Observer or Factory — they named the catalog, wrote the canonical formulations, and every engineer since has spoken their language. So the Trust Stack's posture is credibility through attribution: each layer's card cites its lineage (who invented it, what the research says, which products embody it), and what's yours is the formulation — which layers, in what order, activated by what triage, at what cost. Two formulation ideas that are genuinely yours to develop:

• Trust as a budgeted quantity. The dials aren't decoration — "how much rigor can this decision afford?" is a framing nobody in the governance space uses. Cheap decision, thin stack; consequential decision, full council. The cost-tiered-rigor curve is the Trust Stack's equivalent of the swarm console's Pareto frontier — and it's measurable, which makes it defensible.
• The receipts discipline as signature. Break the Stack, the verification ledger, "shows its work" — one visible standard applied across every property. People can copy a diagram; they can't copy a two-year public track record of publishing your own failures.

Why now, three reasons stacked: your presentation audience asked "how do AWS customers actually use this" (answer below, with links); the EU AI Act's Digital Omnibus just moved the deadlines without touching the risk tiers — "the deadlines slipped; the risk didn't" is a ready-made hook; and research found no existing tool combining the pieces — every EU-AI-Act classifier on the market is a static questionnaire, every trace tool is a post-hoc engineer view. Stated with precision (because precision is the brand): I haven't found this combination anywhere — not "nobody has done it," which is a claim someone falsifies in a reply thread.

---

The employer line — where it actually is (this section governs everything else)

The critique drew the line better than the research did: explaining public capabilities, citing public references, personal disclaimer, no naming claims = thought leadership. Claiming a named framework built on employer products, an authenticated app with budgets, targeting external monetization = outside activity requiring formal approval. This proposal as first drafted was on the second side. The restructure:

• The conflict check is Gate Zero, not a T1 line-item. Nothing publishes before it.
• Seek endorsement, not tolerance: pitch the five-layer pattern internally as AWS-publishable first. Yes → every customer reference below becomes legitimate scaffolding under an AWS-blessed pattern. No → the public version strips the AWS customer scaffolding entirely and stands on the console alone; the boundary got learned at zero cost instead of terminal cost.
• The runtime inversion gets fixed: a demo wearing AWS proof points must not run exclusively on non-AWS models. The live slice routes through Bedrock for at least the Judge layer (cheap Bedrock-hosted models exist), with OpenRouter models as council diversity — so AWS gets workload, not just risk.
• EU AI Act commentary stays descriptive (dates, tiers, what the text says) — regulatory positioning is AWS public policy's lane, and disclaimers don't change how it reads.

The brand — research verdict, tempered by the critique

The term "Trust Stack" is fragmented, not owned: Gartner uses "Data and AI Trust Stack" for data governance, Growth Marshal sells "Trust Stack™" for LLM-SEO, Rachel Botsman used it for social trust in 2017, and AllCloud's TrustStack is cloud security on AWS Marketplace. None claims the layered runtime decision-trust pipeline, and no blocking trademark exists in the AI class (only "TRUST STACKING", unrelated marketing services, 2017).

What makes it ownable is naming the layers — the framework is the brand:

1. TRIAGE — classify the decision's risk (the EU AI Act's four tiers as the canonical scheme)
2. GUARDRAILS — deterministic policy walls (the Bedrock Guardrails class of control)
3. JUDGE — a model that grades the work against criteria (LLM-as-judge)
4. COUNCIL — independent models deliberating when stakes demand disagreement
5. HUMAN — escalation with a decision-ready dossier, never a raw dump

The naming path after Gate Zero: say "the AI Trust Stack" descriptively (a pattern with five named layers), never possessively; no ™ ambitions. Hard avoid: "Trust Layer" (Salesforce owns it) and "AI Control Plane" (a Forrester vendor category now). If AllCloud's Marketplace listing makes even the descriptive use awkward, fallback names exist (Decision Stack, the Rigor Ladder) — the layers are the asset, not the label.

The answer your audience asked for — referencable customers

• PitCrew — the single best reference: a dedicated AWS case study of Automated Reasoning checks verifying agent decisions against financial regulations (30-minute reviews that took 2 weeks). This is the Trust Stack story told by a customer.
• PwC — brand-name co-published blog on Automated Reasoning for pharma marketing and utility outage classification, endorsed on the re:Invent stage.
• Grab — publicly benchmarked Bedrock Guardrails "best in class" before standardizing on it.
• Depth: Remitly, KONE, PagerDuty (AWS ML blog); Chime, Panorama, Strava on the Guardrails product page. Cross-cloud proof it's an industry pattern, not an AWS quirk: AXA and Shell on Azure AI Content Safety.
• One honest gap that's an opportunity: LLM-as-judge on Bedrock has no named customer case study yet — your console demos the pattern publicly before anyone's reference does.

The console — "watch the trust pipeline think"

One screen, nothing scrolls off. Console-grade, same family as command and swarm:

• Input: one clear dialogue box — a decision, question, or task ("Should our chatbot answer medication-dosage questions?"). Below it, a context selector: EU AI Act ships first (pre-loaded with the real post-omnibus dates), others later (NIST AI RMF, your own policy).
• Triage is deterministic — the critique's non-negotiable. Rule-based mapping to the Act's four risk tiers (the Act's structure supports it); the LLM only extracts features from the input, and every citation comes from a lookup table, not a sampler. Legal classification cannot be probabilistic theater — a hallucinated Annex citation, permalinked forever, would be the fatal screenshot.
• The tree builds left → right in real time. The signature visual: nodes activate as the stack decides they're needed — GUARDRAILS passes/blocks; JUDGE grades with its rubric visible, criteria by criteria — never a naked score (a visible, criticizable rubric is honest; "6/10" is a random number in a lab coat); for high stakes the COUNCIL opens as models trading positions, each box filling with a live one-line summary. HUMAN lights with the dossier. Every box clickable for full detail.
• Every layer carries a "production equivalent" chip — the critique's best structural fix: "Judge here: [cheap model], pedagogical. In production: Automated Reasoning checks / frontier judge / domain evaluator." Cheapness becomes a teaching device instead of a liability: the demo shows the architecture and says so. The framing rule, enforced in copy everywhere: this is a legible-governance demonstrator, never a compliance tool — "this is what the pipeline looks like," not "this is the pipeline working." The punchline is "$0.08 to see the shape of it."
• Council honesty: cheap models share training data — their agreement is correlated, not independent. The council card says this on screen and shows disagreement as the interesting signal, not convergence as proof.
• The dials: a mixture panel (judge vs. council vs. guardrail rigor). Two modes, exactly as you framed it: EXPERIMENT (you set the dials) and AUTO (triage sets the dials; watching them move is the explanation).
• Replay + permalink per run — and the Council layer literally runs on the swarm engine and says so ("Council powered by the swarm verifier"). The split declared on both sites in one sentence each: swarm asks "is it right?" — Trust Stack asks "is it allowed, and who's accountable?" Capability console and governance console: siblings in visual grammar, distinct in identity, shared auth/manifest/budget/replay infrastructure. Composability is the story.

Cost + access (the app-manifest pattern, applied): demo replays are free and public — the full theater from cache. Live runs require Google sign-in and run on cheap OpenRouter-class models with a hard ~$0.10/run target and a per-account daily allowance; the dry-run estimator warns and steers before spend. This becomes the first app born compliant with the fleet manifest: auth flag, budgetMax, analytics, expiry — all declared on day one.

Glass Court: deprecate. Its purpose (making deliberation visible) is absorbed by this console with an actual mechanism behind it; per the fleet mortality rule it gets a tombstone redirect to the Trust Stack demo.

The walkthrough that sells it (90 seconds, honest version)

Type: "Our support bot wants to answer medication-dosage questions." Triage: HIGH RISK — the rule engine maps health + consumer-facing to Annex III, citation from the lookup table, deterministic. Guardrails: passes content policy, flags the domain. Judge: rubric on screen — five criteria, each graded with reasoning, production-equivalent chip visible ("in production: a domain evaluator, not this $0.01 model"). Council opens: models trade; three say "don't answer, refer out," one dissents with conditions — the disagreement is the exhibit, and the correlation caveat sits right on the card. HUMAN lights: escalation dossier with the split and the citation. Cost on screen: $0.08 — to see the shape of it. Close: "the omnibus moved the compliance deadlines to 2027; it didn't move the risk. This is what acting like it's already law looks like."

EU AI Act facts baked into the demo (verified 2026-07-17, post-omnibus)

Per the Council's final green light (29 June 2026) and Gibson Dunn's analysis: GPAI obligations in force since Aug 2025 (unchanged); Annex III high-risk delayed to 2 Dec 2027; Annex I to Aug 2028; Article 50 transparency 2 Aug 2026 (watermarking grace to Dec 2026); sandboxes pushed to Aug 2027. The four risk tiers are untouched. The demo renders these dates on the context card — being current on the omnibus is itself a credibility signal most RAI content will get wrong for months.

Break the Stack — the signature move (critique's bold idea, adopted whole)

Every trust demo ever built shows only success runs; that's the genre's tell that it's marketing. Invert it: invite visitors to adversarially break the pipeline, and publish the failures — permalinked, annotated with which layer failed and why, in the same sealed-run format as everything else. A trust console that maintains a public ledger of its own breaches is without precedent, it converts the biggest risk (getting caught faking rigor) into the signature move (you caught it first, in public, on purpose), and it is exactly what a $1M responsible-AI hire looks like.

Sequencing — resolved by the critique, adopted

(0) AWS-internal first — Gate Zero. Manager, external-comms policy, name check; pitched as a pattern AWS might want to publish. (1) Then the live demo, quietly, with honest framing — the first public artifact is a working thing. (2) Then the article, pointing at it. The branded-article-plus-mockup path is eliminated: maximum brand exposure, zero proof, indistinguishable from framework-vaporware. The article amplifies; it cannot lead.

Roadmap

• T0 — Gate Zero (before anything public): internal clearance + name check. Also decide Glass Court's tombstone.
• T1 — mockup behind the gate: console mockup (deterministic-triage theater, rubric-visible judge, production-equivalent chips, dials, both modes, replayed run) — buildable and shareable internally while Gate Zero runs.
• T2 — live thin slice: deterministic triage + Bedrock-routed judge + council on the swarm engine, $0.10 cap, sealed replays, Google sign-in + allowance via the shared auth/manifest infra (first born-compliant app). Break-the-Stack ledger from day one.
• T3 — context packs (NIST RMF, internal policy) and the permalink library as the receipts for talks; the article lands here.

Self-critique — Fable adversarial pass

Full text: fable-critique-20260717.md. Its verdict — "a well-researched plan to do a dangerous thing elegantly… pick an animal" — restructured this document:

• Employer risk was treated as a to-do; it's the whole game. "Claim it as yours" deleted as a strategy; conflict check promoted to Gate Zero; endorsement-not-tolerance sequencing; Bedrock in the runtime so AWS gets workload, not just risk; EU-AI-Act commentary kept descriptive.
• The demo faked exactly what it sells. Fixed: deterministic triage with lookup-table citations, rubric-visible judging, production-equivalent chips on every layer, correlation caveat on the council, "legible-governance demonstrator" framing — "$0.08 to see the shape of it."
• "No prior art" was research overreach. Now: "I haven't found this combination" — precision is the brand.
• Two consoles were blurring into one story. Fixed: capability vs. governance split declared on both sites; Council literally runs on the swarm engine; siblings, not twins.
• Its bold idea — Break the Stack, the public failure ledger — is now the signature feature.