Verify power.
Preserve freedom.

Global Accountability Initiative

Verify Power, Preserve Freedom

A proposal to test whether AI can help citizens and institutions find and connect public evidence of rule-breaking by the powerful—without creating a new surveillance power

Revision 3 — Discussion draft, November 8, 2026
Originator: Jeff Owen, private citizen
Status: Discussion draft ready for expert critique. Not a validated design or implementation plan, not an operating organization, and not an endorsement.

Part I — Short introduction

This part is for a five-minute read. Part II is the full proposal.

Why this matters

Each of us gets one finite life. We spend much of it working within shared rules: we pay taxes, compete for contracts and jobs, follow procedures, and accept outcomes we may dislike because we believe the rules apply to everyone. When someone gains money, office, or influence by quietly cheating those rules—through a rigged tender, an undisclosed interest, or a favor traded for public money—the cost lands on people who played fair, who may never learn what happened.

This proposal does not presume that institutions or officials are corrupt, and it does not start from suspicion of any person, party, or country. It starts from a narrower concern: when rule-breaking by people with power is hard to see, it is hard to correct. Evidence that could reveal it is often public but scattered across procurement portals, registries, audit reports, and court records that few people have time to connect.

AI tools may now help with that connecting work: reading large volumes of documents, linking records, and assembling evidence that a human can check. They are not flawless, and nothing here assumes success. The question is whether they can help now, under strict limits, in a way that is measurably useful.

Two kinds of secrecy must be kept apart. Legitimate privacy—personal life, lawful association, ordinary finances, journalism, dissent—deserves protection, including from well-meaning watchdogs. Concealment of misconduct in the exercise of public power does not deserve the same protection. The aim is to make arbitrary power less common, not to give anyone a new power to watch everyone.

What is proposed

The proposal has two parts that readers can judge separately.

1. An immediate, bounded pilot (the near-term proposal). One jurisdiction or defined group of agencies; public procurement records only; no private banking data; no public naming during research unless separately and independently justified; no automatic referral or punishment. The testable question: Does an AI-assisted workflow improve procurement-integrity review compared with conventional rules and expert review, without unacceptable harm? A “no” is a legitimate result.
2. A long-term federated vision (provisional and optional). Independently governed nodes sharing evidence standards, to be examined only if the pilot succeeds and is independently reviewed. A reader may support the pilot and reject the network.

Before any novelty claim, map existing tools, research, and organizations. Joining or contributing to an existing effort may be better than creating a new institution.

What is firm and what is provisional

What reviewers are asked

Section 14 lists the full questions. In short: Is the pilot worthwhile and feasible? What existing work should it build on, join, or use only as a baseline? What weaknesses should stop it? Who is qualified to evaluate it? Which Section 11 citations are too thin or over-read?

Feedback is critique, not endorsement. Agreement among AI assistants used in drafting is editorial progress only. External human scrutiny is the test.

How to read this document

• [Supported as scoped] checked against sources in Section 11, within the stated boundary.
• [Partially supported] partly checked; some elements remain unverified or limited.
• [Claim requiring verification] still unverified after this revision’s targeted check.
• [Proposal] a proposed mechanism; nothing proposed exists yet.
• [Assumption] something the design depends on that could be wrong.
• [Open question] unresolved; research or reviewers must address it.

A targeted check of F1–F9 on November 8, 2026 does not validate the design. Sources and gaps are in Section 11.

Revision history and source status

Changes in Revision 3. Concrete comparison baselines, with AI incremental value tested rather than assumed; precision@K separate from investigator time per actionable lead; question-specific data readiness; distinct join/contribute/evaluate/build/stop criteria, with no automatic integration; “before an operational prototype begins,” allowing bounded exploratory checks that are not covert deployment; targeted F1–F9 source check with citations (not design validation); unresolved disagreements and reviewer questions preserved. No universal legal thresholds or red-flag rules.

Source status. F1–F9 and named-organization pages were checked on November 8, 2026. This is not a comprehensive review. Named organizations are mapping candidates, not partners or endorsers; no outreach has occurred.

Part II — Full proposal

1. The problem

[Supported as scoped] Evidence relevant to procurement integrity is commonly held in separate systems—contracting records, company registers, beneficial-ownership registers, budgets, and related disclosures—and often has to be linked rather than read from one file (see F1). A contract may look ordinary until ownership, award history, pricing, amendments, and delivery are examined together. Some relevant evidence is confidential or legally inaccessible; its usefulness creates no right to obtain it.

Interpretation is hard. Concentrated awards can reflect a specialized market. A large amendment can follow a legitimate scope change. An apparent ownership link can be an entity-resolution error. Conversely, misconduct may be designed to look normal.

A credible initiative must distinguish:

• potential criminal conduct, which requires investigation and adjudication under law;
• documented administrative or procurement-rule violations that may not establish corrupt intent;
• legal but ethically troubling relationships;
• poor administration, incomplete documentation, or ordinary commercial disputes;
• legitimate policy choices and political disagreement, which are not evidence of misconduct.

These distinctions matter because an anti-corruption system can acquire reputational power even without legal power. Public naming can damage livelihoods; a referral can invite intrusive investigation; a dashboard can become a de facto blacklist. “Advisory only” is not protection if users treat outputs as verdicts. Public debt, economic decline, and unequal outcomes cannot automatically be attributed to corruption. Missing records are not evidence of innocence; missing explanations are not evidence of guilt.

2. The opportunity and the testable question

[Assumption; Partially supported] Computational methods—document extraction, multilingual retrieval, entity resolution, graph analysis, anomaly detection, and evidence organization—are used in some procurement-integrity settings, but whether they assist reviewers reliably at acceptable error rates remains an open question (see F4). A limited pilot does not require advanced or general AI. It does require lawful data handling, domain expertise, and evaluation that measures rather than assumes value.

Pilot inputs could include tenders, awards, vendor disclosures, amendments, public payment summaries, and procurement-related audit or judicial records. Ownership or campaign-finance disclosures would be linked only where a documented procurement question justifies it. General political relationship mapping is out of scope.

The value proposition is not "trust the AI." It is that an analyst can inspect a claim, find the supporting passage, check the original record, see the transformations applied, and challenge the inference. [Supported as scoped] In studies of chain-of-thought prompting on specific models and tasks, models produced plausible explanations that did not faithfully report the factors influencing their outputs (see F5). The initiative should not promise universal explainability. It can require evidence-linked outputs, testable methods, explicit uncertainty, and rejection of unsupported claims.

Possible benefits—faster discovery of records, more consistent checks, better-documented leads, and identification of disclosure gaps—are hypotheses. If ordinary rules and human analysis perform as well with less risk, that should narrow or defeat the case for AI.

Central testable question [Proposal]: Does the AI-assisted workflow improve the quality or efficiency of procurement-integrity review relative to credible alternatives, without unacceptable legal, privacy, fairness, or reputational harm?

3. Existing-work mapping: required before novelty or implementation claims

[Open question] It is not yet known whether this proposal adds anything beyond existing efforts. [Partially supported] Several organizations are active on parts of this problem (see F8). That is not a complete landscape review and does not make joining any of them feasible or preferable. No claim of novelty should be made, and no operational prototype should begin, until mapping is completed and reviewed.

Phase 0 mapping task [Proposal]

Categories to map (official pages checked November 8, 2026 for existence and general scope, not fitness, licensing, or partnership potential):

Questions for each effort: What does it do? Is it maintained? What evidence exists about effectiveness? What gaps does it acknowledge? Could the pilot contribute to it, study it, or use it as a baseline?

Criteria before choosing an option. Finding relevant work does not make integration automatic or even possible. Assess at least: governance and independence (can it criticise methods, publish negative results, and keep Section 4 commitments?); rights and purpose limits (privacy, contestability, no autonomous punishment); legal access to needed public data for the pilot purpose; technical interfaces (formats, identifiers, or APIs sufficient for the planned comparison or contribution); licensing and terms (evaluation and publication of methods and negative results permitted?); maintenance (active stewardship vs. an unmaintained snapshot); and evaluation feasibility (can independent reviewers test whether AI adds value?).

Possible outcomes, kept distinct; all legitimate: (1) join as a participant if the criteria are met; (2) contribute a bounded piece without being absorbed by the host; (3) evaluate independently, using existing tools or data as baselines rather than integrating operations; (4) build a narrow reusable component (for example, an evidence-package format or evaluation protocol); (5) propose a new institution only if mapping shows a documented gap that existing bodies cannot or will not fill; (6) stop, if the need is met, no option satisfies the criteria, or the gap cannot be filled safely.

Output: a short public mapping report of what was found, checked, and not checked, and the recommended option—reviewed by at least one person with field experience before Phase 1 decisions.

4. Commitments and principles

Firm core commitments

These are not open to trade-off for convenience, funding, or speed. If a design cannot keep them, the design changes or the project stops.

1. Intelligence without coercive authority. AI may help analyze and report; it may not govern, punish, compel disclosure, or determine guilt. The initiative would have no enforcement powers. Humans authorizing publication or referral must be identifiable and accountable. Recipients must make their own lawful assessment rather than treating outputs as proof.
2. Evidence before accusation. A statistical anomaly is a screening result, not proof. Consequential outputs must distinguish observed facts, model suggestions, analyst inferences, disputed claims, and unresolved questions. Confidence must not imply certainty or hide missing evidence.
3. Meaningful correction and contestability. Anyone affected must have a practical, free way to challenge identity matches, source accuracy, missing context, and conclusions, decided by someone independent of the original decision. Corrections travel with the original output.
4. Privacy, necessity, and proportionality. Public availability does not make every reuse proportionate; combining records can expose what no single record reveals. Collect and link only what the procurement question requires; avoid publishing identifiers that do not materially support a justified finding. No private banking access in the pilot; no blanket access to individual transactions ever.
5. Equal standards with contextual validity. Evidence thresholds do not change with wealth, office, nationality, party, donor preference, or affiliation. Contextual adjustments for lawful differences must be documented, justified, and tested for selective application.
6. Honest results and real stopping options. Methods, negative results, and adverse events are published. Pausing, narrowing, or shutting down must remain practical options.

Explicit prohibitions [Proposal]

Autonomous enforcement; social or political loyalty scoring; generalized tracking of individuals; targeting lawful dissent, journalism, organizing, or protected characteristics; sale of suspect lists; covert expansion into unrelated private activity; and designing outputs as automatic exclusion lists for employment, credit, public services, or contracting. Purpose restrictions need enforceable agreements where possible, while acknowledging that published information can be copied and misused.

Bounded assurance, not endless oversight

Adding a reviewer does not remove the need to assess that reviewer. A useful system defines finite responsibilities, independent checks at consequential points, and acceptable residual risk. When uncertainty exceeds those limits, pause or narrow—do not add agents until agreement appears.

International interoperability without a global ruler (long-term only)

If federation is ever pursued, nodes may cooperate through standards without transferring sovereignty. Participation and withdrawal remain subject to lawful authority and rights protections. Refusal to participate is not evidence of corruption.

5. The immediate pilot: public procurement integrity

Scope [Proposal]

• One jurisdiction or clearly defined group of agencies; a specified multi-year period; a manageable set of procurement categories.
• Public procurement evidence only; no private banking access. Contextual disclosures linked only to defined procurement questions.
• No population profiling, automatic sanctions, or automatic referral pipeline.
• Nonpublic research by default. Whether any public naming is needed during the pilot is itself an [Open question]; anonymized or aggregate reporting may satisfy the research purpose.

Sample size should follow data availability, reviewer capacity, and the precision needed—not publicity. A feasibility report should cover disclosure quality, procurement law, language coverage, comparison data, and whether independent review is possible. The result may support only a narrower document-processing tool.

Question-specific data readiness [Proposal]

Requirements are selected by the pilot hypothesis, not a universal field list. For the chosen question, a short readiness note should cover completeness of the fields actually needed and how missingness would bias interpretation; coverage of agencies, procedures, years, and values; linkage keys of sufficient quality for the planned joins only; timestamps reliable enough for the intended comparisons; contextual comparability of groups (markets, procedure types, emergencies) without mixing unlike cases; and a documented fit, narrow, or no-go decision.

A dataset can be fit for one hypothesis and unfit for another. Unused missing fields are not, by themselves, a reason to reject a setting. [Partially supported] Substantial public procurement datasets exist in more than one jurisdiction; fitness for a particular question still depends on these criteria (see F2).

Evidence categories

Thresholds are defined before testing, separately for restricted triage, further investigation, public reporting, public naming, and referral. No universal "corruption score" is proposed.

The base-rate problem

[Supported as scoped] Indicators such as single bidding, non-competitive procedures, contract modifications, and repeated awards can reflect market structure, thin supplier pools, tender design, geography, administrative capacity, or legitimate operational change as well as integrity problems. They should prompt investigation, not stand as accusations or a universal red-flag code (see F3). No empirical false-positive rate or legal threshold is asserted here. When the sought condition is uncommon, even a modest false-positive rate can produce many misleading flags; that is a general screening property, not a measured rate for this proposal. Review should test emergencies, thin markets, legitimate scope changes, inflation, aggregation errors, and incomplete disclosure.

Case handling and public-naming rules [Proposal]

1. Restricted intake and data checking. Record the indicator, comparison group, source quality, entity-match uncertainty, and version. Restrict access. Deduplicate and fix parsing errors before interpreting.
2. Nonpublic human triage. A procurement-informed reviewer checks whether the anomaly survives basic context. Unsupported cases are closed with reasons; closure does not prove the conduct was proper.
3. Corroboration and alternative hypotheses. State the precise proposition, seek independent support, and document contrary evidence. A shared name or graph link alone does not establish ownership, control, or misconduct.
4. Response opportunity. Before adverse public naming, subjects ordinarily receive the factual propositions, a safe response channel, and a reasonable period. Nonresponse is not an admission. Any urgent-public-interest or safety exception requires independent authorization and recorded reasons.
5. Independent publication decision. Reviewers who did not generate the lead assess corroboration, materiality, identity certainty, legal constraints, response, and foreseeable harm. Public naming requires a documented finding that the specific disclosure is justified and proportionate. Anomaly scores, uncorroborated model outputs, or model consensus cannot meet that threshold.
6. Separate referral decision. A named human panel decides whether lawful referral is appropriate, what minimum information to share, and how uncertainty is communicated. Referral is never automatic and implies no guilt. Confidential referral must not become a lower-accountability path around publication safeguards.
7. Follow-through. Record corrections, challenges, recipient responses where lawful, and authoritative outcomes. Silence from an authority does not validate a lead; opening an inquiry does not prove it.

Thresholds are central to legitimacy. Too low, and noisy accusations harm innocent people; too high, and useful evidence may be hidden. Phase 1 defines the trade-off; Phase 2 tests it nonpublicly; Phase 3 examines whether any public naming is justified.

Contestability, correction, and harm response [Proposal]

• Free challenge without technical knowledge of models; published timeframes matched to staffing; safe evidence submission; protection against retaliation within the initiative’s control; escalation when a reviewer’s conflicts are disputed.
• The appeal function can correct, withdraw, annotate, or suspend outputs and require reanalysis. Internal appeal does not replace courts or other remedies.
• For a credible serious error: restrict access to the disputed output, pause similar publications, notify known recipients, and preserve records. Corrections should be as prominent as the original claim. Copies elsewhere cannot be guaranteed removed—a reason for caution before publication. Severe harm triggers independent incident review and a decision on whether work may resume.

Evaluation design [Proposal]

A protocol is preregistered before confirmatory testing: hypotheses, units, indicators, baselines, sampling, adjudication, threshold selection, uncertainty reporting, and stop rules. Exploratory changes are versioned and distinguished from confirmatory findings.

• Comparison baselines. Treat any AI increment as a question to test. Compare, under comparable evidence access and reviewer time: (1) documented conventional procurement rules and administrative checks in the chosen jurisdiction—not a universal legal code; (2) statistical screening without language-model assistance, using documented measures chosen for the hypothesis; (3) expert review without AI on the same records; and (4) the AI-assisted workflow. Ablate language-model interpretation, graph linkage, or secondary review to see whether any benefit comes from AI, data cleaning, or extra analyst time. Use existing tools from mapping as additional baselines, not as assumed integrations.
• Precision among top-ranked alerts (precision@K), separate from investigator time. For measurement, an actionable lead matches the table above: independent reference review finds sufficiently credible, specific evidence for a defined, bounded next step—not proof of misconduct. K is a review-capacity budget set before confirmatory results, based on actual capacity rather than publicity. Rank a pre-specified unit (for example, a contracting process or award), not raw flags; multiple flags on one unit count once. Pre-specify a tie-break. precision@K = (units among those K that meet the actionable-lead definition) / K. Unknown or insufficient-evidence labels are not successes; report them separately. If some of the K cannot be reviewed, disclose that count. The set should support a meaningful estimate with uncertainty; it need not be a census.
• Investigator time per actionable lead. Total investigator and reviewer hours—including data checking, context review, and documentation—divided by actionable leads found. High precision@K does not imply efficient use of time, and low time per lead does not imply trustworthy precision.
• Blinded review of flagged and unflagged cases. Independent reviewers assess a representative sample of both, without screening status or scores where feasible. Standardize materials; record disagreement rather than forcing a label.
• Sampling and labels. Cover relevant contract types, agencies, periods, languages, and data-quality conditions. Weight oversampled designs and disclose coverage limits. Success stories cannot establish performance. Audit findings, enforcement records, expert judgments, and legal outcomes measure different things; none is complete ground truth. Distinguish supported, unsupported, disputed, and insufficient evidence. Do not count unknowns as negatives; report sensitivity to label uncertainty.
• Leakage and data splits. Split by units that fit the hypothesis (time, suppliers, agencies, related contracts). For prospective tests, use only information available at decision time. Disclose that models may already know public cases, and add prospective testing.
• Error, calibration, and entity resolution. Report precision@K separately from substantiated findings. Report false-positive and missed-case estimates only against defined review outcomes, with uncertainty intervals that account for clustering and weights and do not claim to capture all systematic error. Fluent confidence is not a calibrated probability. Measure false merges, missed links, and extraction quality across languages and registry conditions, without unjustified inference of sensitive attributes. Small samples limit fairness claims.
• Operational utility and reproducibility. Besides time per actionable lead, measure time to a usable evidence package, reviewer burden, duplicates, correction costs, and incidents, including data, annotation, and governance effort. If external reviewers cannot reproduce a material result, explain why and reduce the claim.

Success, stopping, and publication

Acceptance criteria for utility, reliability, workload, security, contestability, and distributional error are set before confirmatory testing and justified with stakeholders—not tuned after results. No single accuracy number establishes legitimacy.

Stop or pause for unauthorized data access; material prompt-injection or supply-chain compromise; unacceptable identity errors; inability to provide independent appeals; donor interference; serious unexplained unequal harm; or repeated failure to beat baselines, even if isolated examples look compelling. Resumption requires documented remediation and independent review.

Publish methods, aggregate outcomes, uncertainty, adverse events, and negative findings, with redactions explained. Do not claim a count of “proven corruption cases” from anomaly labels or researcher judgments.

6. Pilot safeguards: data, systems, and AI-specific risks

The architecture separates evidence collection, analytical assistance, challenge, and accountable human decisions. Technical controls do not by themselves resolve legitimacy.

Public evidence and provenance [Proposal]

• Ingest only lawfully available procurement-related records under a published data inventory: legal basis, relevance, coverage, known gaps, permitted uses, retention schedule. Do not bypass access controls or import leaked or confidential material.
• Record source location, retrieval and publication dates, method, document hash, parser version, transformations, and revision history. Preserve snapshots where lawful and proportionate; restrict inadvertently collected personal information.
• Provenance is not truth. A hash shows whether a captured file changed; it does not show that content was accurate, authentic, or complete. Official records contain mistakes, and many sites can repeat one false source. Material claims require source criticism and, where feasible, independent corroboration.
• Source corrections propagate downstream; each claim retains a history of the evidence and analytical version behind it, without retaining unnecessary personal data indefinitely.

Analysis systems and security [Proposal]

• Baseline screening remains inspectable and does not depend entirely on a proprietary model. Where feasible, publish code, signed manifests, evaluation configurations, and dependency inventories; disclose proprietary limits. Open source aids inspection but does not guarantee security or fairness.
• Minimum necessary access: extraction components cannot publish, change policy, contact subjects, or transmit data externally. Use role-based permissions, separate service accounts, short-lived credentials, protected signing keys, restricted outbound connections, and human approval for consequential actions.
• Prompt injection. External documents are untrusted and may contain instructions aimed at a model. Content is never treated as instruction. Sandboxed parsing, disabled active content, constrained tools, output validation, and adversarial testing limit exposure; no single filter is a complete defense. Unexpected tool requests trigger containment.
• A threat model before operational use should cover malicious insiders, compromised operators, hostile states, interested vendors, compromised dependencies, manipulated records, abusive users, and ordinary error, with patching, isolation, encryption, tested backups, incident exercises, and access revocation.
• Tamper-evident logs record access, model and policy versions, consequential transformations, and approvals—without copying raw personal data or credentials into logs. Retention schedules should distinguish evidence, notes, logs, and reports, and reconcile deletion, legal holds, and correction.

Corroboration and multi-agent correlated error

• A common evidence package states the question, sources, entity matches, applicable rules, analytical steps, alternative explanations, and gaps; distinguishes independent sources from repetition; and preserves disagreement.
• Human reviewers examine leads, not just model prose; they can reject matches, request context, and record dissent.
• [Supported as scoped] In a large evaluation of language models on public benchmarks and a resume-screening task—not as a universal law—errors were substantially correlated, including among some models with different architectures or providers (see F6). Agreement is therefore not independent corroboration, especially when systems also share prompts, records, or retrieval errors. A second model can generate challenges; its vote is not evidence.
• Multi-agent workflows add failure modes: stale instructions, conflicting versions, lost caveats, duplicated work, inherited access, and mistaken handoffs. Common-mode errors can become apparent consensus. Controls include explicit task ownership, versioned handoffs, scoped permissions, acceptance checks, and a named human for each consequential decision. More agents can increase failure opportunities rather than assurance.

Reporting

Public outputs should prioritize aggregate results, methods, limitations, correction records, and properly reviewed case studies—not unverified personal suspicion scores, and not any implication that lack of a flag certifies integrity. Publication and referral are separate decisions.

Whistleblower submissions: out of scope

The pilot does not offer a whistleblower channel and should not solicit sensitive submissions. That would require separate legal review, tested security, trained staff, source protection, and an honest account of compelled-disclosure risk. No system should promise absolute anonymity or safety.

7. Preventing capture of the watchdog

An unresolved design problem

A watchdog can be captured through funding, appointments, selective data access, staffing, legal pressure, vendor dependence, or control of publication—without falsifying any finding. It can investigate only opponents, define indicators around a donor's interests, or bury negative results. Diverse funding and independent appointments raise the cost of capture; they do not prevent it. The proposal should be judged partly on whether it can detect, disclose, and survive interference—and stop when it cannot.

Phase 1 commissions adversarial governance critique before any operational prototype. Critics should construct capture scenarios: coordinated donors, a compromised appointment panel, colluding reviewers, selective publication rules, and emergency claims used to bypass safeguards. Publish weaknesses, responses, and unresolved objections, subject to necessary security protections.

Functional separation (provisional structure)

Whatever institutional form emerges—including hosting within an existing organization—these functions should be separated at consequential boundaries:

• Governance: scope, budget, appointments, conflicts.
• Operations: lawful collection, security, analysis; no unilateral public accusation.
• Methods and evaluation: utility, error, reproducibility testing.
• Publication and referral: evidentiary thresholds, public interest, legal review, recorded decisions.
• Complaint and appeal: members not involved in the challenged decision, with funding the decision's author cannot withdraw.

A small first phase may not need five standing bodies, but it must preserve these separations through external reviewers and conflict rules. If independent review cannot be resourced, the work stays nonpublic research. Appointment rules should disclose selectors, qualifications, terms, removal grounds, and conflicts, with staggered terms, recusal, revolving-door limits, signed policy-change records, and protected dissent. Each safeguard needs an owner, a test, and a response to failure.

Funding without buying the agenda (provisional)

No cost estimate or committed funder exists. A costed budget should follow agreed scope, be independently challenged, and include safeguards, not just model development.

Possible sources—research grants, philanthropy, public-interest contributions, bounded institutional cost-sharing—each bring distinct conflicts. Multiple nominal donors may share a controlling interest, so concentration analysis should consider related sources. A public register should disclose sources, amounts, material terms, intermediaries, controlling interests where lawfully ascertainable, earmarks, in-kind services, and conflicts. If lawful disclosure is impossible, accepting the support may be incompatible with credibility.

Donors have no right to choose targets, veto findings, obtain privileged leads, appoint reviewers, change thresholds, or tie payment to allegations. Vendors do not control benchmarks for their own products. Fundraising, analysis, evaluation, and publication need documented firewalls. Numerical concentration limits are set in Phase 1, not invented here.

Early agenda-setting deserves scrutiny: a founding sponsor—or the originator—can choose a jurisdiction, dataset, definition, or metric that predetermines what becomes visible. Publish the scoping rationale and rejected alternatives, invite challenge, and test whether equally situated cases are treated equally.

Independence tests

Before each phase, reviewers ask: Can the project investigate a major sponsor’s interests under the same rules? Publish a finding that its methods failed? Recuse a conflicted decision-maker without disabling review? Reject a convenient but weak allegation? Preserve negative results if a funder withdraws? Unresolved interference, undisclosed controlling interests, inability to fund appeals or evaluation, or conditions blocking negative publication should halt progression. Specify a binding reserve for correction, retention, and orderly exit before any live public reporting.

Who watches the watchers?

Every layer can fail. Auditors can have conflicts; a model reviewing another model can share its errors. Audit or agent counts are a poor substitute for an assurance argument linking each material risk to evidence, controls, responsibility, and residual uncertainty. No finite arrangement proves incorruptibility. Refusal, suspension, disconnection, or shutdown must remain real options.

8. Long-term federated vision (provisional and optional)

This section describes a possible future, not part of the immediate proposal. It is subject to all pilot results, the existing-work mapping, and separate review. Readers may reject it while supporting the pilot.

Federation

[Proposal; Open question] Qualified institutions could operate separately governed nodes using shared evidence formats, so analyses can be replicated without transferring all records to one operator. Federation does not itself guarantee independence, security, or privacy: nodes may share software, models, funders, assumptions, or infrastructure. A credible network would demonstrate genuine diversity of evidence and review, not count agreeing systems. Existing standards bodies or networks may be better hosts than a new one.

Requirements before any federation include interoperable evidence formats, jurisdiction-specific rights mapping, node qualification and suspension rules, lawful sharing and correction protocols, independently assessed governance, and the option to withdraw. One successful pilot does not justify global deployment.

Protected financial verification: separate research question

Protected financial verification is outside the pilot and outside any automatic expansion path. It would require a separate mandate, legal analysis, authorization, funding decision, privacy assessment, and legitimate public oversight. Procurement success would not establish the necessity or legitimacy of bank-level analysis.

[Open question] Privacy-preserving techniques—secure multiparty computation, privacy-preserving record linkage, and related methods—might allow tightly bounded questions to be answered inside institutions without moving raw records. Utility, cost, leakage, re-identification risk, and repeated-query vulnerability need independent evaluation. Cryptographic protection does not make a purpose lawful or prevent misuse of outputs. There would be no central repository of transaction histories. Any proposal would have to specify prohibited queries, thresholds, independent authorization, query budgets, audit rights, retention limits, and remedies. A risk flag must not automatically reveal identity, restrict accounts, or trigger enforcement. If meaningful limits cannot be enforced, the research should not proceed toward deployment.

Authoritarian misuse and international harm

Governments may seek dissident lists, use ownership links to expose journalists, or demand access under incompatible laws. Cross-border cooperation can endanger sources and subjects. Nodes would need jurisdiction-specific legal advice, minimized transfers, enforceable purpose limits where possible, and a published policy for refusal, challenge, suspension, or exit. No charter can guarantee protection against state coercion. Participation must not require exporting sensitive records or accepting another jurisdiction’s political definitions of misconduct.

9. Roadmap and readiness gates

Time windows are illustrative ranges from a formally authorized start, not commitments. Delay, narrowing, joining another effort, and termination are legitimate.

Each gate should produce a public decision record: who approved, conflicts managed, supporting evidence, dissent, remaining limits, and next stop conditions.

10. Risks (summary)

• False allegations and reputational power. A disclaimer cannot undo a convincing but wrong report. Public naming should be exceptional, if used at all.
• Threshold and governance manipulation. Capture can target success definitions, data choice, appeal staffing, or thresholds. Who can credibly authorize suspension against institutional resistance is unresolved.
• Surveillance and mission creep. Successive “small” expansions can turn a public-data tool into a profiling system. Where less data suffices, use less.
• Manipulated inputs and supply chains. Forged records, poisoned data, hostile documents, and compromised dependencies can corrupt analysis. How much reliable evidence remains when an authoritative source itself is compromised is unresolved.
• Unequal visibility. Powerful actors may use structures absent from public data while small suppliers are easy to map. A lack of flags is never a certificate of integrity.
• Specification and gaming. “Find corruption” is not a specification. Publishing indicators aids contestability but may aid evasion.
• Security, outages, and funding loss. A breach can expose subjects and reviewers; sudden funding loss can leave errors uncorrected. Shutdown funding is part of legitimacy.
• Legitimate objections. Agencies, businesses, and civil-society groups may object for valid confidentiality, security, cost, due-process, or sovereignty reasons. Objection is not evidence of wrongdoing.
• Limits of impact. No pilot should promise to eliminate debt, inequality, or political conflict. Evidence without institutional capacity or legal protection may achieve little or increase retaliation.

11. Verification of factual premises and open research questions

F1–F9 were checked against publicly available sources opened and read on November 8, 2026. This is a targeted check, not a systematic review, and it does not validate the proposal. No legal thresholds or universal red-flag rules are inferred.

Verification table

Open research questions

12. Unresolved disagreements

These disagreements remain open and should be argued by reviewers rather than settled by drafting:

1. New institution versus joining existing work. The original framing envisioned a new initiative; joining or contributing may be better. Section 3 leaves this to evidence.
2. Value of the federated network. Some readers may see federation as the core idea; others as unnecessary or risky. It is optional.
3. Public naming. It may be needed for accountability, or too harmful during research (Q3).
4. Transparency of indicators. Openness supports contestability and may also teach evasion (Q7).
5. Acceptable funding. Whether any state, industry, or large philanthropic funding is compatible with independence is unresolved (Q6).
6. Whether AI adds value. The proposal is built to allow the answer “no” (Q1).
7. Depth of detail. Some readers may find the safeguards excessive for a pilot; others, insufficient. They are kept because removing them would change what is being proposed.

13. Editorial readiness and stopping criteria

This draft is intended as a strong discussion draft, not a perfect document. Scope (procurement-only pilot; less arbitrary power, not more surveillance), labeled premises (Section 11), and preserved disagreements (Section 12) are in place for external critique. Further AI-assisted editing has diminishing value; the next test is human scrutiny.

Stop or substantially rethink if mapping shows the need is already well served or joining is clearly better; if reviewers identify a fatal legal, rights, or feasibility objection; if no jurisdiction offers usable public data with safe contestability; if independent funding for safeguards, evaluation, appeals, and orderly exit cannot be secured; or if the pilot fails to beat baselines or harms exceed agreed limits.

14. Request for critique and reviewer group

Questions for reviewers

1. Worth and feasibility. Is the pilot question worth answering? Is it feasible with public procurement data in a jurisdiction you know, given the data-readiness criteria in Section 5?
2. Existing work. What tools, research, datasets, or organizations should this build on, join, contribute to, or use only as a baseline? Is joining actually feasible under the criteria in Section 3, or is independent evaluation the better option? Is the gap already filled?
3. Evaluation measures. Are the proposed baselines and the distinction between precision@K and investigator time per actionable lead workable? What would you change about units, K, ties, or unknown-label handling?
4. Weaknesses. What are the most serious flaws in the pilot design, safeguards, governance, or evaluation? Which should stop the project?
5. Qualified evaluators. Who is qualified to evaluate this—including critics—and what expertise is missing?
6. Source check. Which statements or citations in Section 11 are wrong, too thin, or over-read? Which open questions matter most?

A small, varied critique group [Proposal]

Seek critique from a small, varied group—for example a procurement practitioner or auditor, an anti-corruption researcher, an investigative journalist experienced in data and source protection, a civil-liberties or privacy specialist, a statistician or evaluation expert, an AI security specialist, and someone with experience of wrongful accusation or administrative exclusion. Include at least one skeptic of AI-enabled oversight.

Participation is critique, not endorsement. Do not use reviewers’ names to imply support. Disclose conflicts and compensate review where appropriate. Listing any organization creates no partnership; no outreach has occurred.

15. Immediate next steps

1. Complete the existing-work mapping (Section 3), apply the join/contribute/evaluate/build/stop criteria, and publish what was and was not checked.
2. Invite reviewers to challenge the Section 11 source check, including over-reading and remaining unverified claims.
3. Obtain critique from the small reviewer group (Section 14) and record disagreements rather than resolving them by drafting.
4. After critique, prepare separate later artifacts if needed: a two-page briefing that keeps the procurement-only boundary, no-enforcement principle, and governance uncertainty; and short recipient-specific notes. Neither is part of this draft.
5. If Phase 0 supports proceeding, develop the Phase 1 governance and funding package and commission adversarial capture critique before an operational prototype begins. Bounded exploratory feasibility checks—reading public data documentation, testing parsers on a small public sample, or estimating coverage—are permitted if they stay within privacy and scope safeguards and are not covert deployment or public-facing analysis.
6. Identify one candidate jurisdiction and dataset, documenting permissions, hypothesis-specific readiness (Section 5), gaps, language needs, and risks to subjects; reject settings without safe contestability.
7. Define a falsifiable pilot protocol with the baselines above, precision@K, investigator time per actionable lead, blinded flagged/unflagged review, uncertain-label handling, leakage controls, harm measures, and preregistered stop rules.
8. Commit to publishing results, favorable or not.

The first deliverable should be a stronger research design—not a list of suspected wrongdoers.

References

Accessed November 8, 2026 unless a publication date is the point of the citation. Inclusion is not endorsement.

1. Open Contracting Partnership. “Linked standards.” OCDS documentation. https://standard.open-contracting.org/latest/en/guidance/map/linked_standards/ — F1: OCDS data often refers to separate registers, budgets, and infrastructure datasets.
2. Open Contracting Partnership. “Beneficial ownership information.” OCDS documentation. https://standard.open-contracting.org/latest/en/guidance/map/beneficial_ownership/ — F1: preferred practice is separate contracting and ownership datasets linked by shared identifiers.
3. OECD. “Integrity in public procurement.” In Anti-Corruption and Integrity Outlook 2026, 24 March 2026. https://www.oecd.org/en/publications/anti-corruption-and-integrity-outlook-2026_16708b78-en/full-report/component-14.html — F1, F3, and limited-use part of F4: mixed causes of red flags; value of combining sources; limited analytics/AI adoption.
4. Open Contracting Partnership. “OCP Data Registry.” https://data.open-contracting.org/ — F2: OCDS data from over 100 publishers, with noted quality issues.
5. U.S. Department of the Treasury, Bureau of the Fiscal Service. “Data Sources.” USAspending.gov. https://www.usaspending.gov/data-sources — F2: official U.S. federal award and FPDS data, with documented gaps and linkage limits.
6. Turpin, Miles, Julian Michael, Ethan Perez, and Samuel R. Bowman. “Language Models Don’t Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting.” arXiv:2305.04388, 2023. https://arxiv.org/abs/2305.04388 — F5: in the models and tasks studied, chain-of-thought explanations can be plausible yet systematically unfaithful.
7. Anthropic Alignment Team (Lanham et al.). “Measuring faithfulness in Chain-of-Thought reasoning.” 18 July 2023. https://www.anthropic.com/research/measuring-faithfulness-in-chain-of-thought-reasoning — F5: on the tasks tested, models did not consistently rely on the reasoning they stated.
8. Kim, Elliot Myunghoon, Avi Garg, Kenny Peng, and Nikhil Garg. “Correlated Errors in Large Language Models.” Proceedings of the 42nd International Conference on Machine Learning, PMLR 267:30038–30066, 2025. https://proceedings.mlr.press/v267/kim25e.html — F6: in the leaderboard and resume-screening settings studied, model errors were substantially correlated.
9. OWASP Gen AI Security Project. “LLM01:2025 Prompt Injection.” https://genai.owasp.org/llmrisk/llm01-prompt-injection/ — F7: indirect injection via external files or websites; no known fool-proof prevention method.
10. Open Contracting Partnership. Home page. https://www.open-contracting.org/ — F8: active open-contracting organization.
11. Open Ownership. Home page. https://www.openownership.org/en/ — F8: active beneficial-ownership transparency organization.
12. Organized Crime and Corruption Reporting Project. “OCCRP Aleph Pro.” https://aleph.occrp.org/ — F8: investigative platform of public sources; also hosts leaked archives for accredited journalists, outside GAI’s public-data rule.
13. OpenSanctions. Home page. https://www.opensanctions.org/ — F8: open database of sanctions, PEPs, and watchlists.
14. Transparency International. Home page. https://www.transparency.org/en — F8: global anti-corruption movement.
15. Government Transparency Institute. “About the Institute.” https://www.govtransparency.eu/about/ — F8: procurement-integrity research institute; names Opentender among its tools.
16. Garfinkel, Simson L. De-Identification of Personal Information. NISTIR 8053. National Institute of Standards and Technology, October 2015. https://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8053.pdf — F9: secondary NIST recounting of linkage attacks, including Sweeney’s hospital-record demonstration.

Closing

Ordinary people cannot personally audit every contract made in their name. They rely on rules, and on institutions that enforce them. When those who hold power can bend the rules unseen, everyone else bears the cost.

AI may help people find and connect public evidence that would otherwise stay scattered. It is not a ruler, a judge, or an oracle, and it will make mistakes. It is worth using only if its methods can be questioned, its errors corrected, its expansion refused, and its operation stopped.

The aim is not to end privacy, presume guilt, or replace institutions with machines. It is to make honest conduct easier to demonstrate, concealed rule-breaking harder to sustain, and accountability less dependent on who holds power—without creating a new unaccountable power.

Verify power. Preserve freedom.

Revision 3 discussion draft, November 8, 2026. Prepared by Jeff Owen, private citizen, with AI-assisted drafting, for expert critique. This document does not allege wrongdoing by any person, family, institution, or political group. It proposes no automatic enforcement, claims no endorsement or partnership, reports no outreach, and establishes no authority to obtain protected records. Citations support only the scoped statements in Section 11; they do not validate the proposal as an implementation plan.