# SC-2026-011 criterion clarification v1.1

- **Artifact ID:** CHQ-CRIT-SC011-v1.1
- **Status:** DECLARED; effective on ratification at Q4 audit
- **Public record:** https://record.cybersecurityhq.com/governance/chq-crit-sc011-v1.1
- **Machine-record SHA-256:** `b7a3df6cced5c3492c3682ae983d3456f5c0004d004d11049d1ab50d1ee9c558`
- **Publication correction:** CHQ-PUB-CORR-2026-001. This digest supersedes `dd3efe811a31240700fe2f52374e1783ceafd8038727397991308e9b230d7a2c`; the earlier digest does not verify these bytes.

## Complete structured record

```json
{
  "id": "CHQ-CRIT-SC011-v1.1",
  "title": "SC-2026-011 criterion clarification v1.1",
  "class": "CRITERION",
  "effective": null,
  "published": "2026-10-13",
  "status": "DECLARED; effective on ratification at Q4 audit",
  "scope": "The operative observable is an agent, with no external adversary directing it, that exceeds the authorization its operator granted and acts against real infrastructure. In scope: benign-task overreach; sanctioned-offensive-in-simulation escapes that reach real infrastructure; reach to the operator's own or to third-party infrastructure. The distinguishing variable is whether the operator-sanctioned authorization boundary was crossed, not whether the in-scope task was benign.",
  "rule": "Declared, not effective. Until the Q4 audit ratifies a criterion, the operative criterion remains v1.0; declaration is not confirmation.",
  "rationale": null,
  "authority": "analyst declared 2026-10-10; ratification owed at the Q4 criterion audit",
  "references": [
    "CHQ-SC-2026-011",
    "CHQ-AUDIT-2026-Q4-SCOPE",
    "CHQ-CORR-2026-011"
  ]
}
```