# Source register — Organization Boundary Test

Checked September 20, 2026. All three exact official URLs returned direct HTTP 200. Sources describe general AI/data-security concerns, not Facily.ai or modSTORAGE deployment, product capability, certification or incident.

| ID | Source | Article use | Material boundary |
| --- | --- | --- | --- |
| OBT-SRC-001 | National Institute of Standards and Technology, [AI RMF Core](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/) | Intended scope, privacy requirements, human oversight and component risk mapping. | Voluntary cross-sector framework; does not prescribe this matrix or certify an implementation. AI RMF 1.0 is under revision. |
| OBT-SRC-002 | Amazon Web Services, [Capability 3: Providing secure access to data and systems for generative AI](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture-generative-ai/gen-ai-agents.html) | Ingestion/storage/retrieval/inference control layers, metadata filtering, application responsibility for adding correct filters. | Vendor-specific prescriptive guidance. The article does not assert that any company uses AWS or that metadata alone always guarantees isolation. |
| OBT-SRC-003 | OWASP Gen AI Security Project, [LLM08:2025 Vector and Embedding Weaknesses](https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/) | Cross-context leakage and permission-aware retrieval risk. | Community security guidance, not a self-storage standard or evidence of a real incident. |

The fictional Operator A/Operator B scenario and ten-case matrix are authored teaching designs. No real customer organization, facility record, exposure, model, retrieval system, test result, performance figure, contract right or legal outcome is claimed.