Research methodology and limitations

The collection and the public bibliography

The underlying inventory has 218 records. Of these, 210 were reviewed to the scope required for the research and eight were unreviewed, inaccessible, or excluded candidates. A reviewed record does not mean every page of every linked document was read from beginning to end.

Neither 130 publication units nor 113 report families is a count of independent empirical studies. A family can contain related articles, a recurring survey, shared evidence, or practitioner interpretation. The number of independent empirical studies is not established. Documents within and across publishers can cite one another, reuse a survey, or discuss the same customer example.

The nine principal organizations have different publishing roles. Palantir is a software-platform publisher; it is not classified as a traditional consulting firm. Ten of its 13 counted units are mutable technical documentation, with three historical case examples.

Coverage is materially uneven. McKinsey’s five counted sources are a narrower slice than the collections for several other organizations. “No meaningful evidence” in a coded theme therefore means that the requirement was not established in the reviewed tranche. It does not mean that the organization has never discussed it, lacks the capability, opposes it, or sees no market for it.

Of the 130 counted units, 56 have a 2026 original publication date, 45 a 2025 date, 12 a 2024 date and one a 2023 date. Sixteen original dates remain unknown. Unknown dates are published as unknown, rather than inferred from a copyright year, URL, retrieval date or SEO update.

Discovery and inclusion

Discovery combined ordinary public search, official publication and topic pages, related links, report PDFs, technical documentation and public site inventories. Discovery lists were used to find candidates. Their size does not count as documents read or evidence of comprehensive coverage.

Sources were retained for their relevance to business workflows, enterprise architecture, identity, authorization, runtime policy, evaluation, native action behavior, uncertainty, recovery or evidence. The principal research included broader industry material; the public report selects a smaller set that directly informs its execution and recovery argument.

The main report uses 50 reference keys:

• 39 sources from the original inventory: 23 principal-corpus publications and 16 supplemental sources.
• Nine additional external sources: four official Kubernetes documentation pages and five first-party security, specification or recovery publications found during follow-up.
• Two Nikxius product references: current product scope and a dated local verification record. These are product evidence, not independent external validation.

The report therefore cites 48 external sources. The complete public library is deliberately larger, with 222 bibliographic records. Inclusion in that library does not mean a document is quoted or relied on for a particular report claim. Records identify the counted principal collection, excluded summaries, supplemental material, follow-up material and report references.

The 39 selected original sources were rechecked at the relevant retained passages for the public report. The review resolved the original publisher, title, URL, documented date and claim location. Quantitative passages were checked for denominator, population and interpretation. Longer PDFs, standards and documentation were reviewed at relevant sections; the review does not claim that all 210 original reviewed documents were freshly reread end-to-end during publication preparation.

Automated checks confirmed consistency of all 210 reviewed main-capture hashes and found all 363 stored excerpts in normalized retained main or supporting text. These checks establish consistency of retained evidence. They cannot establish truth, independent replication, completeness, representativeness or the current behavior of a deployed product.

Public text extraction and mutable documentation

Some sources were retained as HTML text or through public-reader extraction when useful public content was available. McKinsey’s reviewed reader PDFs and much of BCG’s extracted article text used such transport. A text extraction is not equivalent to a visual audit of every original PDF page. Charts, figures and layout can be incompletely represented in extracted text.

Where a chart’s interpretation mattered, the review used the retained chart or accompanying methodology. KPMG’s cost-response chart on page 18 was visually inspected to confirm that the reported 49% is 24% scaling back or narrowing deployment plus 25% delaying or pausing it. The separate 22% questioning the decision without making changes is excluded.

Living documentation can change after the cutoff. The library keeps the original public URL and relevant version information, with unknown publication dates where appropriate. For example, an MCP URL redirecting to a dated specification version establishes the version inspected, not necessarily its publication date. The current Kubernetes API documentation describes conditions for ordering resource versions; older general statements about universal opacity must not override those documented version and resource-type conditions.

The public library publishes bibliographic metadata and original links. It does not distribute retained commercial PDFs, page captures, substantial quotations or publisher graphics.

Quantitative evidence

A number is useful only with its base and question. The report does not pool unrelated survey percentages into a global adoption rate or infer a software market from general AI spending intentions.

The broader reviewed selection also contains survey findings about agent inventories, audit trails and human-approval levels. Those retain their question-specific bases in the claims record. Forecasts, modeled potential, aspirational operating targets, anonymous cases and self-reported outcomes are not interchangeable evidence types.

Editorial coding and the consensus matrix

The matrix contains 12 themes across nine organizations: 108 editorial assessments. Its categories are Strong evidence, Moderate evidence, Weak mention, No meaningful evidence and Contradictory evidence. These describe the cited publications, not verified enterprise deployments, publisher endorsements or demand for a separate supplier.

Several rows combine adjacent ideas. Identity and access coverage does not prove formal attenuated delegation. Security coverage does not prove process, memory and network isolation. Observability and evaluation coverage does not prove outcome reconciliation. Logs that can contribute to an audit do not automatically satisfy a particular audit assertion.

The public matrix uses narrower labels and explicit row limits. Six grades were amended during publication review:

• PwC, Accenture and Oliver Wyman were reduced from Moderate to Weak for narrow authoritative outcome reconciliation. Incident recovery, payment-authority proposals and operational review are relevant but adjacent evidence.
• Palantir was reduced from Strong to Moderate in that row. Its webhook documentation is direct evidence of an external partial-success boundary; it does not itself demonstrate a complete reconciliation mechanism.
• Accenture and Oliver Wyman were reduced from Weak to No meaningful evidence for independent portable execution verification under the strict definition. Cryptographic intent, tamper-evident trails, output-verification preferences and model portability are different functions.

Every cell links to the publications used for its assessment. Other composite grades retain their stated limits even where the letter grade did not change. The organization count is not an independent-study count or a statistical consensus measure.

Supplementary search and current alternatives

A limited supplementary search review examined terminology and existing approaches. It obtained 40 parsed organic results from four usable queries. Access failures prevented the planned broader query set from producing usable observations. The sample came from DuckDuckGo and Brave; it is not a Google ranking study. No search-volume, click, conversion or keyword-price measurement supports the conclusions.

Thirteen first-party pages were attempted in that follow-up and ten page bodies were verified. The three blocked pages were not used as verified product evidence. An inaccessible page or an unobserved query is not evidence of no competitors or no demand.

The verified follow-up shows that pre-action enforcement, exact-action approval, draft control contracts and outcome-aware recovery are already discussed by other publishers. Airia, Snyk, Microsoft’s draft Agent Control Specification, OWASP and Cohesivity supply relevant examples in the report. Some are previews or draft specifications. Their terminology and stated mechanisms are evidence of existing approaches, not independent proof of feature quality, customer adoption or complete coverage.

How statements are classified

The action-contract framework is a synthesis of established security and distributed-systems concepts. UNKNOWN is used as explicit design vocabulary for an unresolved effect. The report does not claim invention of pre-action controls, durable operation identity, idempotency, reconciliation or signed receipts.

Product evidence remains separate. The referenced local verification reports 232 distinct Runtime tests, including 27 native Kubernetes cases, and three demonstration scenarios. It is historical local conformance with disposable infrastructure and synthetic identity fixtures. Website checks do not refresh that record or establish customer production validation. A desired-state commit, controller convergence and application health remain separate conclusions.

Nikxius is not affiliated with or endorsed by the organizations referenced. Sources are presented through short original paraphrases and links. Corrections should identify the specific claim, source and relevant section; changed evidence may require revising both the report and its coded assessment.