Changelog
What changed in the BROCS framework, versioned and dated. Site tweaks do not appear here; changes to the framework itself do.
This page records changes to BROCS definitions, capabilities, and supporting evidence. Editorial and site changes stay outside the framework version. Include the version when citing BROCS.
2026-08-27 / v1.3
Assessment expands to 25 statements and adds reports
The assessment moves to a five-point scale: twenty-five statements, five per letter, each new statement covering the vertical the four-point version missed. Each letter gains a count-based coverage label, from Uncovered to Covered. The total remains a score out of 25 rather than a maturity rank. The result page now draws coverage as a radar, generates a written report on what to fix first with a link per finding, and can be printed to PDF or emailed on request without writing the address to site storage unless the reader subscribes. Scorelines are recorded without selected statements, addresses, accounts, or stored IP addresses to build an aggregate picture; the privacy notice lists the fields. The framework repository moves to github.com/brocs-org/brocs, its own organization, and brocs.org and brocs.io join brocs.ai as permanent redirects to the canonical home.
2026-08-26 / v1.2
The library and the questions grow; the FAQ and the reading list arrive
The failure-mode library grows from seven entries to sixteen, every one publicly sourced: Samsung's three pastes in twenty days, Microsoft's 38TB SAS token, NYC's MyCity chatbot, Zillow Offers, the Slack AI exfiltration demonstration, the one dollar Tahoe, the OpenAI Redis leak, the GPT-4o sycophancy rollback, and the three-day Codex deprecation. The questions grow from twelve to twenty-one with the ones asked in incident reviews, audits, and renewals: insider exfiltration through an assistant, hidden instructions in documents, retention and training terms, the 2am incident, cost caps, audit evidence, air-gapped operation, exit with the derived artifacts, and the model updated underneath you. A twenty-seven answer FAQ about the framework itself and a sourced reading list join the resources.
2026-08-26 / v1.1
Control gains a sixth vertical: remote access
Twelve buyer questions collected from real rooms kept landing on the same missing ground: remote work without data movement, consultants and contractors, cross-border travel, and cross-border data governance. Eight of the twelve mapped to Control, so Control now carries remote access as a first-class vertical alongside configuration, ingress, identity, storage, and routing. The questions themselves are published at /resources/questions/.
2026-08-26 / v1.0
The framework site launches at brocs.fyi
Five letters, twenty-six vertical pages, the failure-mode library with seven sourced public incidents, a thirty-two term glossary, the assessment and its scoreline, why five, and adjacent practices. The framework text is published under CC BY 4.0 and the data files are public at github.com/brocs-org/brocs.
2026-05-23 / v0.9
BROCS is coined and published
Build, Run, Observe, Control, Secure, named as the capabilities required to enable AI in an enterprise. Coined a few weeks earlier during an AI enablement engagement for a healthtech startup, and published on May 23, 2026 in the origin essay at leomata.com/blog/brocs.