{
  "E38-IP-001": "signed policy documents / OPA bundles / SPKI certificates",
  "E38-IP-002": "content addressing, signed manifests",
  "E38-IP-003": "HTN planning, delegation chains, macaroon caveat chains",
  "E38-IP-004": "object-capability attenuation, macaroons, UCAN, Biscuit",
  "E38-IP-005": "capability non-amplification; constrained RL / shielding",
  "E38-IP-006": "reward-hacking / specification-gaming literature, ML monitoring, Goodhart taxonomy (Manheim & Garrabrant)",
  "E38-IP-007": "fencing tokens, epoch numbers in consensus, lease invalidation",
  "E38-IP-008": "runtime verification, digital twins, E16 (same repo)",
  "E38-IP-009": "proof-carrying authorization (Appel & Felten), XACML obligations/advice",
  "E38-IP-010": "signed audit logs, policy decision logging",
  "E38-IP-011": "BFT literature; NOTE ledger is not BFT-replicated",
  "E38-IP-012": "cross-domain authorization, GNAP, federated XACML",
  "E38-IP-013": "same as IP-012",
  "E38-IP-014": "workflow engines, saga patterns",
  "E38-IP-015": "event sourcing, deterministic replay, CT logs"
}