# AI Permission Cycle Time Research Protocol

**Protocol ID:** COY-PCT-0.1
**Status:** Draft frozen for external methods review
**Owner:** Philipp Rimmler, Petrichor Projects
**Frozen:** 2026-08-23
**Recruitment:** Blocked pending approval
**Results:** None collected

## 1. Research question

How much time and repeated diligence do a buyer and provider spend reaching a bounded AI-use decision, and what changes when the decision is supported by structured evidence and a reusable assurance assertion?

## 2. Design

Prospective observational pilot with within-buyer historical comparison where comparable prior events exist. No randomization, market representativeness, or causal identification is claimed.

### Unit of analysis

One provider, one buyer, one bounded AI-use permission event.

### Event start

Timestamp when the accountable buyer receives a complete request containing:

- provider legal entity;
- named service and workflow boundary;
- AI use and purpose;
- tools and suppliers;
- data classes;
- accountable provider owner;
- requested permission;
- known exclusions and open conditions; and
- the initial evidence pack.

Preparation time before completeness is recorded separately.

### Event end

Timestamp of documented approval, conditional approval, rejection, provider withdrawal, or unresolved cutoff.

## 3. Participants

### Buyer eligibility

- Owns or materially influences the permission decision.
- Can identify one live or realistic simulated event.
- Agrees to record time, requests, roles, restrictions, and outcome.
- Accepts de-identified learning publication under the consent selection.
- Discloses conflicts.

### Provider eligibility

- Brings a real and assessable service boundary.
- Can provide evidence lawfully.
- Names an accountable executive and operating owner.
- Discloses known material conditions.
- Accepts unfavorable findings and the no-certification language.

### Exclusion

- Fictitious boundary.
- No accountable decision owner.
- Evidence access is structurally impossible.
- Participation would impair an investigation or legal duty.
- Participant demands a positive decision, certification, endorsement, or editorial control.

## 4. Measures

| Measure | Definition | Source |
|---|---|---|
| Permission cycle time | Calendar hours from complete request to documented decision | Timestamped intake and decision records |
| Preparation time | Calendar and labor time before request completeness | Provider activity log |
| Buyer diligence hours | Review, clarification, meeting, escalation, and documentation time | Buyer activity log |
| Provider diligence hours | Evidence preparation, response, remediation, and revision time | Provider activity log |
| Clarification burden | Count of material follow-up requests | Request log |
| Evidence reuse rate | Reused accepted items divided by accepted items presented | Evidence ledger |
| Decision result | Approved, conditional, rejected, withdrawn, unresolved | Signed decision record |
| Control preservation | Client restrictions, escalation rights, and accountable authority retained | Decision-quality checklist |
| Rework | Material items resubmitted after buyer rejection or clarification | Evidence ledger |
| Handoffs | Transfers between accountable review functions | Activity log |

Metric definitions freeze before the first comparative analysis.

## 5. Baseline

Collect up to three comparable permission events per buyer from the preceding twelve months where records permit. Record comparability on service risk, data class, use type, buyer functions, contract stage, and decision result. Do not pool events rated non-comparable.

## 6. Study evidence pack

- Boundary schedule.
- Material AI-use record.
- Tool, supplier, and data-class inventory.
- Client restriction map.
- Control and evidence register.
- Task-specific evaluation summary.
- Known exceptions and remediation.
- Material-change rules.
- Provider assertion.
- Buyer decision record.

## 7. Decision-quality safeguards

- Buyer authority cannot be delegated to Petrichor, an assessor, or the evidence pack.
- Client-specific restrictions remain explicit.
- Missing evidence remains visible.
- The provider retains primary responsibility for its service.
- Reviewers record whether assurance framing caused overreliance.
- Rejection and added control work count as valid outcomes.

## 8. Data handling

### Collection

Use participant IDs and event IDs from intake. Do not place client content, privileged advice, secrets, credentials, vulnerabilities, or unrelated personal data in the research dataset.

### Access

- Identifiable intake: Phil and the approved research administrator.
- Event evidence: approved review team on a need-to-know basis.
- Analysis dataset: de-identified fields only.
- External methods reviewer: de-identified method and sample materials unless separate permission exists.

### Retention

The participant agreement must set retention periods for contact records, evidence, activity logs, consent, analysis data, and publication support. No default retention period is approved in this draft.

### Withdrawal

Participants may withdraw prospectively under the signed agreement. Treatment of data already included in de-identified aggregate analysis must be stated before consent.

## 9. Publication permissions

Each participant selects one:

1. Named participation with attributed findings.
2. Named participation with de-identified findings.
3. Fully de-identified participation.

Quotation, logo, audio, transcript, and document permissions are separate selections. Factual review does not grant editorial control.

## 10. Analysis plan

- Report sample composition and recruitment.
- Separate live and simulated events.
- Report medians, ranges, and individual paired changes where defensible.
- Report missingness and attrition.
- Do not substitute averages for skewed time measures.
- Do not infer causation from pre-post differences.
- Suppress or combine small cells that create reidentification risk.
- Report null, mixed, adverse, and favorable findings.
- Record every deviation from the frozen protocol.

## 11. Pilot gate

- Eight to twelve providers.
- At least three buyer risk owners.
- At least ten independently double-scored cases.
- At least three live buyer permission decisions.

Meeting the gate permits a pilot report. It does not permit a broad market benchmark.

## 12. Pause and stop rules

Pause recruitment or analysis when:

- buyer authority is weakened;
- participants treat the study as certification;
- a boundary is misleading or unassessable;
- protected data cannot be handled lawfully;
- commercial pressure affects a finding;
- measurement fields change after results are reviewed; or
- publication creates material reidentification risk.

## 13. Required approvals before recruitment

- Phil editorial approval.
- External methods review.
- Consent and participation agreement review.
- Privacy, confidentiality, privilege, and security review.
- Final data dictionary.
- Final intake implementation.
- Named research administrator and incident contact.

## 14. Change control

Record protocol version, date, editor, exact change, reason, whether data collection had begun, affected measures, and required reanalysis. A change after data review must be labeled post-hoc.

## 15. Current decision

Protocol 0.1 is frozen for critique. Recruitment and data collection remain blocked.