# Authoritative Product Management Source Catalog

Research baseline and link check: **July 28, 2026**

## How to use this catalog

This is a curated evidence base, not a ranking of personalities and not a
requirement to consume every item. Start with the free route for the competency
you are practicing, use original sources before summaries, and read competing
methods when the context matters.

### Evidence tiers

- **Tier A:** standards, regulators, government data, peer-reviewed or original
  research, official documentation, public filings, and first-party accounts.
  A first-party company source is authoritative about what that company says it
  did; it is not automatically proof that the method generalizes.
- **Tier B:** original practitioner frameworks, respected books, author-origin
  guidance, and well-documented vendor methods. These are useful for practice
  but contain a viewpoint, commercial incentive, or less formal evidence base.
- **Tier C:** secondary summaries, aggregators, community collections, and
  interview-prep sites. Use them to discover prompts or vocabulary, never as the
  sole support for a factual or legal claim.

### Freshness rules

1. Date-stamp market numbers, laws, product behavior, prices, interview
   processes, AI capabilities, and vendor documentation.
2. Recheck AI, privacy, security, regulation, current product cases, pricing,
   and company interview-process sources every quarter.
3. Recheck stable standards and foundational methods annually. A publication
   can be old and still be the current official version; note both facts.
4. For regulation, read the official text and obtain qualified advice. This
   catalog is a learning aid, not legal advice.
5. When a page is a living document, record the access date in the question or
   case source record.

### Access labels

- **Free:** full useful content is available without payment.
- **Free registration:** useful content requires an account or email.
- **Freemium:** core material is free; the publisher sells related tools or
  training.
- **Paid/library:** book, course, or article normally requires purchase,
  subscription, or library access.

## 1. PM role, competency, and operating-model baselines

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [Product Management CDF Competencies — GitLab](https://handbook.gitlab.com/handbook/product/product-management/product-cdf-competencies/) | A, first-party role system | Free | A public PM ladder from PM through Principal, with observable scope across roadmap, sensing, thought leadership, and team alignment. | GitLab's all-remote, developer-tool, and product-led context shapes the model; do not copy titles mechanically. | Modified **March 19, 2026**; live when checked. |
| [Product Management Learning and Development — GitLab](https://handbook.gitlab.com/handbook/product/product-management/learning-and-development/) | A for GitLab practice; B as curriculum | Free | A current example of how one product organization curates principles, process, domain learning, PM craft, and leadership development. | A living internal collection, not an independently validated curriculum; links can move. | Page was recently updated when checked in July 2026. |
| [Product Manager Capability Framework — UK Government Digital and Data Profession](https://ddat-capability-framework.service.gov.uk/role/product-manager) | A, government profession standard | Free | Role expectations from Associate PM through Head of Product; strong on user needs, outcomes, value for money, leadership, and multidisciplinary delivery. | Public-service language and governance differ from venture-backed software, though most competencies transfer. | Product role updated **February 28, 2025**; checked 2026-07-28. |
| [Service Standard — GOV.UK](https://www.gov.uk/service-manual/service-standard) | A, government standard | Free | A compact whole-product quality bar: understand users, solve the whole problem, join channels, include everyone, protect privacy, publish performance, choose technology well, and operate reliably. | Written for UK public services; legal and organizational details do not transfer automatically. | Living standard; checked 2026-07-28. |
| [Solve a whole problem](https://www.gov.uk/service-manual/service-standard/point-2-solve-a-whole-problem) and [provide a joined-up experience across channels](https://www.gov.uk/service-manual/service-standard/point-3-join-up-across-channels) — GOV.UK, with [Monitoring Distributed Systems — Google SRE](https://sre.google/sre-book/monitoring-distributed-systems/) | A for documented government service expectations and first-party engineering practice; B as cross-context patterns | Free | Testing whether separately passing buyer, seller, payment, support, online, offline, and partner components compose into one complete outcome; combining end-to-end black-box journeys, internal state evidence, exception coverage, actor-specific support, and operational readiness rather than calling component health “done.” | GOV.UK requirements are scoped to UK government services and the Google chapter describes one engineering organization. The four golden signals do not prove correct business state, money reconciliation, accessible recovery, safe marketplace behavior, or a complete user journey. | GOV.UK points updated **January 29, 2026** and **December 16, 2025**; Google SRE chapter and all routes checked 2026-07-28. |
| [Product Manager Job Description — GitLab](https://handbook.gitlab.com/job-description-library/product/product-manager/) | A, first-party role definition | Free | Clear responsibilities and the leadership nature of PM work in a product-led company. | One company's role architecture; less useful as a universal leveling rubric than the CDF page. | Current when checked in July 2026. |
| [The Product Operating Model: An Introduction — SVPG](https://www.svpg.com/the-product-operating-model-an-introduction/) | B, original practitioner model | Free | Connecting product strategy, discovery, delivery, and empowered durable teams; useful for contrasting outcomes with feature-factory output. | Normative and opinionated; examples emphasize technology companies and can understate valid regulated, services, hardware, or project constraints. | Foundational 2022–2023-era model; SVPG remained active in 2026. |
| [Empowered Product Teams — SVPG](https://www.svpg.com/empowered-product-teams/) | B, original practitioner guidance | Free | Team mission, context, coaching, staffing, and the difference between assigning problems and assigning features. | Aspirational without the required leadership, skills, decision rights, and funding mechanisms. | Published 2018; concept remains central to SVPG's current material. |
| [SVPG Books: INSPIRED, EMPOWERED, LOVED, TRANSFORMED](https://www.svpg.com/books/) | B, practitioner books | Paid/library; summaries free | A coherent reading route through product teams, product leadership, product marketing, and operating-model transformation. | One school of product management; read alongside government, reliability, economics, safety, and empirical research sources. | Catalog live in July 2026; `INSPIRED` second edition is from 2017. |

## 2. Discovery, research, problem framing, and product-market fit

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [Framework for Innovation / Double Diamond — Design Council](https://www.designcouncil.org.uk/resources/framework-for-innovation/) | A/B, origin institution | Free | Divergent and convergent work across Discover, Define, Develop, and Deliver; an accessible map for framing design work. | A process map, not a guarantee of rigor or a required sequence. Real discovery and delivery overlap. | Double Diamond originated in 2004; current Design Council page checked 2026. |
| [Systemic Design Framework — Design Council](https://www.designcouncil.org.uk/resources/systemic-design-framework/) | A/B, origin institution | Free | Complex services and ecosystems: explore, reframe, create, catalyse, plus relationships, leadership, and continuing change. | More abstract than a feature-level workflow; needs domain, operations, and policy expertise. | Current living framework checked 2026-07-28. |
| [What Is Human-Centered Design? — IDEO.org Design Kit](https://www.designkit.org/human-centered-design.html) | B, author-origin method | Free | Inspiration, ideation, implementation, empathy, prototyping, and learning with people. | Workshop language can encourage superficial empathy unless paired with representative sampling, research rigor, and longitudinal evidence. | Stable foundational material; checked 2026. |
| [Field Guide to Human-Centered Design / Facilitator Resources — IDEO.org](https://www.designkit.org/resources/7.html) | B, practitioner toolkit | Free | Activities and facilitation for a first practical HCD workshop. | A starting toolkit, not a replacement for trained research, accessibility, ethics, or domain expertise. | Stable; checked 2026. |
| [Jobs to Be Done Theory — Christensen Institute](https://www.christenseninstitute.org/theory/jobs-to-be-done/) | B, theory-origin institution | Free | Framing the progress a person seeks in a circumstance, including functional, social, and emotional dimensions. | JTBD has competing interpretations; avoid turning it into a slogan or ignoring power, access, and multi-stakeholder systems. | Institute page and examples were current in 2025–2026. |
| [Jobs to Be Done Resource Library — Christensen Institute](https://www.christenseninstitute.org/resources/theory/jobs-to-be-done/) | B, case library | Free | Case examples and deeper applications beyond a one-paragraph JTBD definition. | Cases are selected to illustrate the theory and should be triangulated with other evidence. | Included 2025–2026 material when checked. |
| [Opportunity Solution Trees — Product Talk](https://www.producttalk.org/2016/08/opportunity-solution-tree/) | B, author-origin framework | Free | Mapping a desired outcome to an opportunity space, solution options, and assumption tests. | A visualization and conversation aid; tree neatness can hide uncertain, overlapping, or systemic relationships. | Page revised **December 6, 2023**; checked 2026. |
| [Getting Started with Continuous Discovery — Product Talk](https://www.producttalk.org/getting-started-with-discovery/) | B, practitioner guidance | Free/freemium | Outcomes, frequent customer contact, assumption testing, opportunity mapping, and a sustainable discovery cadence. | Prescriptive cadence may not fit all procurement, safety, hardware, or regulated settings; adapt the habit to access and risk. | Living article checked 2026. |
| [When to Use Which UX Research Methods — Nielsen Norman Group](https://www.nngroup.com/articles/which-ux-research-methods/) | B, research-practitioner synthesis | Free | Selecting among twenty methods by attitudinal/behavioral, qualitative/quantitative, context, and product stage. | A high-level selection grid; it does not teach sampling, consent, analysis, or domain-specific validation by itself. | Published 2022; reviewed **July 15, 2026**. |
| [Usability Testing 101 — Nielsen Norman Group](https://www.nngroup.com/articles/usability-testing-101/) | B, practitioner synthesis | Free | Participants, realistic tasks, facilitation, qualitative versus quantitative tests, and remote versus in-person basics. | Introductory; teams still need accessibility, assistive-technology, statistical, and research-operations depth. | Published 2019; reviewed **July 15, 2026**. |
| [The Real Product-Market Fit — Y Combinator](https://www.ycombinator.com/blog/the-real-product-market-fit/) | B, first-party accelerator guidance | Free | Distinguishing urgent demand and sustained usage from self-declared PMF; launch, listen, and iterate. | Startup and founder lens; not a precise universal metric and less direct for mandated or public services. | Published 2016; stable concept, checked 2026. |
| [Y Combinator's Essential Startup Advice](https://www.ycombinator.com/blog/ycs-essential-startup-advice/) | B, first-party accelerator guidance | Free | Launching, talking to users, doing unscalable work, and resisting premature scaling. | Optimized for early venture startups; mature, regulated, hardware, and safety-critical products need additional gates. | Published 2017; stable advice, checked 2026. |
| [Startup School Video Library — Y Combinator](https://www.ycombinator.com/blog/startup-school-videos) | B, first-party course collection | Free | Practical talks on user conversations, first customers, MVPs, launch, and founder-led discovery. | Quality and specificity vary by talk; examples skew toward venture-backed startups. | Catalog published 2023 and live in 2026. |
| [Do Things That Don't Scale — Paul Graham](https://www.paulgraham.com/ds.html) | B, original essay | Free | Manual recruitment and exceptional early-user service before repeatable growth exists. | An essay, not causal evidence; manual work must produce learning rather than permanent hidden operations. | Published 2013; stable. |
| [The Lean Product Playbook — Dan Olsen](https://leanproductplaybook.com/book/) | B, author-origin book | Paid/library; overview free | A stepwise product-market-fit process from target customer and unmet need through value proposition, MVP, prototype, testing, and metrics. | A linear-looking model can obscure iteration and system context; examples predate today's AI and trust landscape. | Book published 2015; author page live in 2026. |
| [Continuous Discovery Habits — Teresa Torres](https://www.producttalk.org/continuous-discovery-habits/) | B, author-origin book | Paid/library; related articles free | A detailed practice system for continuous interviewing, opportunity mapping, and assumption testing. | Practitioner model; the suggested cadence and trio structure should be adapted to context. | Book published 2021; supporting material current in 2026. |
| [Participant safeguarding in user research — UK Department for Education](https://standards.education.gov.uk/standard/participant-safeguarding-in-user-research) | A, government research standard | Free | Planning consent, confidentiality limits, participant autonomy, disclosure-of-harm escalation, additional safeguards for people who may not be able to consent, and an explicit safeguarding owner before sensitive research. | A DfE standard and checklist, not a universal ethics-board decision, local safeguarding law, clinical protocol, or proof that a study is safe. Adapt it with qualified research, legal, safeguarding, disability, and local-domain owners. | Version **1.01**, published December 6, 2023 and updated September 16, 2024; checked 2026-07-28. |
| [Best Practices for Survey Research: AAPOR](https://aapor.org/standards-and-ethics/best-practices/) and [June 2023 PDF](https://aapor.org/wp-content/uploads/2023/06/Survey-Best-Practices.pdf) | A, professional-association research guidance | Free | Choosing probability or nonprobability sampling and collection modes; writing and pretesting questionnaires; piloting fieldwork; checking quality; and reporting methods, weighting, limitations, and sponsor transparently. | Public-opinion and survey-research guidance, not a local privacy, safeguarding, institutional-review, or legal determination. Nonresponse and nonprobability adjustment require specialist judgment, and a compliant process does not make a sample representative. | Living AAPOR page and **June 2023** PDF checked 2026-07-28; recheck annually and when AAPOR revises its code or standards. |
| [Using thematic analysis in psychology: Braun and Clarke](https://doi.org/10.1191/1478088706qp063oa) with [publisher record](https://www.tandfonline.com/doi/abs/10.1191/1478088706qp063oa) | A, peer-reviewed original method | Abstract free; full text may require library access | Building a traceable qualitative analysis from familiarization and coding through candidate themes, review, definition, and written evidence while making the analyst's theoretical stance and reflexivity explicit. | Reflexive thematic analysis is not coding-reliability content analysis, a frequency estimate, or proof of prevalence. Theme quality depends on the question, corpus, reflexive judgment, negative evidence, and an auditable analysis record. | *Qualitative Research in Psychology* **3(2), 2006**, pp. 77-101; DOI and publisher record checked 2026-07-28. |

## 3. Product design, service design, accessibility, and internationalization

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [Effective Communication](https://www.ada.gov/resources/effective-communication/) and [Emergency Planning](https://www.ada.gov/topics/emergency-planning/) — U.S. Department of Justice ADA.gov | A, government civil-rights guidance | Free | Matching auxiliary aids and channels to the nature, length, complexity, context, and person's communication method; planning multimodal emergency alerts, accessible evacuation information, and communication continuity. | U.S. ADA Title II/III and state/local emergency-management scope is fact-specific. The effective-communication page describes itself as informal guidance, not new binding duties; it neither proves whole-service accessibility nor replaces current law and qualified review. | Effective-communication guidance last updated **February 28, 2020**; both official routes checked 2026-07-28. |
| [Web Content Accessibility Guidelines Overview — W3C WAI](https://www.w3.org/WAI/standards-guidelines/wcag/) | A, international standard body | Free | The canonical starting point for WCAG 2.2 and the Perceivable, Operable, Understandable, and Robust principles. | Conformance is a baseline, not proof that a complete product or service is usable by disabled people. | Page updated **May 5, 2026**; WCAG 2.2 is the recommended stable version. |
| [Web Content Accessibility Guidelines (WCAG) 2.2 — W3C](https://www.w3.org/TR/WCAG22/) | A, normative web standard | Free | The direct normative source for testable web-content success criteria across perceivable, operable, understandable, and robust behavior. | WCAG conformance does not by itself prove that the whole service, native application, assisted channel, or physical interaction is usable or legally compliant. | W3C Recommendation updated **December 12, 2024**; checked 2026-07-28. |
| [What's New in WCAG 2.2 — W3C WAI](https://www.w3.org/WAI/standards-guidelines/wcag/new-in-22/) | A, standard explainer | Free | The nine additions covering focus, target size, dragging, consistent help, redundant entry, accessible authentication, and related needs. | A change summary, not the normative standard or full implementation guidance. | WCAG 2.2 published **October 5, 2023**; page checked 2026. |
| [WCAG Supporting Documents — W3C WAI](https://www.w3.org/WAI/standards-guidelines/wcag/docs/) | A, standard body | Free | Navigating the normative standard, Understanding documents, Techniques, and ACT rules. | Techniques are informative examples, not an exhaustive compliance checklist. | Updated in 2026 when checked. |
| [Involving Users in Evaluating Web Accessibility — W3C WAI](https://www.w3.org/WAI/test-evaluate/involving-users/) | A, standard-body evaluation guidance | Free | Combining standards evaluation with realistic disabled-user evaluation, selecting relevant participants, reporting study scope, and learning from task barriers. | A few participants cannot establish conformance or represent all people with similar or different disabilities; formal and technical evaluation remain necessary. | Living WAI guidance checked **July 28, 2026**. |
| [Images Tutorial](https://www.w3.org/WAI/tutorials/images/) and [`alt` Decision Tree](https://www.w3.org/WAI/tutorials/images/decision-tree/) — W3C WAI | A, standard-body implementation guidance | Free | Classifying informative, decorative, functional, text-bearing, complex, grouped, and mapped images; choosing context- and purpose-sensitive text alternatives; and defining a publisher-authored baseline before evaluating generated descriptions with affected users. | Informative guidance linked to WCAG, not a model-quality benchmark, automatic description rule, complete accessibility evaluation, conformance certificate, or proof that one description serves every user and task. Complex information may require a full text equivalent outside the `alt` attribute. | Images Tutorial updated **April 8, 2026**; decision tree updated May 13, 2024; both checked 2026-07-28. |
| [Assisted digital support: an introduction — GOV.UK](https://www.gov.uk/service-manual/assisted-digital/) | A, government service guidance | Free | Designing phone, in-person, or webchat help for people who lack access, skills, confidence, trust, or another condition needed to complete an online public service. | UK public-service guidance, not a universal channel mandate or proof that an assisted route is accessible, private, lawful, or adequately staffed. | Updated **December 18, 2025**; checked 2026-07-28. |
| [Microsoft Inclusive Design](https://inclusive.microsoft.design/) | B, first-party design methodology | Free | Recognize exclusion, learn from diversity, and solve for one/extend to many; practical inclusion workshops and examples. | Inclusive design is a method, while accessibility is a product attribute; the method alone does not prove access or conformance. | Living site checked 2026-07-28. |
| [Inclusive 101 Guidebook — Microsoft](https://inclusive.microsoft.design/articles/inclusive-101-guidebook) | B, first-party toolkit | Free | A structured introduction to disability as mismatch, bias, co-design, and inclusive product practice. | Microsoft examples and workshop framing require local disability expertise and user research. | Current guidebook version available in 2026. |
| [Accessibility Strategy — GOV.UK Design System](https://design-system.service.gov.uk/accessibility/accessibility-strategy/) | A, government design-system practice | Free | Integrating WCAG, universal design, progressive enhancement, disabled-user research, manual testing, and prioritization. | Reusing accessible components does not make a service accessible; the page explicitly requires additional research, design, development, and testing. | Strategy and implementation page checked 2026. |
| [GOV.UK Design System](https://design-system.service.gov.uk/) | A, government design system | Free | Researched patterns, accessible components, content, and service consistency at scale. | UK government conventions are not a universal visual system; use the research and quality practices, not unexamined styling. | GOV.UK Frontend **6.4.0** announced July 16, 2026. |
| [W3C Internationalization Activity](https://www.w3.org/International/) | A, web standards body | Free | Language, script, direction, formatting, address, typography, and web internationalization resources. | A large technical library rather than a single PM checklist; localization also needs cultural research and operations. | Active through **July 2026** when checked. |
| [Language Tags and Locale Identifiers for the World Wide Web — W3C](https://www.w3.org/TR/ltli/) | A for provenance; B as draft guidance | Free | Separating content language, language tags, locale preferences, processing, formatting, and display behavior when designing multilingual products and data contracts. | This is a Public Working Draft, not a W3C Recommendation, and explicitly remains work in progress. Use BCP 47 and the relevant normative platform standards for implementation. | Public Working Draft dated **October 7, 2020**; status rechecked 2026-07-28. |
| [Internationalization Glossary — W3C](https://www.w3.org/TR/i18n-glossary/) | A for W3C terminology provenance; B as informative guidance | Free | Distinguishing locale, language negotiation, localizable content, localization, internationalization, scripts, writing systems, and related concepts when regional terminology requests are ambiguous. | A W3C Group Note, explicitly non-normative. Shared definitions reduce ambiguity but do not decide customer terminology, translation quality, legal wording, ontology ownership, or product behavior. | Group Note published **October 17, 2024**; latest route checked 2026-07-28. |
| [Material Design: Accessible Design](https://m3.material.io/foundations/accessible-design/overview) | B, first-party design-system guidance | Free | Translating accessibility needs into common component and interaction decisions. | Vendor design-system guidance; never use it instead of WCAG, disabled-user research, and platform-specific testing. | Living Material 3 documentation checked 2026. |
| [The Design of Everyday Things — Don Norman / Basic Books](https://www.hachettebookgroup.com/titles/don-norman/the-design-of-everyday-things/9780465050659/) | B, foundational book | Paid/library | Affordances, signifiers, mappings, constraints, feedback, conceptual models, and human error. | Foundational rather than a current digital-design manual; pair with accessibility and service/system design. | Revised edition published 2013; stable. |
| [EU Copyright in the Digital Single Market Directive](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L0790), [EU Web Accessibility Directive](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016L2102), [UNESCO Recommendation on Open Educational Resources](https://www.unesco.org/en/legal-affairs/recommendation-open-educational-resources-oer?hub=422), and [Coursera fiscal 2025 Form 10-K](https://www.sec.gov/Archives/edgar/data/1651562/000165156226000015/cour-20251231.htm) | A for primary law, intergovernmental recommendation, and issuer disclosure | Free | Negotiating a university-course system across chain of title, author remuneration and transparency, intentional open licensing, public-service accessibility, institutional and consumer licensing, content-partner concentration, and learner continuity. | National transposition, employment and collective agreements, institution type, authorship, work type, platform role, accessibility scope, and contract facts control. The UNESCO recommendation is non-binding, OER must be intentionally openly licensed, and the issuer filing describes one business rather than a fair universal contract. | Directives adopted **2019** and **2016**; UNESCO recommendation adopted **November 25, 2019**; fiscal 2025 filing and all official routes checked 2026-07-28. |
| [DOJ Title II web and mobile accessibility rule fact sheet](https://www.ada.gov/resources/2024-03-08-web-rule/), [U.S. Department of Education technology-accessibility guidance](https://www.ed.gov/laws-and-policy/civil-rights-laws/disability-discrimination/disability-discrimination-key-issues/disability-discrimination-technology-accessibility), and [FERPA hub](https://studentprivacy.ed.gov/ferpa) | A, U.S. government civil-rights and student-privacy sources | Free | Scoping a U.S. public-school platform across equal access, contractor-provided web and mobile services, technical conformance, effective communication, reasonable modifications, and education-record privacy rather than treating an administrator purchase as whole-system readiness. | U.S.-specific and fact-dependent. The Title II rule names **WCAG 2.1 AA**, not WCAG 2.2, and technical conformance does not eliminate effective-communication or individual-access obligations. FERPA applicability, school-official conditions, consent, disclosure, record status, state law, and district policy require qualified review. | DOJ final rule published April 24, 2024; the April 20, 2026 interim final rule extended covered compliance dates to **April 26, 2027** or **April 26, 2028** by entity class. All three official routes checked 2026-07-28. |

## 4. Strategy, business models, and product economics

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [Strategy — Roger Martin](https://rogerlmartin.com/thought-pillars/strategy) | B, original strategist | Free; books paid | The Playing to Win choice cascade: winning aspiration, where to play, how to win, required capabilities, and enabling systems. | A choice architecture, not market evidence; strategy quality still depends on diagnosis, economics, and execution. | Living author hub checked 2026. |
| [The Five Competitive Forces That Shape Strategy — Michael Porter, HBR](https://hbr.org/2008/01/the-five-competitive-forces-that-shape-strategy) | A/B, foundational scholarship | Paid/library; limited preview | Industry structure across rivalry, buyers, suppliers, entrants, and substitutes. | Originally an industry-level framework; it can underweight ecosystems, complementors, regulation, internal capabilities, and fast feedback. | 2008 update of foundational work; stable. |
| [Value Proposition Canvas — Strategyzer](https://www.strategyzer.com/value-proposition) | B, author-origin framework | Freemium | Connecting customer jobs, pains, and gains with products, pain relievers, and gain creators. | Canvas completion is not evidence of fit; every claim remains a hypothesis until tested. | Living page checked 2026. |
| [Business Model Canvas — Strategyzer](https://www.strategyzer.com/library/the-business-model-canvas) | B, author-origin framework | Freemium | Visualizing nine linked business-model components and comparing alternatives. | A static canvas can hide timing, unit economics, power, risk, and operating detail. | Page updated **May 20, 2026**. |
| [Good Strategy/Bad Strategy — Richard Rumelt](https://www.richardrumelt.com/books) | B, foundational practitioner book | Paid/library; author resources free | Diagnosis, guiding policy, coherent action, proximate objectives, and recognizing strategy fluff. | Broad strategy lens rather than a product-method recipe; examples need translation into current context. | Book published 2011; principles stable. |
| [Obviously Awesome — April Dunford](https://www.aprildunford.com/books) | B, author-origin book | Paid/library; author articles free | Positioning from competitive alternatives, differentiated attributes, value, best-fit customers, and market category. | Strong B2B technology lens; positioning research must include actual customer language and behavior. | Book catalog and updated editions live in 2026. |
| [Escaping the Build Trap — Melissa Perri / O'Reilly](https://www.oreilly.com/library/view/escaping-the-build/9781491973783/) | B, practitioner book | Paid/library | Outcomes, product strategy, organizational alignment, and diagnosing output-driven product work. | Diagnostic and operating-model perspective, not a complete guide to economics, reliability, or regulation. | Published 2018; stable. |
| [Thinking in Systems — Donella Meadows](https://www.penguinrandomhouse.com/books/801035/thinking-in-systems-by-donella-meadows/) | B, foundational systems book | Paid/library | Stocks, flows, feedback, delays, resilience, leverage points, and unintended consequences. | General systems primer; applying it well requires domain data and careful causal boundaries. | Published posthumously in 2008; foundational. |
| [Platform Competition in Two-Sided Markets — Rochet and Tirole](https://onlinelibrary.wiley.com/doi/10.1162/154247603322493212) | A, peer-reviewed foundational research | Abstract free; PDF access may vary | Modeling cross-side participation, platform competition, governance structure, and why a platform chooses both a total price and a price allocation across sides. | A formal 2003 economic model with stylized assumptions, not a marketplace operating playbook, causal field estimate, optimal subsidy, legal market definition, or proof that every intermediary is two-sided. | Journal of the European Economic Association 1(4), **2003**, pp. 990–1029; DOI route checked 2026-07-28. |
| [A Theory of Multihoming in Rideshare Competition — Bryan and Gans](https://www.nber.org/papers/w24806) | A for disclosed theoretical research | Abstract free; working paper downloadable | Reasoning about how consumer-only versus two-side multihoming can alter platform-paid idleness, wait time, competition, and welfare in a stylized rideshare market. | Theory rather than a measured product effect; results depend on model assumptions and urban density. The NBER page discloses an author's unrelated paid patent-litigation work for Uber; treat that as a relevant conflict note. | NBER Working Paper 24806 issued **July 2018**; published version appeared in 2019; route checked 2026-07-28. |
| [World Employment and Social Outlook 2021: The role of digital labour platforms in transforming the world of work — ILO](https://www.ilo.org/publications/flagship-reports/role-digital-labour-platforms-transforming-world-work) | A, intergovernmental research | Free | Bringing provider recruitment, work availability, earnings, working time, algorithmic management, social protection, geography, and worker power into labor-marketplace liquidity and capacity choices rather than optimizing buyer acquisition alone. | Cross-country evidence and policy analysis from a 2021 report cannot identify the binding side, verification backlog, marginal match yield, legal employment status, or current local conditions for a synthetic marketplace. Platform and worker categories are heterogeneous. | Flagship report published **February 23, 2021**; official route checked 2026-07-28. |
| [Measuring Markets for Network Goods — Bursztyn et al.](https://www.nber.org/papers/w33901) | A, primary experimental research and working paper | Abstract free; working paper downloadable | Showing why substitution for a network product can differ when one person exits versus when the network collectively shifts, and separating content-supply and social-coordination mechanisms in a social-media setting. | A 2025–2026 working paper and one application, not a settled universal correction, legal market definition, or direct estimate for another platform. NOMO supplied data; the paper discloses that Bursztyn founded, leads, and holds equity in NOMO, while Gentzkow advises and holds equity in it and reports additional technology-company consulting. Preserve intervention, population, uncertainty, revision date, and these interests. | NBER Working Paper 33901 issued **June 2025**, revised **April 2026**; disclosure and route checked 2026-07-28. |
| [Herfindahl-Hirschman Index](https://www.justice.gov/atr/herfindahl-hirschman-index) and [market-share calculation guidance](https://www.justice.gov/atr/merger-guidelines/tools/market-shares) — U.S. DOJ Antitrust Division | A, competition-authority method | Free | Computing HHI as squared relevant-market shares, interpreting concentration only after market definition, and understanding why the measure's probative value depends on the products and competitive concern in scope. | The 2023 U.S. merger-guideline thresholds concern legally defined merger markets. A PM may use the arithmetic as a labeled supplier- or partner-dependency diagnostic, but a customer-source distribution is not automatically a relevant market and no antitrust conclusion follows. | HHI explainer updated **January 17, 2024**; 2023 Guidelines routes and status checked 2026-07-28. |
| [Platform-to-Business Regulation — Regulation (EU) 2019/1150](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019R1150) | A, primary legal text | Free | Business-user terms, restriction and suspension explanations, ranking-parameter transparency, differentiated treatment, data access descriptions, complaint handling, mediation, and representative enforcement for in-scope online intermediation and search services. | Service, business-user, consumer, territorial, and provision scope require legal analysis. The Regulation does not require source-code disclosure, dictate a ranking objective, establish product-market fit, or govern every marketplace worldwide. | Adopted **June 20, 2019** and applicable since **July 12, 2020**; official text checked 2026-07-28. |
| [Endorsements, Influencers, and Reviews — U.S. Federal Trade Commission](https://www.ftc.gov/business-guidance/advertising-marketing/endorsements-influencers-reviews) | A, regulator guidance hub | Free | Designing review and reputation systems that preserve genuine feedback, disclose material incentives, avoid suppression or distortion, and distinguish consumer-review law, the 2023 Endorsement Guides, and the Reviews and Testimonials Rule. | U.S.-specific legal and staff-guidance routes with fact-dependent coverage. They do not validate a reputation score, guarantee review authenticity, or replace current counsel and the exact rule or statute. | Hub, linked 2023 Guides, and current rule routes checked 2026-07-28. |
| [UNESCO-UNICEF-ITU Charter for Public Digital Learning Platforms](https://www.unesco.org/en/digital-education/learning-platforms-gateway/charter) | A, intergovernmental public-platform charter | Free | Benchmarking public learning platforms against schools, teachers, community access, public infrastructure, open standards, inclusion, pedagogy, safety, and public accountability rather than only commercial apps. | A normative charter and assessment lens, not evidence that one platform causes learning outcomes, a procurement mandate, a universal governance model, or a substitute for local learners, teachers, law, infrastructure, and policy. | Living charter and consultation account checked **July 28, 2026**. |
| [Data Standards Authority](https://www.gov.uk/government/groups/data-standards-authority), [GOV.UK API design guidance](https://www.gov.uk/government/collections/api-design-guidance), [UK public-sector API Catalogue](https://www.api.gov.uk/), and [International Open Data Charter](https://opendatacharter.org/) | A for government program and documented practice; A/B for an international charter organization | Free | Designing a public-data developer ecosystem around user-led standards, transparent peer governance, discoverability, documented APIs, reuse, machine-readable access, common components, public value, participation, interoperability, feedback, and sustainable stewardship rather than counting keys or calls alone. | UK government guidance and infrastructure are jurisdiction- and organization-specific; the Open Data Charter is a voluntary principles initiative. Catalogue inclusion does not make an API public, reliable, licensed for every use, privacy-safe, accessible, well governed, or valuable. Open-by-default has legitimate legal, privacy, security, intellectual-property, community-rights, and public-interest exceptions. | DSA established April 2020; API collection last updated July 11, 2022; catalogue and Charter are living services; all four routes returned HTTP 200 and were checked 2026-07-28. |
| [Fairness of Exposure in Rankings — Singh and Joachims](https://arxiv.org/abs/1802.07281) | A, primary peer-reviewed research with open author manuscript | Free | Treating ranked exposure as a scarce allocation across users and listed participants; making the utility objective and application-specific fairness constraint explicit; and evaluating the trade-off rather than hiding it inside a relevance score. | A formal framework and two empirical illustrations, not a universal fairness definition, legal test, production objective, causal participant-outcome estimate, or permission to infer protected traits. Merit, exposure, position bias, eligibility, user utility, provider welfare, uncertainty, strategic behavior, and jurisdiction still require case evidence and affected-party review. | Submitted **February 20, 2018** and published at KDD 2018; author-manuscript route returned HTTP 200 and was checked 2026-07-28. |
| [API Setu](https://apisetu.gov.in/) and [ONDC technical resources](https://resources.ondc.org/tech-resources) | A for current Indian public-program documentation and first-party operating examples | Free; some onboarding functions require accounts | Designing an Indian developer-platform expansion around publisher and consumer roles, discovery, sandbox/testing, specifications, participant onboarding, reference implementations, community sessions, monitoring, and support rather than raw sign-ups. | These are distinct Indian programs, not a template for every commercial platform, proof of ecosystem health, a current adoption statistic, or evidence that a language, sector, city, anchor, partner, or subsidy will create self-sustaining network effects. Portal claims require corroboration; production access, terms, standards, support, and program status can change. | Both living routes returned HTTP 200 and were checked **July 28, 2026**; recheck at each rollout decision. |
| [Promoting Platform Takeoff and Self-Fulfilling Expectations — Boudreau](https://www.nber.org/papers/w28325) | A, peer-reviewed field experiment with an open NBER record | Free abstract and downloadable working paper | Understanding one causal mechanism in early platform adoption: randomized statements about expected future installed base influenced invitations to join a newly launched platform, while the effect disappeared after the actual base became larger. Useful for designing truthful expectation, anchor, and takeoff tests rather than assuming that current sign-ups alone create critical mass. | One experiment sent invitations to 16,349 people in a particular new platform context. It does not prove that advertising, forecasts, anchors, subsidies, communities, reference apps, or a stated future base will work for an Indian developer platform; authorize exaggeration; identify durable use, complement quality, cross-side value, or local density; or supply a transferable threshold. Preserve the randomized message, population, outcome, time horizon, and later published version. | NBER Working Paper 28325 issued **January 2021**; published in *Management Science* 67(9), September 2021, pp. 5953–5967. NBER route returned HTTP 200 and was checked 2026-07-28. |
| [Google for Startups Cloud Program](https://startup.google.com/cloud/) and [AWS Activate Terms](https://aws.amazon.com/activate/terms/) | A for each vendor's current offer and terms; B as comparative program-design evidence | Free pages; benefits require eligibility and approval | Separating headline promotional value from eligible-service use, activation, retained production workloads, support, expiry, post-credit economics, fraud controls, attribution, and program cohort design when evaluating developer credits. | Vendor-specific, mutable offers with selection and marketing incentives. Headline credit ceilings are not expected cash cost, redeemed value, causal retention, customer value, or a portable benchmark. Eligibility, exclusions, expiry, tax, marketplace coverage, support enrollment, price changes, and counterfactual adoption must be verified. | Google page and AWS terms returned HTTP 200 on 2026-07-28; AWS terms were last updated **January 22, 2026**. Recheck before every program comparison. |
| [Marketplace Leakage — Hagiu and Wright](https://pubsonline.informs.org/doi/10.1287/mnsc.2023.4757) and [author manuscript record](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6632138) | A, peer-reviewed theoretical research and author manuscript | Publisher abstract/record and author manuscript; access varies | Distinguishing introductions, first transactions, repeat pairs, observed on-platform transactions, inferred leakage, and contribution exposure; then comparing transaction benefits, communication limits, referral fees, price parity, seller competition, and enforcement as mechanisms with participant trade-offs. | A stylized model, not an observed leakage rate, ethical or legal endorsement of every remedy, proof that an unmatched repeat is off-platform, or a substitute for cohort/frequency evidence. Restrictions can reduce legitimate communication, safety, accessibility, portability, competition, provider power, and buyer choice; price-parity and enforcement rules require jurisdiction-specific review. | Published in *Management Science* **70(3), March 2024, pp. 1529–1553**. Publisher and SSRN routes were substantively available through rendered/indexed records but returned scripted HTTP 403; checked 2026-07-28. |
| [Data on the Web Best Practices](https://www.w3.org/TR/dwbp/), [DCAT 3](https://www.w3.org/TR/vocab-dcat-3/), and [Five Safes Framework](https://www.gov.uk/data-ethics-guidance/the-five-safes-framework) | A, W3C Recommendations and government data-access framework | Free | Turning a public-data charter into testable metadata, licensing, provenance, quality, versioning, identifiers, formats, API, feedback, and preservation expectations; cataloging datasets, services, and versions; and separating safe people, projects, settings, outputs, and data for controlled access. | W3C publication practices and a UK research-access framework do not determine that data should be open, define lawful purpose, resolve community or Indigenous data rights, certify privacy/security, prescribe one access tier, or replace records, archival, accessibility, procurement, and local legal duties. DCAT metadata does not make the underlying service complete or reliable. | DWBP became a W3C Recommendation **January 31, 2017**; DCAT 3 became a Recommendation **August 22, 2024**; the GOV.UK framework page was published January 30, 2025. All three routes returned HTTP 200 and were checked 2026-07-28. |
| [Experience Curves for Energy Technology Policy](https://www.iea.org/reports/experience-curves-for-energy-technology-policy) and [Energy Technology Perspectives 2026](https://www.iea.org/reports/energy-technology-perspectives-2026/executive-summary) — IEA | A, intergovernmental research and current sector analysis | Free | Modeling cost change per cumulative-volume doubling while separating learning-by-doing, scale, standardization, innovation, input cost, capacity, policy, and concentrated supply-chain effects. | The 2000 report is methodological and historical; the 2026 analysis is scenario- and data-dependent. Neither validates a synthetic 12% learning rate, makes cost decline inevitable, or proves one firm's regional advantage. | Experience-curves report published **July 7, 2000**; 2026 edition and model notes checked 2026-07-28. |
| [Agreement on Subsidies and Countervailing Measures](https://www.wto.org/english/docs_e/legal_e/scm_e.htm) — World Trade Organization | A, primary multilateral legal text | Free | Distinguishing a product strategist's observed rival support from legally defined subsidy, specificity, prohibited subsidy, actionable subsidy, injury, investigation, and countervailing measures. | Legal classification, evidence, member obligations, remedies, exceptions, and developing-country treatment are fact-specific. A PM should model commercial reactions without asserting illegality or a remedy from public signals alone. | Official legal text checked 2026-07-28. |
| [OECD MAGIC Database of Industrial Subsidies](https://www.oecd.org/en/publications/oecd-magic-database-of-industrial-subsidies_ce94f33b-en.html) | A, intergovernmental research with public aggregated estimates | Free report and aggregated data | Comparing estimated industrial support across manufacturing groups, instruments, jurisdictions, and time without treating one aggregate as a firm's effective cost advantage. | The underlying firm-level database is confidential; the public workbook contains aggregated estimates. Coverage, attribution, comparability, market effects, missing jurisdictions, and transfer to any company require the report's methods and uncertainty. It is not a WTO legal determination. | OECD 2026 release covers 2005–2024 and was checked 2026-07-28. |
| [Adobe fiscal 2013 Form 10-K — SEC filing](https://www.sec.gov/Archives/edgar/data/796343/000079634314000004/adbe10kfy13.htm) | A for Adobe's contemporaneous disclosures; historical first-party case | Free | Studying an incumbent's deliberate perpetual-license-to-subscription transition: explicitly managed displacement of perpetual-license revenue, short-term revenue and margin pressure, recurring-revenue leading indicators, customer and channel risks, migration choices, and the decision to concentrate future innovation in the new offer. | A regulated company disclosure documents Adobe's strategy, expectations, selected metrics, and risks in one historical context; it is not causal proof, a reusable threshold, or evidence that forced migration, subscription, cloud delivery, or self-cannibalization is right for another product. Preserve the 2013 evidence cutoff and avoid hindsight. | Filed **January 21, 2014** for fiscal year ended November 29, 2013; official SEC HTML checked 2026-07-28. |
| [FCA wind-down impact guidance](https://handbook.fca.org.uk/handbook/wdpg3/wdpg3s6), [wind-down planning](https://www.fca.org.uk/firms/authorisation/apply/preparing-wind-down-plan), [vulnerable-customer guidance](https://www.fca.org.uk/publications/finalised-guidance/guidance-firms-fair-treatment-vulnerable-customers), and [Consumer Duty information](https://www.fca.org.uk/firms/consumer-duty/information-firms) | A, financial-regulator handbook and guidance | Free | Comparing repair, sale, harvest, and closure while inventorying affected customers, funds and assets, service continuity, records, migration, communications, vulnerability, foreseeable harm, closure cost, and governance. | UK financial-services scope and live Handbook applicability require qualified analysis. Guidance does not select a buyer, approve a transaction, quantify synthetic economics, or make every European product subject to the Consumer Duty. | WDPG 3.6 updated **June 26, 2026**; wind-down page March 1, 2024; vulnerable-customer guidance July 22, 2026; Consumer Duty page April 2, 2026; all checked 2026-07-28. |
| [Cost Estimating and Assessment Guide — U.S. GAO](https://www.gao.gov/products/gao-20-195g) | A, government methods guide | Free | Building a technical baseline, work breakdown, assumptions, data plan, estimating methods, sensitivity and risk analysis, documentation, and actual-versus-estimate update for lifecycle investments. | Written primarily for U.S. government programs and major system acquisitions; product teams should transfer the estimation discipline, not the procurement machinery. | GAO-20-195G published **March 12, 2020** and remained the current GAO guide when checked 2026-07-28. |
| [Building Life Cycle Cost Programs — U.S. DOE FEMP and NIST](https://www.energy.gov/cmei/femp/building-life-cycle-cost-programs) | A, government lifecycle-cost method and tools | Free | Comparing capital alternatives with discounted lifecycle cost, net savings, savings-to-investment ratio, internal rate of return, and payback rather than choosing on acquisition price alone. | Built for buildings and federal energy/water investments; its discount factors and domain assumptions are not generic product-finance inputs. | Living page checked **July 28, 2026**; it identified Handbook 135's most recent revision as 2025 and described the desktop-tool sunset as Spring 2026. |
| [IFRS 16 Leases — IFRS Foundation](https://www.ifrs.org/issued-standards/list-of-standards/ifrs-16-leases/) | A, official accounting-standard overview | Free overview; full standards access may require registration or subscription | Recognizing that lease cash flows, assets, liabilities, presentation, and disclosure require a finance-owned accounting analysis distinct from a PM's contribution-margin model. | The public overview emphasizes lessee recognition; vendor/lessor treatment, contract classification, tax, reporting framework, and jurisdiction need qualified finance advice. It is not a lease-pricing formula. | Effective for annual periods beginning **January 1, 2019**; standard history and active post-implementation work checked 2026-07-28. |
| [Post-Implementation Review: Leases (Topic 842) — FASB](https://fasb.org/news-and-meetings/in-the-news/fasb-issues-post-implementation-review-report-for-its-leases-standard-423362) | A, U.S. accounting standard-setter | Free | Establishing the current U.S.-GAAP lease-accounting context and the need to involve finance when a product changes ownership, payment timing, or lessor obligations. The review also separates lessee implementation experience from lessor reporting. | A post-implementation review is not the full Codification, a contract-classification decision, or a pricing model. Company facts, jurisdiction, tax, and qualified accounting analysis still govern. | FASB issued the completed Topic 842 review **November 20, 2025**; official page checked 2026-07-28. |
| [UK Futures Toolkit](https://www.gov.uk/government/publications/futures-toolkit-for-policy-makers-and-analysts/the-futures-toolkit-html), [Defra weak-signals case](https://www.gov.uk/government/publications/weak-signals-and-trend-analysis-horizon-scanning/weak-signals-and-trend-analysis-horizon-scanning), [OECD Strategic Foresight Toolkit](https://doi.org/10.1787/bcdd9304-en), and [IEA World Energy Outlook 2025 scenario method](https://www.iea.org/reports/world-energy-outlook-2025/setting-the-scene) | A, government and intergovernmental methods and case evidence | Free | Building a recurring horizon-scanning system that separates observations, weak signals, assumptions, and narratives; broadens scanners and sources; creates multiple plausible scenarios; stress-tests strategy; and connects indicators to options and action. | Public-policy methods and one government case do not predict markets, validate a signal, set a corporate investment threshold, or make an IEA scenario a forecast. Teams must preserve provenance, dissent, decay, incentives, decision ownership, and domain-specific evidence. | UK toolkit updated 2024; Defra case published **August 28, 2025**; OECD and IEA 2025 editions; routes checked 2026-07-28. |
| [Competition in Two-Sided Markets — Armstrong](https://onlinelibrary.wiley.com/doi/10.1111/j.1756-2171.2006.tb00037.x), [OECD Handbook on Competition Policy in the Digital Age](https://www.oecd.org/content/dam/oecd/en/publications/reports/2022/02/oecd-handbook-on-competition-policy-in-the-digital-age_50b6e951/c8c1841b-en.pdf), and [DOJ Merger Guidelines: Guideline 9](https://www.justice.gov/atr/merger-guidelines/applying-merger-guidelines/guideline-9) | A, peer-reviewed theory plus official analytical and enforcement guidance | Free abstract/report/guidance; article access may vary | Challenging winner-take-all claims through side-specific participation, local versus global network effects, switching, multi-homing, interoperability, platform governance, complement incentives, and competition between, on, or to displace a platform. | Armstrong is a stylized 2006 model; the OECD handbook is analytical guidance; DOJ Guideline 9 belongs to U.S. merger enforcement. None defines a product market, proves market power, estimates a logistics equilibrium, or supplies a PM threshold. | Research published **2006**; OECD handbook 2022; U.S. guidelines 2023; official routes checked 2026-07-28. |
| [Angi fiscal 2025 Form 10-K](https://www.sec.gov/Archives/edgar/data/1705110/000170511026000011/angi-20251231.htm) and [Urban Company final prospectus archive](https://investorrelations.urbancompany.com/offer-documents/prospectus) | A for what the issuers disclose; first-party marketplace cases | Free | Studying category breadth, professional networks, matching and project flow, provider quality and stability, screening and training, ratings and reviews, complaints, safety, trust, guarantees, acquisition, and category-portfolio risk in home services. | Issuer-selected financial, risk, and offer disclosure is not neutral causal evidence, a comparable operating definition, or proof that a fictional category should stay or close. Preserve period, geography, business model, metric definition, conflicts, and hindsight boundaries. | Fiscal 2025 Angi filing and Urban Company offer-document archive checked 2026-07-28. |
| [RBI Digital Lending Directions 2025](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12848&Mode=0), [RBI Outsourcing of IT Services Directions 2023](https://www.rbi.org.in/scripts/FS_Notification.aspx?Id=12486&Mode=0&fn=14), [BCBS credit-risk principles 2025](https://www.bis.org/bcbs/publ/d595.htm), and [BCBS third-party-risk principles 2025](https://www.bis.org/bcbs/publ/d605.htm) | A, primary regulator directions and international supervisory principles | Free | Separating a lending-risk engine from lending authority; mapping regulated-entity and LSP responsibility, underwriting, due diligence, data, IT-service criticality, contracting, monitoring, validation, continuity, audit access, dependency, and exit when evaluating sell, partner, license, or close. | Exact entity, activity, product, service, outsourcing, LSP, materiality, and territorial scope require qualified current analysis. BCBS principles are a common supervisory baseline, not directly binding Indian law; none approves a vendor, validates a model, transfers bank accountability, or values an asset. | RBI directions issued **May 8, 2025** and **April 10, 2023**; BCBS principles issued April 30 and December 10, 2025; checked 2026-07-28. |
| [RBI IRACP Master Circular, April 2025](https://rbi.org.in/scripts/NotificationUser.aspx?Id=12822), [MCA Ind AS 109](https://www.mca.gov.in/Ministry/pdf/IndAS109_2020_10112020.pdf), [IFRS 9 overview](https://www.ifrs.org/issued-standards/list-of-standards/ifrs-9-financial-instruments/), and [BCBS expected-credit-loss guidance](https://www.bis.org/bcbs/publ/d350.htm) | A, regulator, official accounting text/overview, and supervisory guidance | Free overview and documents; full IFRS standard access may vary | Keeping a product cohort forecast time-consistent across contractual and realized cash, effective interest, default, prepayment, cure, recovery, servicing, provisioning, and expected-credit-loss governance while separating management economics from statutory accounting. | Covered entities and reporting frameworks differ; amendments, auditor judgments, asset classification, prudential rules, tax, loan terms, and exact facts govern. A PM forecast must not instruct Finance to reverse valid revenue, present contribution as accounting, or apply IFRS automatically in India. | RBI circular issued **April 1, 2025**; MCA text dated 2020; IFRS and BCBS official routes checked 2026-07-28. |
| [IFRS 15 Revenue from Contracts with Customers](https://www.ifrs.org/issued-standards/list-of-standards/ifrs-15-revenue-from-contracts-with-customers/) and [IFRS implementation materials](https://www.ifrs.org/supporting-implementation/supporting-materials-by-ifrs-standards/ifrs-15/) | A, official accounting standard and implementation route | Free overview and materials; full standards access may vary | Separating bookings, billings, cash, and recognized revenue; identifying contracts and performance obligations; determining and allocating transaction price; and reasoning about variable consideration, principal-agent treatment, and point-in-time versus over-time recognition. | Not a SaaS KPI taxonomy, unit-economics model, contract conclusion, or substitute for Finance and qualified accounting analysis. Reporting framework, amendments, jurisdiction, contract terms, enforceable rights, and facts govern. | IASB issued IFRS 15 in **May 2014**; effective **January 1, 2018**, clarified April 2016, and consequentially amended through 2024; official routes checked 2026-07-28. |
| [Digital Markets Act: Regulation (EU) 2022/1925](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R1925) and [European Commission implementation hub](https://digital-markets-act.ec.europa.eu/index_en) | A, primary EU law and regulator implementation source | Free | Testing platform strategy against designated-gatekeeper and covered-core-platform-service duties involving interoperability, business-user access, end-user choice, data use, steering, self-preferencing, and compliance governance. | Applies to designated gatekeepers and covered services in the EU, not every marketplace or network product. Designations, service scope, enforcement decisions, corrigenda, facts, and qualified legal analysis control. | Regulation adopted **September 14, 2022**, published October 12, 2022, with a corrigendum published January 10, 2025; current text and implementation hub checked 2026-07-28. |
| [Stable Allocations and the Practice of Market Design: Royal Swedish Academy of Sciences](https://www.nobelprize.org/prizes/economic-sciences/2012/advanced-information/) and [scientific-background PDF](https://www.nobelprize.org/uploads/2018/06/advanced-economicsciences2012-1.pdf) | A, original-research authoritative synthesis | Free | Matching markets where price alone does not clear supply: stability, blocking pairs, proposer-side advantage, incentive properties, market thickness, and unraveling across school, medical, and related allocation designs. | Basic two-sided stable matching does not resolve dynamic arrival, transfers, congestion, ranking or recommendation, identity, fraud, quality uncertainty, or every fairness objective. Product use requires the appropriate model and domain constraints. | Prize Committee scientific background published **October 15, 2012**; stable official page and PDF checked 2026-07-28. |

## 5. Prioritization, roadmaps, objectives, decisions, and delivery

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [RICE: Simple Prioritization for Product Managers — Intercom](https://www.intercom.com/blog/rice-simple-prioritization-for-product-managers/) | B, framework-origin company | Free | Reach × Impact × Confidence ÷ Effort; making comparative assumptions visible. | The authors state that the score is not a hard rule. Dependencies, strategy, table stakes, risk, and enabling work can override rank. | Published **January 5, 2018**; stable. |
| [Product Roadmaps — Atlassian](https://www.atlassian.com/agile/product-management/product-roadmaps) | B, vendor practitioner guide | Free | A roadmap as a shared explanation of direction, priorities, progress, and relation to strategy. | Vendor-linked and introductory; can understate portfolio finance, uncertainty, and political constraints. | Living guide checked 2026. |
| [Developing a roadmap](https://www.gov.uk/service-manual/agile-delivery/developing-a-roadmap) and [planning in agile](https://www.gov.uk/service-manual/agile-delivery/planning-agile) — GOV.UK, with [The Orange Book: Management of Risk](https://www.gov.uk/government/publications/orange-book/the-orange-book-management-of-risk-principles-and-concepts) | A, government delivery and risk guidance | Free | Versioning roadmap intent as evidence and assumptions change; showing objectives, ownership, confidence, dependencies, risk, decisions, superseded commitments, and reopen triggers while increasing detail only as work approaches. | UK public-service guidance is not a universal product cadence, commitment policy, or risk threshold. The roadmap pages do not themselves prescribe an append-only decision ledger; teams must design lineage, access, security, customer communication, and governance for their context. | Roadmap page published **November 16, 2017**; planning page updated March 31, 2026; Orange Book updated **June 3, 2026**; checked 2026-07-28. |
| [OKRs — Atlassian Team Playbook](https://www.atlassian.com/team-playbook/plays/okrs) | B, first-party team practice | Free | Writing a small number of objectives and measurable key results, tracking them, and retaining quality guardrails. | OKRs can create gaming or ritual overhead; they do not replace strategy, capacity, or causal learning. | Current in 2026. |
| [What Makes a Good OKR? — What Matters](https://www.whatmatters.com/okrs-explained/good-example-okrs) | B, author-affiliated practitioner guidance | Free/freemium | Distinguishing the qualitative objective from measurable evidence in key results. | Promotes the OKR method; examples are not evidence that OKRs fit every organization. | Living site checked 2026. |
| [DACI Decision Framework — Atlassian](https://www.atlassian.com/team-playbook/plays/daci) | B, practitioner play | Free | Driver, one Approver, Contributors, Informed, and a shared decision document. | Role labels do not resolve power, missing evidence, or poor decision quality by themselves. | Current in 2026. |
| [Deciding on Priorities — GOV.UK Service Manual](https://www.gov.uk/service-manual/agile-delivery/deciding-on-priorities) | A, government delivery guidance | Free | Using performance, research, and stakeholder evidence; ensuring support and technical debt compete with features. | Page is older and public-service oriented; named methods such as MoSCoW should not become mechanical. | Updated December 2018; checked 2026. |
| [Writing User Stories — GOV.UK Service Manual](https://www.gov.uk/service-manual/agile-delivery/writing-user-stories) | A, government practice | Free | Actor, need, goal, acceptance criteria, splitting epics, and preserving the reason behind work. | User stories are one communication device, not mandatory requirements syntax. | Published 2016; stable and live in 2026. |
| [Scrum Guide](https://scrumguides.org/scrum-guide.html) | A, official framework definition | Free | The canonical minimal definition of Scrum roles, events, artifacts, and commitments. | Scrum governs delivery and learning; it is not product strategy, discovery, research, or organization design. | **November 2020** remains the current official guide as of 2026-07-28. |
| [Kanban Guide](https://kanbanguides.org/the-kanban-guide/) | A, official guide | Free | A minimal current reference for defining and improving workflow and flow metrics. | Does not supply product strategy, prioritization logic, or technical quality practices. | Current guide released **May 2025**. |
| [Schedule Assessment Guide — U.S. GAO](https://www.gao.gov/products/gao-16-89g) | A, government methods guide | Free | Building an integrated schedule, mapping dependencies and critical path, testing credibility, maintaining status, and conducting schedule-risk analysis. | Written for program schedules and public oversight; product teams should transfer the dependency and uncertainty discipline rather than import procurement ceremony or treat a point date as guaranteed. | GAO-16-89G published **December 22, 2015** and remained current when checked 2026-07-28. |
| [ISO 31000:2018 Risk management — Guidelines](https://www.iso.org/standard/65694.html) | A, international standard | Free overview; standard paid | A common process for identifying, analyzing, evaluating, treating, monitoring, reviewing, and communicating risk across an organization. | It supplies adaptable guidance rather than a certifiable system, product-specific risk appetite, numeric score, legal conclusion, or launch threshold. | Edition 2 published **February 2018**, confirmed in 2023, and current when checked 2026-07-28. |
| [Retiring your service — GOV.UK Service Manual](https://www.gov.uk/service-manual/agile-delivery/retiring-your-service) | A, government service guidance | Free | Treating retirement as a user transition: continuing user need, replacement, direct/API/assisted communication, redirects, and protection or transfer of information. | Specific GOV.UK channel and timing rules do not automatically transfer to commercial products or other jurisdictions; contracts, entitlements, data, and support need local decisions. | Updated **August 26, 2025**; checked 2026-07-28. |
| [Google AIP-180: Backwards compatibility](https://google.aip.dev/180), [AIP-185: API versioning](https://google.aip.dev/185), and [IETF Deprecation and Sunset HTTP fields — RFC 9745 and RFC 8594](https://www.rfc-editor.org/rfc/rfc9745.html) ([Sunset RFC](https://www.rfc-editor.org/info/rfc8594/)) | A for first-party API rules and primary protocol publications; B when transferred beyond their scope | Free | Separating source, wire, and semantic compatibility; choosing explicit version and stability strategies; operating old and new versions through a bounded transition; and attaching machine-readable deprecation, migration, and expected-unavailability information. | Google AIPs describe Google-managed API conventions, not universal standards; their protobuf/JSON and channel assumptions may not fit every event or API system. Headers and version numbers complement rather than replace client inventory, measured compatibility, direct notice, contractual migration, support, rollback, and safe retirement; RFC 8594 is Informational. | AIP-180 approved in 2019 with an October 21, 2025 changelog entry; AIP-185 approved **October 22, 2024**; RFC status and all routes checked 2026-07-28. |
| [Principles Behind the Agile Manifesto](https://agilemanifesto.org/principles) | A, origin document | Free | Customer value, working software, collaboration, sustainable pace, technical excellence, simplicity, and reflection. | Written in 2001 for software development; principles require contextual interpretation and do not cover the entire product role. | Foundational 2001 document; stable. |
| [Shape Up — Basecamp](https://basecamp.com/shapeup) | B, first-party operating method | Free full book | Fixed time/variable scope, shaping, appetite, betting, and reducing project risk before commitment. | One company's strong opinion; six-week cycles and team model are not universal. | Living free book checked 2026. |
| [Digital, Data and Technology Playbook — GOV.UK](https://www.gov.uk/government/publications/the-digital-data-and-technology-playbook/the-digital-data-and-technology-playbook-html) | A, government sourcing and lifecycle guidance | Free | Outcome-based specifications, delivery-model assessment, supplier relationships, cyber planning, interoperable data, phased introduction and dual running, lifecycle and obsolescence management, knowledge/data transfer, and exit planning. | Mandatory on a comply-or-explain basis only for its stated UK central-government scope. Commercial teams should transfer the lifecycle and risk questions, not assume its procurement process, authority, contract language, or thresholds apply. | Published **March 28, 2022** and updated **June 20, 2023**; official HTML route checked 2026-07-28. |
| [An Insider Look at Amazon's Culture and Processes — Amazon](https://www.aboutamazon.com/news/workplace/an-insider-look-at-amazons-culture-and-processes) | A for Amazon practice | Free | Working Backwards and the PR/FAQ as a customer-centered narrative and constraint-discovery mechanism. | A curated first-party account; does not expose every failure, power dynamic, or implementation cost. | Current About Amazon page checked 2026. |
| [Amazon 2015 Letter to Shareholders](https://ir.aboutamazon.com/files/doc_financials/annual/2015-Letter-to-Shareholders.PDF) | A, public company filing | Free PDF | Original primary source for one-way versus two-way doors and matching decision process to reversibility. | A leadership heuristic, not a full risk model; reversibility is often disputed or path-dependent. | Letter published 2016 about 2015; stable primary source. |
| [Team templates in the Teams admin center — Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/get-started-with-teams-templates-in-the-admin-console) | A for Microsoft behavior; B as reusable pattern | Free; tenant features vary | A concrete model of administrator-controlled templates, predefined structures, policy visibility, supported properties, and current product limits. | Microsoft Teams-specific and partly tenant-admin dependent. A template capability does not establish organizational authority, adoption, or value in another product. | Documentation updated **October 30, 2024**; feature limits require use-time recheck. |
| [Teams adoption quick-start checklist — Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/teams-adoption-quick-start-checklist) | A for Microsoft rollout practice; B as general method | Free | Sequencing stakeholders, early adopters, scenarios, governance, support, feedback, outcomes, training, and service review from start through scale. | Vendor adoption guidance, not causal evidence or a universal enterprise rollout sequence; the page is older and Teams capabilities have continued to change. | Documentation updated **June 13, 2023**; checked 2026-07-28. |
| [Conduct a user pilot — Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/pilot-essentials) | A for Microsoft rollout practice; B as general method | Free | Designing a bounded enterprise pilot with explicit goals, real users and work, test scenarios, feedback, operational signals, and a go-forward decision. | Teams and legacy Skype migration context; the recommended timing is not a general experimental minimum and a pilot does not by itself identify causal impact. | Documentation updated **February 15, 2023**; checked 2026-07-28. |

## 6. Metrics, analytics, statistics, and data quality

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [Measuring User Experience on a Large Scale: HEART — Google Research](https://research.google/pubs/measuring-the-user-experience-on-a-large-scale-user-centered-metrics-for-web-applications/) | A, original research | Free; PDF linked | Happiness, Engagement, Adoption, Retention, Task Success, and the goals-signals-metrics process. | CHI 2010 framework; supplement it for marketplace health, reliability, fairness, AI quality, and business economics. | Published 2010; still a foundational primary source. |
| [North Star Framework — Amplitude](https://amplitude.com/books/north-star/about-north-star-framework) | B, vendor-origin framework | Free registration/freemium | Choosing a measure of realized user value and connecting it to influenceable inputs and revenue. | Analytics-vendor lens; some products create plural or episodic value that should not be forced into one metric. | Living playbook checked 2026. |
| [What Is Product Analytics? — Mixpanel](https://mixpanel.com/blog/what-is-product-management-analytics/) | B, vendor guide | Free | A current overview spanning acquisition, activation, engagement, retention, revenue, funnels, cohorts, and AI product analytics. | Vendor content and examples favor event analytics; check product claims and benchmarks independently. | Published/updated **May 18, 2026**. |
| [Product Metrics Guide — Mixpanel](https://mixpanel.com/blog/product-metrics/) | B, vendor guide | Free | Metric categories, trees, definitions, and linking product behavior to business outcomes. | Introductory and vendor-influenced; it does not replace a measurement specification or statistical training. | Published **February 18, 2025**. |
| [Retention Analysis — Mixpanel](https://mixpanel.com/blog/what-is-retention-analysis/) | B, vendor guide | Free | Cohorts, meaningful return actions, product-specific cadence, and retention interpretation. | Tool examples can hide identity, censoring, eligibility, and denominator choices. | Updated **June 9, 2026**. |
| [Funnel Analysis — Mixpanel](https://mixpanel.com/blog/introduction-to-analytics-funnel-analysis/) | B, vendor guide | Free | Basic journey conversion, drop-off, segmentation, and iteration. | Linear funnels poorly represent loops, multi-user workflows, offline steps, and causal effects. | Updated **June 9, 2026**. |
| [Introduction to Modern Statistics, 2nd edition — OpenIntro](https://openintro.org/book/ims/online/) | A/B, open academic textbook | Free online/PDF; print paid | Sampling, study design, probability, inference, regression, and experiments with exercises. | General statistics rather than product analytics; learners need SQL, instrumentation, and product cases alongside it. | Online version dated **March 31, 2026**. |
| [OpenIntro Statistics Books](https://www.openintro.org/book/stat/) | A/B, academic open resources | Free/paid print | Alternative statistics texts, datasets, and teaching material when the main text is too fast or too broad. | Course texts require deliberate practice and answer checking; reading alone does not create analysis skill. | Catalog live in 2026. |
| [OpenLineage documentation](https://openlineage.io/docs/) | A/B, open specification and project documentation | Free | Modeling dataset, job, run, and extensible facet lineage so metric and data-product changes can be traced across producers and consumers. | A technical lineage specification, not a complete semantic-metric governance model; ownership, approval, access, reconciliation, and business decisions remain organizational. | Documentation rendered version **1.52.0** when checked 2026-07-28; pin the version used. |
| [ISO/IEC 25012:2008 Data quality model](https://www.iso.org/standard/35736.html) with [W3C Data Quality Vocabulary](https://www.w3.org/TR/vocab-dqv/) | A, international standard; W3C companion is an informative Group Note | ISO overview and W3C note free; ISO standard paid | Defining and evaluating structured-data quality through fifteen characteristics, distinguishing inherent from system-dependent quality, and attaching machine-readable quality measurements, policies, provenance, and annotations where web-data metadata is useful. | ISO 25012 is a broad model, not a metric dictionary, data contract, business-semantic layer, or test suite. DQV is RDF and web-data specific, non-normative, and explicitly does not replace the ISO standard. | ISO Edition 1 published **December 2008** and remains confirmed; W3C Working Group Note dated December 15, 2016; official routes checked 2026-07-28. |
| [GOV.UK Service Standard: define success and publish performance data](https://www.gov.uk/service-manual/service-standard/point-10-define-success-publish-performance-data) and [completion-rate guidance](https://www.gov.uk/service-manual/measuring-success/measuring-completion-rate) | A for UK central-government service guidance; B as a transferable measurement pattern | Free | Linking a service objective to decision-usable metrics across online and offline channels; specifying transaction start, completion, ineligibility, assisted access, delayed mixed-channel journeys, cohort treatment, and publication cadence. | UK government guidance, not a universal North Star, legal rule outside its scope, or proof that completion alone represents public value. A product still needs outcome, error, burden, access, fairness, cost, and gaming measures plus locally valid eligibility and journey definitions. | Service Standard page last updated **May 30, 2022** and completion guidance **February 19, 2021**; both official routes live and checked 2026-07-28. |
| [UN Global SDG Indicator metadata repository](https://unstats.un.org/sdgs/metadata/) | A, official intergovernmental indicator metadata | Free | Learning rigorous indicator documentation: concept, numerator, denominator, population, disaggregation, method, limitations, data source, custodian, update history, and comparability rather than copying a headline rate. | Global SDG indicators are policy statistics, not product KPIs or ready-made targets. Metadata is explicitly a periodically reviewed work in progress; national definitions, missingness, subgroup safety, local actionability, and product event semantics still require independent treatment. | Repository exposed the complete metadata set dated **July 7, 2026** and was checked 2026-07-28. |

## 7. Experimentation and causal inference

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [Online Experimentation at Microsoft](https://www.microsoft.com/en-us/research/publication/online-experimentation-at-microsoft/) | A, original first-party research | Free | Why randomized tests support causal decisions, how humbling win rates can be, and why culture and infrastructure matter. | Foundational 2009 account; modern privacy, marketplace interference, AI, and sequential methods require supplements. | Published 2009; stable primary source. |
| [Trustworthy Analysis of Online A/B Tests: Five Puzzling Outcomes Explained](https://www.microsoft.com/en-us/research/?p=670776) | A, original research | Free | Pre-launch analysis checks, setup quality, data integrity, and practical checklists for surprising results. | Microsoft platform context; teams must translate checks to their exposure and identity systems. | ICSE 2019 research; checked 2026. |
| [Diagnosing Sample Ratio Mismatch — Microsoft Research](https://www.microsoft.com/en-us/research/publication/diagnosing-sample-ratio-mismatch-in-online-controlled-experiments-a-taxonomy-and-rules-of-thumb-for-practitioners/) | A, original research | Free | Treating unexpected treatment/control allocation as a serious data-quality signal and finding common causes. | SRM absence does not prove experiment validity; other exposure, logging, and interference failures remain possible. | Published 2019; still foundational. |
| [Deep Dive into Variance Reduction / CUPED — Microsoft](https://www.microsoft.com/en-us/research/group/experimentation-platform-exp/articles/deep-dive-into-variance-reduction/) | A/B, first-party research explainer | Free | Using pre-experiment covariates to improve sensitivity without simply extending test duration. | Requires correct covariates and implementation; variance reduction cannot repair biased randomization or bad metrics. | Published in the 2022–2023 period; live in 2026. |
| [First Practical Online Controlled Experiments Summit](https://www.microsoft.com/en-us/research/uploads/prod/2020/07/2019-FirstPracticalOnlineControlledExperimentsSummit_SIGKDDExplorations.pdf) | A, cross-company research paper | Free PDF | Practical lessons from thirteen companies and more than 100,000 treatments; excellent map of real experimentation challenges. | Participating companies skew toward large digital platforms with mature infrastructure. | 2019 summit paper, published 2020; stable. |
| [Focus on the Long Term — Google Research](https://research.google/pubs/focus-on-the-long-term-its-better-for-users-and-business/) | A, original research | Free | Why short-run effects may not predict long-run user and business outcomes. | One set of company contexts; deciding the right horizon remains product-specific. | KDD 2015; stable primary research. |
| [ICH E9(R1): Estimands and Sensitivity Analysis](https://www.ema.europa.eu/en/ich-e9-statistical-principles-clinical-trials-scientific-guideline) | A, official international regulatory guideline | Free | Aligning objective, estimand, design, analysis, intercurrent events, and sensitivity checks; a rigorous model for specifying what an experiment is trying to estimate. | Written for clinical trials. Product teams may borrow the discipline, not claim clinical validity or regulatory applicability. | Current official EMA/ICH entry checked 2026-07-28. |
| [Multiple Endpoints in Clinical Trials — US FDA](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/multiple-endpoints-clinical-trials) | A, regulator guidance | Free | Endpoint roles, families, hierarchy, multiplicity, and how benefit and harm evidence interact in a predeclared analysis. | Clinical-regulatory scope; consumer and enterprise product teams must translate the statistical principles and cannot infer FDA jurisdiction. | Final guidance issued **October 2022**; current page checked 2026-07-28. |
| [Toward Causal Inference With Interference — Hudgens and Halloran](https://pmc.ncbi.nlm.nih.gov/articles/PMC2600548/) | A, peer-reviewed primary methods research | Free | Defining direct, indirect or spillover, total, and overall effects when one unit's treatment can affect another unit's outcome. | Formal potential-outcomes treatment; applying it requires a credible exposure map, design, population, and interference boundary. | JASA 2008 primary paper; stable and checked 2026-07-28. |
| [Value of Information Analytical Methods — ISPOR Task Force](https://pmc.ncbi.nlm.nih.gov/articles/PMC7373630/) | A, peer-reviewed methods report | Free | EVPI, EVPPI, EVSI, and expected net benefit of sampling for deciding whether more evidence is worth its cost. | Developed for health-economic decisions; product use requires an explicit loss or utility model, study cost, exposure cost, and honest sensitivity analysis. | Published 2020; stable methods source checked 2026-07-28. |
| [XP: Uber's Experimentation Platform](https://www.uber.com/us/en/blog/xp/) | A for Uber's implementation | Free | Fixed-horizon tests, sequential testing, causal inference, and bandits in a marketplace environment. | First-party platform account; publication may emphasize successful capabilities and omit operational failures. | Published 2018; useful historical architecture case. |
| [T-REX Experimentation Platform — LinkedIn Engineering](https://engineering.linkedin.com/teams/data/analytics-platform-apps/data-applications/t-rex) | A for LinkedIn's implementation | Free | A current view of company-wide experimentation workflows and platform responsibilities. | Enterprise-scale platform design may be excessive for small teams; first-party survivorship bias applies. | Page live when checked in 2026. |
| [It's All A/Bout Testing: Netflix Experimentation Platform](https://medium.com/netflix-techblog/its-all-a-bout-testing-the-netflix-experimentation-platform-4e1ca458c15) | A for Netflix's implementation | Free | Architecture and organizational case study for experimentation at scale. | Published on Netflix's official TechBlog but hosted on Medium; historical design should not be assumed current. | Published 2016; use as a dated case. |
| [Trustworthy Online Controlled Experiments — Kohavi, Tang, Xu](https://www.cambridge.org/core/books/trustworthy-online-controlled-experiments/D97B26382EB0EB2DC2019A7A7B518F59) | A/B, research-practitioner book | Paid/library | The most complete practical reference for experiment design, metrics, statistics, quality checks, culture, and platforms. | Digital controlled-experiment emphasis; quasi-experiments and domain-specific ethics need additional sources. | Published 2020; foundational. |
| [NIST/SEMATECH experimental-design overview](https://itl.nist.gov/div898/handbook/pri/section1/pri11.htm), [randomized blocks](https://www.itl.nist.gov/div898/handbook/pri/section3/pri332.htm), [small-proportion intervals](https://itl.nist.gov/div898/handbook/prc/section2/prc241.htm), [sample size for proportions](https://itl.nist.gov/div898/handbook/prc/section2/prc242.htm), and [ASA statement on p-values](https://www.amstat.org/asa/files/pdfs/p-valuestatement.pdf) | A/B, official government statistical handbook and professional-society statement | Free | Predeclaring objectives, factors, responses, blocking or nuisance context, sampling assumptions, uncertainty, effect/error trade-offs, and why a tiny heterogeneous sequence cannot be rescued by a p-value. | NIST examples and formulas assume statistical structures that twelve negotiated enterprise prospects do not satisfy; the ASA statement is not a design. Use comparable paid offers and decision thresholds without claiming population elasticity or powered inference. | NIST living handbook and 2016 ASA statement checked 2026-07-28. |
| [Difference-in-Differences with Multiple Time Periods: Callaway and Sant'Anna](https://doi.org/10.1016/j.jeconom.2020.12.001), [official method guide](https://bcallaway11.github.io/did/articles/multi-period-did.html), and [Using Synthetic Controls: Abadie](https://www.aeaweb.org/articles?id=10.1257%2Fjel.20191450&page=299) | A, peer-reviewed causal-inference methods | Abstracts and author guide free; article access varies | Estimating effects when randomization is infeasible: staggered adoption and heterogeneous group-time effects with difference-in-differences, or one or a few treated units with a defensible donor pool and pre-treatment fit using synthetic controls. | Identification still depends on no anticipation, credible conditional parallel trends or donor construction, overlap, stable measurement, and bounded interference. Concurrent shocks, poor pre-fit, composition changes, or selective timing can defeat causal interpretation. | *Journal of Econometrics* **225(2), 2021**, pp. 200-230; *Journal of Economic Literature* **59(2), June 2021**, pp. 391-425; DOI, official author guide, and AEA route checked 2026-07-28. |
| [Impact Evaluation in Practice, second edition — World Bank and IDB](https://www.worldbank.org/en/programs/sief-trust-fund/publication/impact-evaluation-in-practice) with the [open handbook PDF](https://openknowledge.worldbank.org/bitstream/handle/10986/25030/9781464807794.pdf) | A/B, official applied-methods handbook | Free | Connecting a decision to a counterfactual, randomized assignment, intention-to-treat under incomplete take-up, instrumental variables, regression discontinuity, difference-in-differences, matching, sampling, implementation, ethics, and policy use through worked public-program cases. | An accessible methods textbook, not a substitute for a statistician, preregistered analysis plan, domain ethics review, exposure instrumentation, or product-specific power model. Method labels do not make identification assumptions true, and public-program transportability is not automatic. | Second edition published **2016**; official landing page and open PDF were live and checked 2026-07-28. |
| [CONSORT cluster-randomized extension — EQUATOR record](https://www.equator-network.org/reporting-guidelines/consort-cluster/) and [full BMJ statement](https://www.bmj.com/content/345/bmj.e5661) | A, consensus reporting guideline and peer-reviewed methods explanation | Free | Making cluster rationale, cluster and participant eligibility, assignment, objectives, sample-size inflation, intracluster correlation, flow, consent, analysis level, attrition, and harms explicit in school, office, district, or site experiments. | A health-research reporting extension, not a product-experiment design recipe or assurance of internal validity. The 2012 cluster extension remains the listed extension while the generic statement moved to CONSORT 2025; cluster choice, ICC, contamination, ethics, and analysis must be justified for the actual setting. | BMJ statement published **September 4, 2012**; EQUATOR record updated **April 4, 2026** and checked 2026-07-28. |
| [Magenta Book Annex A — analytical methods for evaluation](https://assets.publishing.service.gov.uk/media/6a049bf75f39105e0848a21e/CCS0126982978-004_PN10640792_Magenta_Book_Annex_A_WEB_ACCESSIBLE__4_.pdf) | A/B, official UK government evaluation guidance | Free accessible PDF | Selecting and challenging experimental and quasi-experimental designs, especially interrupted time series with a clear intervention point, adequate pre/post series, a priori level or slope estimand, seasonality, autocorrelation, non-stationarity, concurrent-policy checks, and optional comparison series. | Cross-government guidance, not proof that an observational product rollout is causal. A short series, coincident shock, changing composition or measurement, endogenous timing, spillover, or poor comparison can invalidate the estimate; jurisdictional guidance does not supply a product threshold. | Current accessible Annex A route, including the interrupted-time-series section, was live and checked 2026-07-28. |

## 8. RCA, reliability, incidents, and operational learning

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [5 Whys — Lean Enterprise Institute](https://www.lean.org/lexicon-terms/5-whys/) | B, method-origin institution | Free | Tracing a gap from expected performance through a factual causal chain; "five" is not a literal stopping rule. | Can force a false single root cause, invite speculation, or stop at human error. Use timelines, evidence, contributing factors, and tests. | Living glossary checked 2026. |
| [Clarifying the Five Whys — Lean Enterprise Institute](https://www.lean.org/the-lean-post/articles/five-whys-animation/) | B, practitioner explainer | Free | A visual explanation of successive causal questioning and countermeasures. | Introductory; complex socio-technical incidents need richer analysis. | Published 2018; stable. |
| [Postmortem Culture: Learning from Failure — Google SRE](https://sre.google/sre-book/postmortem-culture/) | A/B, first-party engineering practice | Free | Blameless systemic learning, impact, mitigation, root and contributing causes, and owned follow-ups. | Google's scale and engineering organization differ from most teams; "blameless" still requires accountability for actions and systems. | Original SRE book chapter; stable and live in 2026. |
| [Postmortem Culture — Google SRE Workbook](https://sre.google/workbook/postmortem-culture/) | A/B, first-party workbook | Free | More operational guidance, examples, and templates for building a postmortem practice. | Templates can become ritual paperwork without action ownership and follow-up verification. | Living SRE resource checked 2026. |
| [Postmortem Analysis — Google SRE Workbook](https://sre.google/workbook/postmortem-analysis/) | A, first-party aggregate analysis | Free | Learning across thousands of postmortems, including triggers and cause categories rather than reading incidents in isolation. | Taxonomy reflects Google's systems and reporting culture; categories do not transfer one-for-one. | Live when checked in 2026. |
| [Site Reliability Engineering — Google](https://sre.google/sre-book/table-of-contents/) | A/B, first-party technical book | Free full book | SLOs, monitoring, troubleshooting, incident response, overload, cascading failure, and launch readiness. | Large-scale service lens; teams must right-size mechanisms and add product, user, legal, and communications dimensions. | Foundational 2016 book; maintained online. |
| [Incident Postmortems — Atlassian](https://www.atlassian.com/incident-management/handbook/postmortems) | B, vendor practitioner handbook | Free | Impact, proximate and systemic causes, action items, owners, tracking, approval, and a blameless meeting. | Vendor-linked and introductory; examples do not replace technical evidence or organizational analysis. | Living handbook checked 2026. |
| [Failure Mode Analysis — Microsoft Azure Well-Architected](https://learn.microsoft.com/en-us/azure/well-architected/reliability/failure-mode-analysis) | A/B, official cloud guidance | Free | Proactively mapping dependencies, failure points, blast radius, detection, and mitigations before incidents. | Azure vocabulary and services are vendor-specific; use the reasoning across architectures. | Current documentation checked in 2026. |
| [AWS Well-Architected](https://aws.amazon.com/architecture/well-architected/) | A/B, official cloud framework | Free | Operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability questions. | AWS-specific and commercially aligned; architecture choices require independent constraints and multi-cloud/vendor-risk analysis. | Living framework checked 2026. |
| [NIST SP 800-61 Revision 3: Incident Response Recommendations](https://csrc.nist.gov/pubs/sp/800/61/r3/final) | A, government cybersecurity guidance | Free | Integrating preparation, detection, response, recovery, and improvement into CSF 2.0 risk management rather than treating incident response as a separate playbook. | A voluntary cross-sector community profile, not a complete product runbook, regulatory conclusion, severity model, or proof that an organization can execute its plans. | Final Revision 3 published **April 2025**, superseding Revision 2; checked 2026-07-28. |
| [Example Error Budget Policy — Google SRE Workbook](https://sre.google/workbook/error-budget-policy/) | A for Google's published practice; B as a reusable policy pattern | Free | Connecting a measured SLO window to release constraints, reliability work, postmortem triggers, escalation, and an explicit balance between reliability and feature delivery. | An illustrative 2018 policy for a fictional game service, not a universal SLO, release-freeze rule, incident threshold, or current description of every Google team. | Published **February 2018**; stable workbook appendix live when checked 2026-07-28. |
| [Business Continuity Management booklet announcement — FFIEC](https://www.ffiec.gov/news/press-releases/2019/pr-11-14) | A, US financial supervisory source | Free | Enterprise-wide continuity and resilience framing across technology, business operations, testing, communication, recovery, third parties, and examiner expectations. | A 2019 announcement that summarizes the revised booklet, not the complete current handbook or a rule for non-US or non-financial products; reopen the applicable regulator material before use. | Press release and booklet revision dated **November 14, 2019**; official page live 2026-07-28. |
| [Digital Operational Resilience Act — Regulation (EU) 2022/2554](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) | A, primary legal text | Free | In-scope EU financial entities' ICT risk management, incident reporting, resilience testing, third-party risk, information sharing, governance, and operational continuity. | Role, entity, service, territorial, and transition scope are legally complex; it is not a generic incident checklist, and delegated acts, supervisory materials, facts, and qualified advice remain necessary. | In force and applicable since **January 17, 2025**; official text checked 2026-07-28. |
| [National Incident Management System command and coordination](https://www.usfa.fema.gov/a-z/nims/command-and-coordination.html) and [2017 NIMS doctrine](https://www.fema.gov/sites/default/files/2020-07/fema_nims_doctrine-2017.pdf) — FEMA/USFA | A, government incident doctrine | Free | Separating tactical command, incident support, policy decisions, and public communication; building a common operating picture; coordinating resources across organizations; and scaling an incident structure to complexity. | U.S. all-hazards doctrine, not a software-incident org chart or automatic authority transfer. Adapt the principles to existing safety, regulatory, employment, regional, and executive accountabilities. | Third edition doctrine published **October 2017**; current USFA summary and official PDF checked 2026-07-28. |
| [Framework for a Public Health Emergency Operations Centre — WHO](https://www.who.int/publications/i/item/framework-for-a-public-health-emergency-operations-centre) | A, intergovernmental emergency-management handbook | Free | Coordinating information and resources, defining functions and staffing, establishing unity of effort across agencies, and designing an emergency operations centre before activation. | Public-health emergency scope and 2015 publication. It is a transferable coordination reference, not a mandate for routine product work, a substitute for local plans, or proof that centralized control improves every crisis. | Published **November 24, 2015**; official publication route checked 2026-07-28 while WHO listed revision work. |
| [NASA Safety Culture Handbook](https://standards.nasa.gov/standard/nasa/nasa-hdbk-870924) | A for NASA's documented program; B as a cross-domain pattern | Free PDF | Connecting reporting culture, just culture, flexible operations, learning, engagement, risk awareness, surveys, leadership, training, and sustained follow-through after failure. | NASA mission and hazard context is unusually safety-critical; the handbook defines one agency's program, not a causal guarantee or a generic culture score. Do not import aerospace governance without proportional adaptation. | NASA-HDBK-8709.24 baseline dated **November 23, 2015**; active Change 1 dated **February 25, 2021**; official record checked 2026-07-28. |
| [OpenTelemetry Specification](https://opentelemetry.io/docs/specs/otel/), [OTLP Specification](https://opentelemetry.io/docs/specs/otlp/), and [W3C Trace Context](https://www.w3.org/TR/trace-context/) | A, open observability and web standards | Free | Specifying vendor-neutral traces, metrics, logs, resource identity, export, and cross-service context propagation so an incident investigation can follow a request and preserve causal sequence across system boundaries. | Standards do not select product KPIs or SLOs and do not solve sampling, cardinality, privacy, retention, cost, semantic conventions, or missing instrumentation. Trace Context Level 2 remained a draft, so use the stable Recommendation for normative claims. | OpenTelemetry **1.59.0**, OTLP **1.11.0**, and W3C Recommendation dated **November 23, 2021** checked 2026-07-28; pin versions and recheck quarterly. |

## 9. Growth, pricing, commercialization, and startup cases

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [Stripe Atlas Guides](https://stripe.com/atlas/guides) | B, first-party practitioner library | Free | SaaS fundamentals, first customers, startup operations, pricing, and practical commercialization. | Stripe and venture-startup lens; legal, tax, and market claims must be checked for the learner's jurisdiction and date. | Living guide hub checked 2026. |
| [Pricing Low-Touch SaaS — Stripe Atlas](https://stripe.com/au/guides/atlas/saas-pricing) | B, practitioner guide | Free | Value metric, packaging, price testing, and practical constraints in self-serve SaaS. | Low-touch SaaS assumptions do not fit enterprise, marketplace, hardware, ads, or public services; regional URL may redirect. | Living article checked 2026. |
| [Pricing Strategy — Paddle](https://www.paddle.com/resources/pricing-strategy) | B, vendor guide | Free | Comparing pricing methods, value metrics, segments, research, and testing. | Commercial vendor content; quantitative claims and benchmarks require independent verification. | Current when checked in 2026. |
| [SaaS Pricing Models and Strategies — Paddle](https://www.paddle.com/blog/saas-pricing-models-strategies-fltr) | B, vendor guide | Free | Current subscription, usage, hybrid, and AI-era SaaS packaging patterns. | Strong SaaS and vendor viewpoint; new patterns lack long-term evidence and may age quickly. | Published **March 13, 2026**. |
| [Scaling Product at Airbnb — Y Combinator](https://www.ycombinator.com/blog/scaling-product-airbnb) | B, first-party interview/case | Free | Early Airbnb user contact, doing unscalable work, learning from hosts, and connecting customer love with revenue. | Retrospective founder narrative with survivorship and hindsight bias; pair with dated primary metrics where used as a factual case. | Published 2017; historical case. |
| [On or Off Track: How (Broken) Streaks Affect Consumer Decisions — Silverman and Barasch](https://doi.org/10.1093/jcr/ucac029) | A, peer-reviewed primary research | Abstract free; article may require access | Seven studies on how displaying an intact versus broken logged streak can change subsequent engagement, including attribution and repair conditions. | Consumer-study settings and represented streaks do not establish effects for teachers, every culture, long-term welfare, or a particular product. Preserve the actual intervention and population before transferring the finding. | Published online **June 30, 2022**; Journal of Consumer Research 49(6), April 2023. |
| [The "What" and "Why" of Goal Pursuits — Deci and Ryan](https://doi.org/10.1207/S15327965PLI1104_01) | A/B, peer-reviewed original theory article | Abstract free; article may require access | The self-determination-theory account of autonomy, competence, relatedness, goal content, and regulatory processes as a lens for evaluating engagement mechanics. | A foundational theoretical synthesis, not a product recipe, frequency threshold, or proof that a specific mechanic supports need satisfaction across populations and cultures. | Psychological Inquiry 11(4), **2000**, pp. 227–268; stable primary source. |
| [Notifications — Apple Human Interface Guidelines](https://developer.apple.com/design/human-interface-guidelines/notifications) | A for Apple platform guidance; B as general design guidance | Free | Designing timely, high-value notifications, permission-aware experiences, non-repetitive messaging, actions, grouping, and protection of sensitive content on Apple platforms. | Apple-specific, living design guidance; it does not supply a universal notification-frequency benchmark, legal basis, causal lift estimate, or accessibility sign-off. | Living documentation checked **July 28, 2026**; preserve an access date because the page is not editioned. |
| [Notification runtime permission — Android Developers](https://developer.android.com/develop/ui/compose/notifications/notification-permission) | A for Android platform behavior; B as general permission guidance | Free | Android 13+ notification permission states, contextual requests, testing, user choice, enablement checks, and responsible ongoing use. | Android- and implementation-specific; permission acceptance is not evidence that messaging is valuable, non-manipulative, accessible, or incrementally effective. | Documentation updated **July 14, 2026**; checked 2026-07-28. |
| [The Green Book 2026](https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-government/the-green-book-2026) and [stated-preference supplementary guidance](https://www.gov.uk/government/publications/green-book-supplementary-guidance-stated-preference-techniques) — HM Treasury | A, government appraisal and valuation guidance | Free | Separating revealed behavior from stated willingness to pay; designing bounded stated-preference research; exposing hypothetical, strategic, sample, framing, payment, and non-response bias before setting a price. | Public-policy appraisal guidance, not a consumer-product price recipe. The 2026 Green Book warns that stated preference can be unreliable and should follow robust revealed evidence where available; product teams must adapt population, incentive, and commercial context. | Green Book published **February 5, 2026**; supplementary page and 2013 guide checked 2026-07-28. |
| [TRAI consolidated telecom regulations](https://www.trai.gov.in/release-publication/consolidated-regulations/telecom), [TCCCPR hub](https://www.trai.gov.in/tcccpr), and [Advice to Senders](https://trai.gov.in/advice-to-senders) | A, Indian regulator rules and operational guidance | Free | Mapping authentication use cases into the applicable transactional, service, or promotional definitions; then scoping principal-entity, header, template, consent, preference, DLT, complaint, and sender obligations when designing Indian messaging products and prices. | Regulatory classification and duties are not an API vendor's price card, tax rate, delivery guarantee, or permission to bill failed/retried traffic. Reopen the consolidated regulation, amendments, directions, codes of practice, and exact use case with qualified owners. | Consolidated TCCCPR release dated **May 21, 2026**; hubs last updated July 2026 and checked 2026-07-28. |
| [EU transport-poverty recommendation and evidence hub](https://transport.ec.europa.eu/transport-themes/social-issues-equality-and-attractiveness-transport-sector/social-issues/access-transport-all_en), [World Bank urban-transport fares and subsidies review](https://documents.worldbank.org/pt/publication/documents-reports/documentdetail/728671468338671582), and [ITF urban-transport pricing paper](https://www.itf-oecd.org/reforming-private-and-public-urban-transport-pricing) | A, government/intergovernmental policy and research | Free | Balancing rider affordability, operator sustainability, capacity, congestion, peak pricing, targeted subsidy, accessibility, and distributional incidence in mobility fee architecture. | Jurisdictions, modes, operator structures, dates, methods, and welfare assumptions differ. The sources do not validate surge multipliers, contribution floors, subsidy eligibility, or taxes for a synthetic coalition. | EU recommendation adopted **May 22, 2025**; World Bank 2007 working paper and ITF 2018 paper retained as historical methods; routes checked 2026-07-28. |
| [Drip pricing — Competition Bureau Canada](https://competition-bureau.canada.ca/en/deceptive-marketing-practices/drip-pricing) | A, competition-regulator guidance | Free | Testing whether displayed prices include unavoidable charges, whether buyers can compare total cost, and how fixed government-imposed charges differ from seller-added mandatory fees. | Canada-specific competition-law guidance with fact-dependent scope. It does not determine price display, tax, fee, or remedy requirements in another jurisdiction or prove that every usage-based charge is deceptive. | Page modified **November 25, 2024** and checked 2026-07-28. |
| [OpenAI API pricing](https://developers.openai.com/api/docs/pricing), [Google Vertex AI generative-AI pricing](https://cloud.google.com/vertex-ai/generative-ai/pricing), and [OECD public-cloud compute availability for AI](https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/10/measuring-domestic-public-cloud-compute-availability-for-artificial-intelligence_39fa6b0e/8602a322-en.pdf) | A for current vendor prices and intergovernmental analysis; B for cross-vendor product decisions | Free | Decomposing inference cost by model, input, cached input, output, tools, capacity, geography, and use; separating product entitlement and routing from a volatile provider rate when redesigning an AI free tier. | Vendor sheets are living list prices, omit total product cost and negotiated terms, and can fall while one product's cost rises from mix or use. The OECD report is aggregate infrastructure analysis. None measures user value, willingness to pay, referral value, or the right allowance. | Provider pages and OECD 2025 report checked **July 28, 2026**; recheck at every consequential decision. |
| [YouTube partner-earnings overview](https://support.google.com/youtube/answer/72902?hl=en-GB), [YouTube Shorts monetization mechanics](https://support.google.com/youtube/answer/12504220?hl=en), [Alphabet fiscal 2025 Form 10-K](https://www.sec.gov/Archives/edgar/data/1652044/000165204426000018/goog-20251231.htm), and [UK CMA Music and Streaming study](https://www.gov.uk/cma-cases/music-and-streaming-market-study) with [final-report landing page](https://www.gov.uk/government/publications/music-and-streaming-market-study-final-report) | A for first-party terms/disclosure and regulator research | Free | Designing a creator-payout waterfall across eligible net revenue, licensing deductions, country or format pools, advertising and subscription sources, allocation units, revenue-share and per-subscriber alternatives, reconciliation, auditability, concentration, and information asymmetry. | YouTube terms are living and platform-specific; Alphabet reporting is aggregated issuer disclosure; the CMA study concerns a music-rights chain and principally 2017–2021 evidence. None establishes a fair universal share, a video allocation metric, or a synthetic pool. | YouTube pages and fiscal 2025 filing checked 2026-07-28; CMA final report published **November 29, 2022**. |
| [FTC current Negative Option Rule page](https://www.ftc.gov/legal-library/browse/rules/negative-option-rule), [FTC Shutterstock case page](https://www.ftc.gov/legal-library/browse/cases-proceedings/shutterstock-inc), and [OECD International VAT/GST Guidelines](https://www.oecd.org/en/publications/international-vat-gst-guidelines_9789264271401-en.html) | A, regulator status/enforcement source and intergovernmental tax principles | Free | Checking current rule status rather than citing an obsolete announcement; designing material price/renewal disclosure, informed enrollment, simple cancellation, and cross-border consumption-tax ownership when migrating subscriptions. | A rule-status page, allegations, and proposed order do not create a universal holding; OECD principles do not calculate product tax or invoice duties. Market, entity, offer, current law, and qualified legal/tax review govern. | FTC rule page and May 2026 proposed settlement checked **July 28, 2026**; OECD guidelines published 2017. |
| [Modeling Customer Lifetime Value: Gupta et al.](https://journals.sagepub.com/doi/10.1177/1094670506293810) | A, peer-reviewed method and review | Abstract free; full text may require library access | Selecting CLV approaches appropriate to contractual or noncontractual behavior and connecting acquisition, retention, cross-sell, margin, discount rate, and customer-level resource allocation. | A model must fit purchase, churn, censoring, contribution, and cohort behavior. Undiscounted revenue is not profit-based LTV, historical fit is not forecast validity, and sensitive assumptions require ranges and out-of-sample checks. | *Journal of Service Research* **9(2), November 2006**, pp. 139-155; publisher record checked 2026-07-28. |
| [App Review Guidelines: Apple](https://developer.apple.com/app-store/review/guidelines/) and [Developer Policy Center: Google Play](https://play.google.com/about/developer-content-policy/) | A for each platform's current distribution rules | Free | Pre-launch feasibility and review readiness across payments and subscriptions, user-generated and AI-generated content, children, SDK and data practices, account behavior, metadata, promotions, safety, and store-specific operations. | First-party channel rules are not universal product standards or law. Requirements, linked policies, effective dates, regional options, category judgments, and enforcement differ by store and can change between releases. | Apple living guidelines updated **June 8, 2026**; Google policy center showed an **April 15, 2026** update cycle; checked 2026-07-28 and recheck before every submission. |
| [IRDAI consolidated policyholder-protection regulations](https://irdai.gov.in/web/guest/consolidated-gazette-notified-regulations?filterDepartment=CAD&filtersApplied=true) and [policyholder protection and grievance redressal](https://irdai.gov.in/about-consumer-affairs) | A, Indian insurance regulator sources | Free; a linked regulation PDF may block scripted retrieval | Designing insurance-automation launch gates around policyholder communications, claims operations, grievance intake and escalation, appeals, accountable carrier operations, and current regulatory instruments rather than only model or integration readiness. | Indian insurance scope is entity-, product-, role-, contract-, and fact-specific. The consumer page and consolidated index are navigation and operating routes, not proof that an automation complies, that a claim decision is correct, or that an appeal pathway is adequately staffed. Reopen the exact regulation and current master circular with legal, compliance, claims, and grievance owners. | The index listed the **IRDAI (Protection of Policyholder's Interests, operations and allied matters of insurers) Regulations, 2024** as non-archived and was last updated May 15, 2026; official routes checked 2026-07-28. The linked PDF rejected one automated retrieval and must be reopened before consequential use. |
| [CISA Secure by Demand Guide](https://www.cisa.gov/sites/default/files/2024-08/SecureByDemandGuide_080624_508c.pdf), [NIST CSF 2.0 Organizational Profiles](https://www.nist.gov/cyberframework/profiles), and [NIST SP 800-53A Revision 5](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final) | A, government buyer-security and control-assessment guidance | Free | Turning a regulated buyer's security concern into role-owned evaluation evidence: product-security questions, target and current profiles, scoped assessment objectives, procedures, findings, remediation, residual risk, and an explicit no-decision path. | These sources do not define a sales mutual action plan, certify a vendor, make every control applicable, or transfer buyer or supplier accountability. CISA distinguishes product security from enterprise compliance; NIST procedures must be tailored to system boundary and risk tolerance. Procurement, legal, privacy, security, and regulatory owners retain their decisions. | CISA guide dated **August 2024**; NIST CSF 2.0 profile page updated in 2026; SP 800-53A final January 2022 with current minor release **5.2.0** issued August 27, 2025. Routes checked 2026-07-28; the CISA PDF needed indexed/alternate rendering during one check. |
| [NPCI UPI overview](https://www.npci.org.in/product/upi/about-upi), [GST e-invoice API integration portal](https://einvoice6.gst.gov.in/content/api-integration/), and [RBI accessibility guidelines for digital payment systems](https://www.rbi.org.in/scripts/RTGS_Notification.aspx?Id=12741) | A for the official network, GSTN-authorized portal, and Indian regulator guidance | Free; some detailed API material requires registration | Testing whether an API's Indian launch needs local payment rails, a specific statutory workflow, integrator registration and relationships, current validation rules, local support coverage, and accessible payment journeys rather than translated documentation alone. | UPI, GST e-invoicing, and RBI payment guidance do not apply to every API. First establish whether the product handles funds, initiates or supports payment, processes in-scope invoices, or is a regulated participant; then verify entity, transaction, turnover, role, release, and accessibility scope. A portal or integration does not prove statutory compliance or commercial demand. | GST portal showed a February 1, 2026 production release and current integration instructions when checked; NPCI rendered only through a JavaScript-capable route and the RBI page timed out once in scripted retrieval. All official routes were checked or independently indexed on 2026-07-28 and require launch-time recheck. |
| [ILO Guide to Private Employment Agencies, second revised edition](https://www.ilo.org/publications/guide-private-employment-agencies), [ILO fair-recruitment principles and operational guidelines](https://www.ilo.org/resource/ilos-2016-general-principles-and-operational-guidelines-fair-recruitment), [29 CFR Part 1607](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XIV/part-1607), and [EEOC employment tests and selection procedures](https://www.eeoc.gov/laws/guidance/employment-tests-and-selection-procedures) | A, intergovernmental guidance plus U.S. regulation and regulator technical assistance | Free | Reframing a jobs-marketplace launch from application volume to accurate job information, worker protection, qualified progression, selection evidence, employer outcomes, group-wise funnel diagnostics, grievances, and renewal. | ILO principles are expressly non-binding and require national implementation; U.S. selection law and coverage are fact-specific. The eCFR is continuously updated and authoritative but unofficial. The four-fifths measure is a screening rule of thumb, not dispositive proof of discrimination, and small samples, statistical significance, job relatedness, alternatives, recruiting versus selection, disability, age, state law, and other protected classes need separate analysis. | ILO guide second revised edition published **October 28, 2025**; fair-recruitment principles adopted in 2016 with the 2019 fees definition; eCFR displayed currency through July 24, 2026. Official routes checked 2026-07-28; ILO pages returned scripted 403s but remained available through official indexed records. |

## 10. Technical product, security, privacy, and responsible design

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [Secure by Design Pledge](https://www.cisa.gov/sites/default/files/2024-05/CISA%20Secure%20by%20Design%20Pledge_508c.pdf) and [Shifting the Balance of Cybersecurity Risk](https://www.cisa.gov/sites/default/files/2023-06/principles_approaches_for_security-by-design-default_508c.pdf) — CISA and international partners | A, government secure-by-design principles and voluntary pledge | Free | Distinguishing baseline protections customers should not need to buy separately—such as secure defaults, MFA/SSO support, logging, and vulnerability handling—from premium governance, service, assurance, and workload capabilities. | The pledge is voluntary and scoped to participating enterprise-software manufacturers; the principles are guidance, not a universal package mandate, certification, entitlement contract, or proof that a control is effective. Exact product, customer, threat, and jurisdiction still govern. | Pledge published **May 8, 2024**; joint principles refined October 2023; routes checked 2026-07-28. |
| [Pseudonymisation — UK Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) | A, data-protection regulator guidance | Free | Separating pseudonymous from anonymous data; defining purpose, attacker and reversal risks, technique, role separation, access to additional information, documentation, testing, and ongoing governance. | Pseudonymous data remains personal data, and a name replacement does not remove linkage, inference, discrimination, insider, or re-identification risk. UK-specific guidance was under review following the Data (Use and Access) Act, so recheck it and obtain qualified advice before consequential use. | Anonymisation guidance version 1.0.21 published **March 28, 2025**; under-review status and route checked 2026-07-28. |
| [Care and support statutory guidance — UK Department of Health and Social Care](https://www.gov.uk/government/publications/care-act-statutory-guidance/care-and-support-statutory-guidance) | A, government statutory guidance | Free | Adult-safeguarding principles, person-led outcomes, accessible information, advocacy, reporting, records, multi-agency roles, enquiries, escalation, and learning for care-service products. | England-specific Care Act guidance, not a global platform duty or a complete customer contract. The publisher says parts are out of date and the publication is under review; map the exact service, authority, law, regulator, and current local procedure. | Current page updated **July 22, 2025** and checked 2026-07-28 with its under-review warning preserved. |
| [Ethics of health research priority setting — World Health Organization](https://www.who.int/publications/i/item/9789240110953) | A, intergovernmental ethics guidance | Free | Making scarce-resource goals, opportunity costs, value judgments, affected populations, participation, process, and fair allocation assumptions explicit rather than hiding them inside a predictive score. | Written for health-research priorities, not grant applicant ranking, entitlement law, or a universal allocation formula. Its ethical process questions transfer; its domain and authority do not. | Published **June 23, 2025**; official route checked 2026-07-28. |
| [How the FTC Provides Refunds — U.S. Federal Trade Commission](https://www.ftc.gov/enforcement/ftc-refund-programs/how-ftc-provides-refunds) | A, regulator remedy-process account | Free | Designing eligibility, direct versus claims-based outreach, allocation formulas, duplicate and fraud controls, payment audits, reissues, additional rounds, and distribution learning for a bounded remedy proposal. | Describes U.S. FTC distributions under court orders and enforcement matters, not a private company's automatic legal duty, an admission-of-fault rule, or permission to collect extra claimant data. Eligibility and communications must follow the actual order, law, facts, and qualified owners. | Process page includes calendar-2024 operating examples and was checked 2026-07-28. |
| [Payments to harmed consumers](https://www.consumerfinance.gov/enforcement/payments-harmed-consumers/) and [Consumer complaint program](https://www.consumerfinance.gov/compliance/consumer-complaint-program/) — U.S. Consumer Financial Protection Bureau | A, financial regulator sources | Free | Separating consumer redress from unsupported liability language; designing accurate, complete, timely complaint response, privacy-aware case handling, monitoring, cohort analysis, and longitudinal evidence of recovery. | U.S. consumer-financial enforcement and supervised-company context; neither page determines liability, eligibility, amount, privilege, regulator reporting, or a remedy for another product. Current counsel and the governing order or law remain necessary. | Redress page modified **December 12, 2024**; complaint-program page modified **May 18, 2026**; checked 2026-07-28. |
| [Digital Personal Data Protection Rules, 2025](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf), [phased commencement notification](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf), and [current MeitY document hub](https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa) | A, primary Indian legal instruments and official hub | Free | Mapping notice, security, breach, rights, erasure and specified retention mechanics, significant-data-fiduciary duties, Board procedure, and the provisions that commence immediately, after one year, or after eighteen months. | Legal effect is provision-, role-, purpose-, threshold-, fact-, and date-specific. The hub lists a December 2025 corrigendum; use the corrected current instruments, other applicable record laws, and qualified Indian counsel rather than treating one schedule as a universal retention period. | Rules and commencement instruments published **November 14, 2025**; corrigendum listed **December 16, 2025**; hub and instruments checked 2026-07-28. |
| [Digital Personal Data Protection Act, 2023 — India Code](https://www.indiacode.nic.in/handle/123456789/22037) | A, official Indian statute record | Free | Reading the enacted Act alongside provision-specific commencement notifications, final Rules, corrigenda, Board instruments, and other sectoral duties when mapping product-data roles, rights, security, erasure, records, and accountability. | The presence of the Act in India Code does not mean every provision is operative for every entity or processing activity. Applicability, exemptions, commencement, Rules, other laws, facts, and qualified Indian advice must be checked at the decision date. | Act record and linked instruments checked 2026-07-28; current commencement remains provision-specific. |
| [Directions under section 70B of the Information Technology Act — CERT-In hub](https://www.cert-in.org.in/Directions70B.jsp) and [April 28, 2022 Directions](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) | A, primary Indian cybersecurity directions and official status hub | Free | Assigning incident reporting, secure time synchronization, designated points of contact, specified log retention, information requests, and evidence availability to the correct security and legal owners. | Entity, provider, incident, data, timing, and enforcement scope require current legal and security analysis; retaining security logs does not authorize retaining every product or research record. Read the FAQ and any extension or later instrument linked by the hub. | Directions dated **April 28, 2022**; official hub, FAQ/extension routes, and status checked 2026-07-28. |
| [NIST SP 800-63-4: Digital Identity Guidelines](https://www.nist.gov/publications/nist-sp-800-63-4-digital-identity-guidelines) and [online Revision 4 suite](https://pages.nist.gov/800-63-4/) | A, US government technical guidance | Free | Risk-based identity proofing, authentication, federation, fraud controls, privacy, customer experience, redress, control tailoring, and continuous evaluation rather than treating identity disclosure as a binary switch. | Written primarily for US federal online services; private-sector and other public-sector organizations may adopt it where appropriate. It does not establish a lawful basis, require public identity exposure, cover physical access or machine identity comprehensively, or remove the need for user research and jurisdiction-specific review. | Final Revision 4 dated **July 2025** and released through NIST on August 1, 2025; supersedes SP 800-63-3; checked 2026-07-28. |
| [Global Findex Database 2025](https://www.worldbank.org/en/publication/globalfindex/report), [FATF Guidance on Digital ID](https://www.fatf-gafi.org/en/publications/Financialinclusionandnpoissues/Digital-identity-guidance.html), and [FATF financial-inclusion and customer-due-diligence guidance](https://www.fatf-gafi.org/en/publications/Fatfgeneral/Financial-inclusion-cdd-2017.html) | A, international survey/data program and intergovernmental guidance | Free | Segmenting payment access by country, income, gender, age, rurality, phone and internet access, and digital safety; treating identity and fraud controls as risk-based gates while testing whether overly cautious implementation excludes legitimate users. | Findex reports survey estimates from 2024, not a live product census, causal estimate, device-readiness measure, or country-specific fraud baseline. FATF guidance addresses AML/CFT and CDD within its framework; it is not national law, permission to weaken controls, or a universal identity architecture. Local regulation and competent review govern. | Global Findex 2025 launched **July 16, 2025**; FATF guidance published November 3, 2017 and March 6, 2020; official routes checked 2026-07-28. FATF returned scripted 403 but rendered through its official index. |
| [NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) | A, US government control catalog | Free | Selecting and tailoring auditable controls across access, audit and accountability, incident response, monitoring, privacy, personnel, acquisition, integrity, and supply-chain families; separating control functionality from assurance evidence. | A flexible catalog, not a minimum checklist, certification, safeguarding regime, product roadmap, or proof that a selected control works. Baselines and assessments live in companion publications, and mappings do not imply one-to-one equivalence. | Rev. 5 final published **September 2020** with December 2020 updates; minor Release **5.2.0** issued August 27, 2025; checked 2026-07-28. |
| [Regulation 13: Safeguarding service users from abuse and improper treatment — Care Quality Commission](https://www.cqc.org.uk/guidance-regulation/providers/regulations-service-providers-and-managers/health-social-care-act/regulation-13) | A, England health-and-social-care regulator guidance | Free | Testing whether an in-scope provider has effective prevention, immediate investigation, board-level oversight, staff responsibility, proportionality, and partnership mechanisms for abuse, neglect, discrimination, degrading treatment, and misuse of property. | Applies to providers and regulated activities within the CQC framework; it does not automatically regulate every care customer, software vendor, country, or end user. Product controls complement rather than replace professional safeguarding duties, local procedures, and competent authorities. | Current regulation-and-guidance route checked 2026-07-28. |
| [WHO patient-safety incident reporting and learning guidance](https://www.who.int/publications/i/item/9789240010338), [WHO Interagency Integrated Triage Tool](https://www.who.int/tools/triage), [NHS England digital clinical safety assurance](https://www.england.nhs.uk/long-read/digital-clinical-safety-assurance/), [CQC Regulation 16 on complaints](https://www.cqc.org.uk/guidance-regulation/providers/regulations-service-providers-and-managers/health-social-care-act/regulation-16), and [FDA Medical Device Reporting](https://www.fda.gov/medical-devices/medical-device-safety/medical-device-reporting-mdr-how-report-medical-device-problems) | A, intergovernmental clinical guidance plus England and US regulator/health-system sources | Free | Separating emergencies, clinical concerns, safeguarding, regulated complaints, usability issues, device reports, and later product learning; assigning immediate routing, minimum data, accountable owners, accessible response, closure, hazard evidence, and escalation without putting every signal into one backlog. | The WHO triage tool is clinical and setting-specific; NHS/CQC sources are scoped to England; FDA duties depend on product, reporter, event, and US jurisdiction. Incident and passive-surveillance reports do not establish incidence, prevalence, causality, or a universal response SLA. Clinical and legal owners must set the real workflow. | WHO reporting guidance published **September 16, 2020**; NHS version 1.2 updated March 4, 2025; CQC page updated May 16, 2025; FDA route reflected its August 28, 2024 update; checked 2026-07-28. |
| [Convention on the Rights of Persons with Disabilities, Article 16 — United Nations](https://www.un.org/development/desa/disabilities/convention-on-the-rights-of-persons-with-disabilities/article-16-freedom-from-exploitation-violence-and-abuse.html) and [official treaty text](https://www.ohchr.org/sites/default/files/Ch_IV_15.pdf) | A, international treaty text | Free | Centering disability-sensitive prevention, accessible information and reporting, independent monitoring, recovery, participation, and protection from exploitation, violence, and abuse in safeguarding design. | Treaty obligations attach to States Parties and depend on ratification, reservations, and domestic implementation. The text is not a private-platform control catalog or automatic legal conclusion for a fictional vendor. | Convention adopted **December 13, 2006** and entered into force May 3, 2008; official routes checked 2026-07-28. |
| [Online Safety Codes and Standards](https://www.esafety.gov.au/industry/codes) and [official register](https://www.esafety.gov.au/industry/codes/register-online-industry-codes-standards) — Australian eSafety Commissioner | A, Australian regulator sources | Free | Distinguishing unlawful-material codes and standards from age-restricted-material codes, identifying the service-specific instrument, operative date, later-starting measures, regulator guidance, reporting, and compliance directions. | Australian Online Safety Act scope is service-, material-, measure-, and date-specific. The codes are not a global moderation policy, a single strictest-region rule, or a substitute for the registered schedule and current legal analysis. | Three age-restricted codes took effect December 27, 2025 and six more beginning **March 9, 2026**, with some measures later; overview updated May 26 and register June 17, 2026; checked 2026-07-28. |
| [Guidelines for the Governance of Digital Platforms — UNESCO](https://www.unesco.org/en/articles/guidelines-governance-digital-platforms?hub=751) | A/B, intergovernmental human-rights guidance | Free | Human-rights due diligence, transparent and accountable moderation and curation, user empowerment, independent oversight, accessible information, systemic-risk assessment, and multistakeholder governance. | Non-binding guidance for a wide governance ecosystem, not a global statute or platform-specific enforcement rule. It must be reconciled with local law, service risk, affected communities, free-expression impacts, and operational evidence. | Published **November 11, 2023**, page updated March 4, 2025; checked 2026-07-28. |
| [Human Rights Committee General Comment No. 34](https://www.ohchr.org/sites/default/files/english/bodies/hrc/docs/GC34.pdf) and [OHCHR Rabat six-part threshold test](https://www.ohchr.org/sites/default/files/Rabat_threshold_test.pdf) | A, UN human-rights interpretive and analytical material | Free | Challenging vague or overbroad speech restrictions through legality, legitimate purpose, necessity, proportionality, and contextual analysis of speaker, intent, content/form, reach, and likelihood or imminence of harm. | These materials interpret State obligations and a high incitement threshold; they are not a universal private-platform removal cutoff, complete safety policy, or license to ignore lower-severity harms. Preserve lawful-expression, user-safety, notice, appeal, remedy, and local-jurisdiction analysis together. | General Comment 34 adopted **July 2011**; Rabat Plan threshold published through OHCHR in 2013; official routes checked 2026-07-28. |
| [Google Cloud API Design Guide](https://docs.cloud.google.com/apis/design) | A/B, official engineering guide | Free | Resource-oriented APIs, naming, methods, errors, long-running operations, compatibility, and common interface patterns. | Google conventions are influential but not mandatory; REST, GraphQL, events, gRPC, and domain constraints can require alternatives. | Living guide, used inside Google since 2014; checked 2026. |
| [NIST Cybersecurity Framework 2.0](https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20) | A, government cybersecurity framework | Free | Governing and communicating cybersecurity risk through a taxonomy of outcomes across Govern, Identify, Protect, Detect, Respond, and Recover, plus profiles and tiers. | Voluntary and intentionally non-prescriptive; it is not a control catalog, product certification, threat model, or proof that a particular implementation is secure. | NIST CSWP 29 published **February 26, 2024**; checked 2026-07-28. |
| [Secure by Design — CISA](https://www.cisa.gov/securebydesign) | A, government-led manufacturer guidance | Free | Moving responsibility upstream to technology manufacturers through customer-security outcomes, secure defaults, transparency, executive ownership, and measurable product improvement. | A living, voluntary US-led initiative with international partners, not a law, certification, complete secure-development lifecycle, or substitute for product-specific assurance. | Core joint principles refined in **October 2023**; initiative and related 2025 guidance checked 2026-07-28. |
| [NIST SP 800-82 Revision 3: Guide to Operational Technology Security](https://csrc.nist.gov/pubs/sp/800/82/r3/final) and [SP 1339: OT Backup Quick Start Guide](https://csrc.nist.gov/pubs/sp/1339/final) | A, government OT security guidance | Free | Threat modeling and securing industrial control, building automation, transportation, physical-access, and other cyber-physical systems while preserving distinct performance, reliability, and safety requirements; integrating backups with change management, recurring creation, restoration tests, and recovery exercises. | Voluntary cross-sector guidance, not a safe-cutover plan, certification, or authority to change a live plant. System owners, safety engineering, operations, vendors, regulators, site evidence, rollback, and tested recovery govern an actual transition. | SP 800-82r3 final published **September 2023**; a July 2024 planning note is not an official change and Revision 4 remained draft work. SP 1339 final published **June 17, 2026**; both checked 2026-07-28. |
| [Plant Modification and Change Procedures — UK Health and Safety Executive](https://www.hse.gov.uk/comah/sragtech/techmeasplantmod.htm) | A, government major-hazard technical guidance | Free | Formal management of change, traceable safety/engineering/technical review, remote plant effects, cross-functional authorization, HAZOP staging, pre-commissioning checks, post-operation audit, and safe commissioning or decommissioning. | Major-hazard and process-plant guidance with dated references, not a software rollout checklist or universal legal rule. Competent site, engineering, operations, safety, quality, regulator, and equipment-owner procedures remain controlling. | Living technical-measures page showed an **August 19, 2025** page date and was checked 2026-07-28. |
| [OWASP Application Security Verification Standard](https://owasp.org/www-project-application-security-verification-standard/) | A/B, open security verification standard | Free | Testable application-security requirements, verification scope, secure-development acceptance criteria, procurement language, and versioned requirement identifiers. | Community standard rather than regulatory certification; tailor the verification level and controls to the threat model, architecture, data, jurisdiction, and independent testing needs. | Stable **ASVS 5.0.0** released May 30, 2025; pin `v5.0.0` identifiers because the project also publishes bleeding-edge material. |
| [Role-Based Access Control publications — NIST CSRC](https://csrc.nist.gov/Projects/Role-Based-Access-Control/publications) | A, government primary-research library | Free | Role engineering, role hierarchies, separation of duties, permissions, and the historical NIST RBAC model when designing enterprise authorization. | RBAC is one access-control model, not an organizational-authority map or complete authorization system. The library spans old publications and identifies a withdrawn 1995 bulletin, so cite the exact final item used. | Project page updated **March 4, 2026**; underlying listed work dates from 1992–2011. |
| [EU Data Act — Regulation (EU) 2023/2854](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R2854) | A, primary legal text | Free | Current EU rules relevant to in-scope connected-product data access and data-processing-service switching, open interfaces, interoperability, and parallel-provider use. | Complex, role- and service-specific law; portability is not identical to functional equivalence, implementation milestones can change, and qualified counsel is required. | Began applying **September 12, 2025**; official text checked 2026-07-28. |
| [EU Digital Services Act — Regulation (EU) 2022/2065](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2065) | A, primary legal text | Free | Online-platform interface duties, minors protection, transparency, and the additional systemic-risk framework for designated very large services. | Not every digital or consumer product is an online platform or VLOP. Article and service scope, national enforcement, and facts require legal analysis. | In full application since **February 2024**; official text and 2026 context checked 2026-07-28. |
| [Online safety regulatory documents and guidance — Ofcom](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/online-safety-regulatory-documents) | A, UK regulator guidance hub | Free | Current and superseded Online Safety Act risk-assessment guidance, risk profiles, codes, record-keeping guidance, content guidance, transparency, and enforcement materials. | UK service and duty scope is fact-specific; a PM must select the applicable document and version rather than treat this hub as a global moderation checklist or legal conclusion. | Page last updated **June 25, 2026**; several risk and record-keeping documents were updated that day. |
| [General Product Safety Regulation — Regulation (EU) 2023/988](https://eur-lex.europa.eu/eli/reg/2023/988/oj) | A, primary legal text | Free | EU general consumer-product safety duties, corrective action, recall communication and remedies, Safety Gate, online sales, and economic-operator responsibilities. | A legal safety net for in-scope consumer products, not the only applicable product rule. Sector legislation, role, product facts, national enforcement, and safe repair conditions require qualified analysis. | Entered into application **December 13, 2024**; official text checked 2026-07-28. |
| [Product safety and Safety Gate — European Commission](https://commission.europa.eu/business-economy-euro/doing-business-eu/eu-product-safety-and-labelling/product-safety_en) | A, regulator/government portal | Free | Finding the GPSR route, Safety Gate alerts for dangerous non-food products, business obligations, marketplace registration, and current EU product-safety services. | A navigation and operational portal, not a substitute for the legal text, sector-specific rules, recall investigation, competent authority, or legal advice. | Live Commission portal and redirect checked **July 28, 2026**. |
| [Right-to-repair Directive — Directive (EU) 2024/1799](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024L1799), [EU WEEE producer responsibilities](https://europa.eu/youreurope/business/product-rules-compliance/recycling-waste-management/weee-responsibilities/index_en.htm), and [Nixing the Fix — FTC report to Congress](https://www.ftc.gov/reports/nixing-fix-ftc-report-congress-repair-restrictions) | A, primary legal text and official regulator/government guidance and research | Free | Designing physical-product repair and retirement around safe repair, parts, tools, information, partner access, producer registration, collection/treatment financing, warranties, customer choice, unequal repair burdens, and end-of-life responsibility rather than equating app removal with closure. | EU Directive scope depends on product, fact, national transposition, and related legislation; WEEE responsibilities vary by role and Member State; the 2021 FTC report is US evidence and recommendations, not a universal duty or finding for every restriction. None justifies unsafe repair or supplies a synthetic warranty, spares, or support period. | FTC report issued **May 2021**; EU repair Directive entered into force July 30, 2024 with national application due July 31, 2026; WEEE page last checked June 12, 2026; routes checked 2026-07-28. |
| [Enhancing product recall effectiveness globally — OECD](https://www.oecd.org/en/publications/enhancing-product-recall-effectiveness-globally_ef71935c-en.html) | A, intergovernmental policy research | Free | Recall-response measurement, communication strategies, consumer awareness, cross-border co-operation, and the operational challenge of maximizing non-food recall impact. | A 2018 synthesis across authorities and businesses, not current law, a product-specific remedy decision, or a universal recall-response benchmark. | OECD Science, Technology and Industry Policy Paper No. 58 published **November 13, 2018**; checked 2026-07-28. |
| [Unfair Commercial Practices Directive — Directive 2005/29/EC](https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32005L0029) | A, primary legal text | Free | EU rules on misleading actions and omissions, aggressive practices, material transactional decisions, and protections for foreseeably vulnerable consumer groups. | The 2005 instrument has been amended and interpreted through later EU law and case law. Use the current consolidated text, national implementation, facts, and qualified advice rather than turning the average-consumer test into a UX score. | Original directive dated **May 11, 2005**; amended framework and official text checked 2026-07-28. |
| [Consumer Credit Directive — Directive (EU) 2023/2225](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023L2225) | A, primary legal text | Free | EU consumer-credit scope, pre-contractual information, creditworthiness, conduct, forbearance, debt advice, caps, and treatment of newer small or fast credit products. | Complex product, agreement, role, and Member-State scope. National measures and implementation must be checked, and current practice remains under the predecessor regime until the new measures apply. | Member States were due to transpose by November 20, 2025; measures apply from **November 20, 2026**, after this catalog's research cutoff. |
| [Consumer Trends Report 2024/25 — European Banking Authority](https://www.eba.europa.eu/publications-and-media/press-releases/eba-identifies-payment-fraud-indebtedness-and-de-risking-key-issues-affecting-consumers-eu) | A, EU supervisory-authority report | Free | Current regulator-reported signals on payment fraud, indebtedness, short-term credit, creditworthiness practices, de-risking, and access to payment accounts across the EU. | A biennial synthesis of authority, association, ombudsman, and indicator inputs; it does not identify a product's causal harm, establish compliance, or supply a universal risk threshold. | Ninth report and press release published **March 26, 2025**; actions referenced for 2025/26. |
| [Guidelines on arrears and foreclosure — European Banking Authority](https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/consumer-protection-and-financial-innovation/guidelines-arrears-and-foreclosure?phase=consolidated) | A, EU supervisory guidance | Free | Mortgage-credit arrears handling, reasonable forbearance, consumer engagement, documentation, and supervisory expectations before foreclosure. | Mortgage Credit Directive scope, not a generic rule for every consumer loan, reminder, or debt journey. The consolidated document is a documentation tool and national application still matters. | Current page consolidates **EBA/GL/2015/12** and **EBA/GL/2024/10**; checked 2026-07-28. |
| [European Accessibility Act — Directive (EU) 2019/882](https://eur-lex.europa.eu/eli/dir/2019/882/oj/eng) | A, primary legal text | Free | Accessibility requirements for specified products and consumer services, including consumer banking and e-commerce, plus economic-operator responsibilities and exceptions. | It does not cover every product or service, and legal conformity is not identical to usability. National transposition, harmonized standards, transition rules, scope, and qualified advice are required. | National measures began applying **June 28, 2025**; official text checked 2026-07-28. |
| [IETF standards-process guide](https://www.ietf.org/process/process/) | A, primary open-standards process; foundational [RFC 2026](https://datatracker.ietf.org/doc/rfc2026/), maturity update [RFC 6410](https://datatracker.ietf.org/doc/rfc6410/), modern-paradigm [RFC 6852](https://datatracker.ietf.org/doc/rfc6852/), and issue-based consensus discussion [RFC 7282](https://www.rfc-editor.org/info/rfc7282/) | Free | Technical quality, open review, affected interests, consensus, running-code evidence, independent interoperable implementations, due process, balance, transparent change control, and distinguishing addressed objections from a majority vote. | RFC 2026 has been amended and parts of its maturity/report model were superseded; RFC 7282 is Informational rather than a prescriptive process; use the current BCP 9 chain and process guide. Internet-standards practice does not dictate every commercial consortium's IP, funding, certification, security, or decision rights. | Current IETF guide and cited RFC status checked 2026-07-28. |
| [OWASP Top 10: 2025](https://owasp.org/Top10/) | A/B, open security standard project | Free | A current awareness baseline for web application risks: access control, misconfiguration, supply chain, cryptography, injection, insecure design, authentication, integrity, logging/alerting, and exception handling. | Awareness list, not a complete security program or threat model; rankings should not determine every product's risk priority. | Official **2025** release current in July 2026. |
| [OWASP Product Security Guide](https://owasp.org/www-project-product-security-guide/) | A/B, open security project | Free | Product-security organization, lifecycle practices, requirements, risk, and measurable capability beyond vulnerability lists. | Community project; organizations need qualified security review and context-specific controls. | Current project checked 2026. |
| [NIST Privacy Framework](https://www.nist.gov/privacy-framework) | A, government framework | Free | Identifying and managing privacy risk through governance, data processing awareness, control, communication, and protection. | Voluntary US framework, not legal compliance. Version status matters: 1.0 is stable while 1.1 was still an initial public draft in 2026. | Page checked 2026-07-28; verify 1.1 status before citing. |
| [EU Data Protection Legal Framework — European Commission](https://commission.europa.eu/law/law-topic/data-protection/legal-framework-eu-data-protection_en) | A, regulator/government | Free | Official entry point to GDPR, the Law Enforcement Directive, EU-institution rules, and enforcement bodies. | EU scope; obligations depend on role, data, jurisdiction, and facts. Use counsel, regulator guidance, and the legal text. | Live and current when checked in July 2026. |
| [GDPR Information for Businesses and Organizations — European Commission](https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations_en) | A, regulator/government | Free | Purpose, lawful processing, individual rights, security, breach duties, DPOs, and practical topic navigation. | Overview, not case-specific legal advice; national law and regulator decisions also matter. | Living official guidance checked 2026. |
| [General Data Protection Regulation — official EUR-Lex text](https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32016R0679) | A, primary legal text | Free | Reading the enacted EU provisions directly, including principles, lawful bases, consent conditions and withdrawal, rights, processing records, security, and accountability. | Complex role-, purpose-, fact-, and jurisdiction-dependent law; an article citation is not a product-specific legal conclusion, and qualified counsel plus current regulator/court guidance remain necessary. | Consolidated official text checked **July 28, 2026**. |
| [Guidelines 05/2020 on consent — European Data Protection Board](https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en) | A, official supervisory guidance | Free | Understanding GDPR consent conditions, granular choice, imbalance, specificity, informed/unambiguous action, and withdrawal where consent is actually the legal basis. | Does not establish that consent is the right basis for a particular product, validate a UI, or govern non-EU jurisdictions; case facts and later decisions matter. | Adopted **May 4, 2020**; official page live when checked 2026-07-28. |
| [Guidelines 8/2020 on targeting social media users — European Data Protection Board](https://www.edpb.europa.eu/documents/guideline/guidelines-82020-on-the-targeting-of-social-media-users_en) | A, official supervisory guidance | Free | Mapping actors, personal-data processing, legal bases, transparency, responsibility, and risks in social-media targeting arrangements. | GDPR-focused and context-dependent; it does not determine that a specific reminder campaign is lawful, accessible, fair, effective, or outside other consumer and credit rules. | Final version adopted **April 13, 2021**; checked 2026-07-28. |
| [NIST SP 800-218, Secure Software Development Framework 1.1](https://csrc.nist.gov/pubs/sp/800/218/final) | A, government secure-development framework | Free | Integrating preparation, protection, production, provenance, vulnerability response, and root-cause improvement practices into any software-development lifecycle. | Voluntary high-level practices, not a product security certification, complete threat model, legal compliance program, or substitute for context-specific controls and testing. | Final version published **February 2022**; checked 2026-07-28 while a later revision remained draft activity. |
| [NIST TN 2182: Distributed Energy Resource Security](https://www.nist.gov/publications/distributed-energy-resource-security-potential-guidelines-and-research-topics) | A, government primary research | Free | Testing the applicability of smart-grid cybersecurity controls to high-DER environments and identifying guidance updates and open research needs. | Based on stakeholder work and controls from NISTIR 7628 Revision 1; it is neither a current complete DER threat model nor product or grid certification. | NIST Technical Note 2182 published **October 6, 2021**; page updated November 29, 2022. |
| [NIST SP 1800-32: Securing Distributed Energy Resources](https://www.nccoe.nist.gov/publications/practice-guide/securing-distributed-energy-resources-nist-sp-1800-32-practice-guide) | A, government cybersecurity practice guide | Free | A worked architecture, security characteristics, and implementation guides for monitoring and protecting distributed energy resource environments. | An example solution using selected technologies, not a mandate, exhaustive architecture, legal assessment, procurement endorsement, or assurance that a deployment is secure. | Final practice guide published **February 2, 2022**; checked 2026-07-28. |
| [Due diligence for responsible business conduct — OECD topic hub](https://www.oecd.org/en/topics/sub-issues/due-diligence-guidance-for-responsible-business-conduct.html) | A, intergovernmental guidance hub | Free | Identifying, preventing, mitigating, tracking, communicating, and remediating adverse impacts in operations, supply chains, and business relationships with affected-stakeholder engagement, and routing to the underlying guidance and sector material. | A living topic hub rather than the 2018 guidance publication itself. Risk-based due diligence is not a generic supplier score, proof of compliance, or substitute for local labor, human-rights, environmental, consumer, contract, and sector advice. | Official living topic hub and linked guidance route checked **July 28, 2026**. |
| [UN Guiding Principles on Business and Human Rights — OHCHR](https://www.ohchr.org/sites/default/files/Documents/Publications/GuidingPrinciplesBusinessHR_EN.pdf) | A, UN-endorsed normative framework | Free PDF | Corporate responsibility to respect human rights, policy and due-diligence processes, severity and salience, business-relationship leverage, context conflict, tracking and communication, grievance mechanisms, and access to remedy. | Non-binding principles do not select a country-entry or exit decision, establish legal compliance, or prescribe a product control. Apply them with affected people, local expertise, qualified human-rights and legal owners, and current mandatory due-diligence law. | Endorsed by the UN Human Rights Council in **June 2011**; official OHCHR publication route checked 2026-07-28. |
| [Algorithmic Management Practices in Regular Workplaces — ILO and European Commission JRC](https://www.ilo.org/publications/algorithmic-management-practices-regular-workplaces-case-studies-logistics) | A, intergovernmental and government research | Free PDF | Comparative cases from logistics and healthcare in France, Italy, India, and South Africa; mapping workflow simplification and efficiency alongside worker surveillance, job-quality, work-organization, and industrial-relations risks. | Qualitative sector and country cases about algorithmic management, not evidence that every workforce app manages workers or causes the same effects. Apply the worker-impact questions proportionately and obtain local employment, privacy, safety, and representative input. | Joint report published **February 19, 2024**; official ILO route checked 2026-07-28. |
| [Retiring service components securely — UK Government Security](https://www.security.gov.uk/policy-and-guidance/secure-by-design/activities/retiring-service-components-securely/) | A, government security guidance | Free | Asset and dependency inventory, accountable retirement roles, risk assessment, backup/restore, data removal, inventory update, and formal close-out with residual-risk ownership. | UK government Secure by Design guidance; product teams must separately map user continuity, contracts, data/records law, platform behavior, vendors, and jurisdiction. | Updated **October 3, 2025**; checked 2026-07-28. |
| [Dark commercial patterns — OECD](https://www.oecd.org/en/publications/dark-commercial-patterns_44f5e846-en.html) | A, intergovernmental policy research | Free | A working definition, evidence on prevalence and harms, policy responses, and design-risk vocabulary for practices that steer, deceive, coerce, or manipulate consumer choices. | A cross-market policy synthesis, not a product-specific legal finding, causal estimate for one interface, or substitute for current jurisdictional law and user research. | OECD Digital Economy Paper No. 336 published **October 26, 2022**; checked 2026-07-28. |
| [Bringing Dark Patterns to Light — US Federal Trade Commission](https://www.ftc.gov/system/files/ftc_gov/pdf/P214800%20Dark%20Patterns%20Report%209.14.2022%20-%20FINAL.pdf) | A, regulator report | Free PDF | Concrete categories of manipulative interface practice and consumer-protection risk. | US regulator lens and 2022 examples; other jurisdictions use different definitions and rules. | Final staff report dated 2022; still useful, verify current enforcement separately. |
| [NIST SP 800-207: Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final) | A, government cybersecurity architecture | Free | Resource-focused access, continuous authentication and authorization, policy decision and enforcement components, trust-algorithm inputs, and zero-trust deployment models. | High-level federal guidance, not a product architecture, authorization model, implementation profile, security certification, or guarantee that every request is evaluated correctly. | Final publication released **August 11, 2020**; planning note updated April 2024; checked 2026-07-28. |
| [NIST SP 800-162: Guide to Attribute Based Access Control](https://csrc.nist.gov/pubs/sp/800/162/upd2/final) | A, government access-control guidance | Free | Defining ABAC decisions across subject, object, requested operation, environment, policy, attributes, and information-sharing needs. | Assumes trustworthy attributes and binding and does not solve identity proofing, relationship semantics, policy administration, revocation latency, leakage, or operational assurance by itself. | Published **January 2014**, including updates through **August 2, 2019**; checked 2026-07-28. |
| [Zanzibar: Google's Consistent, Global Authorization System](https://research.google/pubs/zanzibar-googles-consistent-global-authorization-system/) | A for the primary systems paper; B for transfer to another product | Free | Relationship-based authorization, causal ordering, consistent permission checks, data-model design, and a documented large-scale production architecture. | A 2019 first-party Google paper with historical internal performance claims; its scale, availability, latency, model, and operational choices do not transfer as guarantees. | Published at USENIX ATC **2019**; official research page live 2026-07-28. |
| [Elasticsearch security limitations](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-limitations.html) | A for current Elastic product behavior; B as general search-security guidance | Free | Checking document- and field-level-security limits, unsupported operations, index-statistics leakage, sensitive field or term inference, aliases, and async-search identity behavior before choosing a search architecture. | Living vendor documentation tied to product version, configuration, and licensing; it neither covers every leakage path nor proves a deployment secure, and the legacy URL currently redirects. | Current documentation reopened through its official redirect on **July 28, 2026**; recheck for every deployed version. |
| [Understanding data transfer charges — AWS Data Exports](https://docs.aws.amazon.com/cur/latest/userguide/cur-data-transfers-charges.html) | A for AWS billing semantics; B as general cost guidance | Free | Mapping in-region, inter-region, internet, Direct Connect, acceleration, and CDN traffic to usage types before modeling architecture cost. | AWS-specific living documentation; actual prices vary by service, region, direction, contract, and date, so it supplies charge paths rather than a reusable dollar-per-GB assumption. | Living AWS Billing documentation checked **July 28, 2026**. |
| [Aggregate data at the edge where possible — AWS Well-Architected IoT Lens](https://docs.aws.amazon.com/wellarchitected/latest/iot-lens/cost-effective-resources.html) | A for AWS architecture guidance; B as a general pattern | Free | Evaluating edge aggregation, message size and count, telemetry fidelity, loss consequences, lifecycle storage, and data-transfer trade-offs in IoT systems. | Vendor-specific, commercially aligned guidance; it does not establish that any reduction ratio is safe, that cloud transfer dominates total cost, or that raw evidence may be discarded. | Living IoT Lens guidance checked **July 28, 2026**. |
| [Apache Kafka documentation](https://kafka.apache.org/documentation/) and [Kafka 4.3 producer configuration](https://kafka.apache.org/43/configuration/producer-configs/) | A/B, official open-source project documentation | Free | Events, partitions, retention, replication and consumers, plus version-pinned producer batching, acknowledgements, retries, ordering, idempotence, compression, and transaction settings. | Broker and client versions, exact configuration, failure boundaries, sinks, and application semantics determine real behavior; producer idempotence is not end-to-end exactly-once business execution. | Official docs exposed the **4.3** branch when checked 2026-07-28; pin and test the deployed client and broker versions. |
| [NIST IR 8259 Revision 1](https://csrc.nist.gov/pubs/ir/8259/r1/final), [NISTIR 8259 IoT cybersecurity series](https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-program/nistir-8259-series), [NISTIR 8259A device capability baseline](https://csrc.nist.gov/pubs/ir/8259/a/final), and [NIST IoT program FAQs](https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-program/faqs) | A, government IoT guidance | Free | Manufacturer premarket and lifecycle activities plus a core device baseline covering identification, configuration, data protection, interface access, software update, cybersecurity-state awareness, customer information, support expectations, and risk-based retirement. | Common starting points that require product, use-case, threat, customer, privacy, safety, support, and jurisdiction tailoring; the series is not certification, a warranty duration, a parts plan, an end-of-life date, or proof that field controls work. | IR 8259 Revision 1 final **April 9, 2026**; series page updated May 14, 2026; 8259A remains the May 2020 final; living FAQ and all routes checked 2026-07-28. |
| [EDPB Guidelines 4/2019 on Data Protection by Design and by Default](https://www.edpb.europa.eu/documents/guideline/guidelines-42019-on-article-25-data-protection-by-design-and-by-default_en) | A, official EU supervisory guidance | Free | Translating GDPR Article 25 into lifecycle design, effective measures, data minimization, default settings, accountability, state of the art, cost, context, and risk considerations. | EU/GDPR and controller-focused, fact-dependent guidance; it does not determine role, lawful basis, architecture, retention period, or compliance for a specific product. | Final version adopted **October 20, 2020**; official page live 2026-07-28. |
| [ETSI EN 303 645 V3.1.3: Cyber Security for Consumer IoT](https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf) | A, European standard | Free PDF | Outcome-focused baseline provisions for consumer connected devices and associated services, including credentials, vulnerability handling, updates, secure communication, attack surface, resilience, telemetry, deletion, and data protection. | Consumer-IoT scope excludes devices primarily for manufacturing, healthcare, or other industrial use; ETSI states that the baseline does not solve every security, privacy, or data-protection challenge or itself assure a product. | Version **3.1.3**, adopted September 11, 2024; conflicting national standards were due for withdrawal by June 30, 2025; checked 2026-07-28. |
| [How to test frontend performance — GOV.UK Service Manual](https://www.gov.uk/service-manual/technology/how-to-test-frontend-performance) | A, government service guidance | Free | Treating speed and page weight as inclusion and whole-team product metrics, setting early request, size, or load-time budgets, testing across devices, and measuring before and after changes. | Stable but dated introductory guidance; it supplies no universal page-weight target, simulated profile, user task, or proof that a service is accessible or fast in the field. | Published May 21, 2018 and last updated **March 14, 2019**; reopened 2026-07-28. |
| [Chrome DevTools throttling](https://developer.chrome.com/docs/devtools/settings/throttling/) and [Device Mode](https://developer.chrome.com/docs/devtools/device-mode) | A for Chrome tool behavior; B as test-method guidance | Free | Creating controlled network and CPU profiles, simulating viewport and sensors, diagnosing constrained-device behavior, and separating repeatable lab work from real-device validation. | Chrome simulation is an approximation; Device Mode does not run code on mobile hardware, presets can mask population variation, and field data plus representative physical devices remain necessary. | Throttling page updated **April 16, 2024** and Device Mode **February 20, 2024**; checked 2026-07-28. |
| [Largest Contentful Paint](https://web.dev/articles/lcp) and [Interaction to Next Paint](https://web.dev/articles/inp) — web.dev | A for Chrome's metric definitions; B as general performance guidance | Free | Diagnosing perceived loading and interaction responsiveness, applying p75 field segmentation, and distinguishing stable Core Web Vitals from a product's complete task-success SLO. | Chrome-led guidance and thresholds are not normative accessibility rules, business-task measures, or guarantees for every browser, device, cohort, connection, or product journey. | LCP updated **September 4, 2025** and INP **September 2, 2025**; both stable metrics when checked 2026-07-28. |
| [RFC 9110: HTTP Semantics](https://www.rfc-editor.org/rfc/rfc9110) | A, IETF Internet Standard | Free | Current HTTP method semantics, safe and idempotent method properties, representations, conditional requests, status codes, fields, caching relationships, and interoperable API reasoning. | Protocol semantics do not create application-level idempotency, authorization, transactionality, retry safety, or a product API design by themselves; consult errata and related HTTP specifications. | Published **June 2022** as STD 97; RFC metadata refreshed May 20, 2026 and status checked 2026-07-28. |
| [ITU urban-rural Internet-use statistics](https://www.itu.int/itu-d/reports/statistics/2025/10/15/ff25-internet-use-in-urban-and-rural-areas/), [GSMA State of Mobile Internet Connectivity](https://www.gsma.com/somic/), [GSMA rural-connectivity analysis](https://www.gsma.com/connectivity-for-good/spectrum/gsma_resources/spectrum-and-rural-connectivity/), and [EU smartphone/tablet ecodesign regulation](https://eur-lex.europa.eu/eli/reg/2023/1670/oj) | A for official statistics and primary EU law; B for industry-association analysis | Free | Challenging smartphone substitution task by task across rural/urban connectivity, device affordability and skill, shared or managed-device context, repairability, parts, software support, security, accessibility, sensors, offline operation, and total lifecycle cost. | Internet use is not smartphone ownership or task readiness; association research is not regulator data; EU product law is not global fleet evidence. None validates a product's substitution rate, repair-cost increase, ruggedness, battery, worker permission, or safe workflow. | ITU 2025 edition, GSMA 2025/February 2026 material, and official EU text checked 2026-07-28. |
| [OpenAPI Specification 3.2.0](https://spec.openapis.org/oas/latest.html), [AsyncAPI Specification 3.1.0](https://www.asyncapi.com/docs/reference/specification/latest), and [CloudEvents 1.0.2](https://github.com/cloudevents/spec/tree/ce@v1.0.2) | A, official open API and event standards | Free | Converting an integration request into auditable HTTP, message-driven, and event-envelope contracts covering operations, schemas, examples, errors, channels, versioning, correlation, and developer-facing interoperability. | These standards do not define domain semantics, authorization, delivery guarantees, transactional boundaries, SLAs, or architecture choice. Tool support may lag the latest version, and event security and compatibility remain system-specific. | OpenAPI **3.2.0**, September 19, 2025; AsyncAPI **3.1.0**, January 2026; CloudEvents **1.0.2**, 2022; official routes checked 2026-07-28 and should be version-pinned. |
| [2017 Trust Services Criteria with Revised Points of Focus: 2022](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) | A, professional attestation criteria | Free resource page; document access may require an account | Enterprise assurance and procurement vocabulary across security, availability, processing integrity, confidentiality, and privacy; scoping control objectives and evidence before an independent SOC 2 examination. | SOC 2 is a CPA attestation report, not a generic certification or self-awarded badge. Criteria are not an implementation checklist; report type, system boundary, period, exceptions, complementary controls, and selected categories govern usefulness. | AICPA criteria revised with **2022** points of focus; official resource posted September 30, 2023 and checked 2026-07-28. |
| [IETF Idempotency-Key HTTP Header Field draft status record](https://datatracker.ietf.org/doc/draft-ietf-httpapi-idempotency-key-header/) | A for provenance and status; B as historical design input | Free | Studying a proposed client-generated idempotency-key field, uniqueness, expiry, fingerprinting, duplicate handling, and error patterns while designing an explicit application contract for retryable non-idempotent operations. | Revision `-07` is an **expired Internet-Draft**, not an RFC, Internet Standard, registry assignment, or current interoperable mandate. RFC 9110 does not standardize POST idempotency keys. A product must own key scope, payload binding, atomic persistence, concurrency, retention, response replay, authorization, and client behavior and should not advertise standards compliance from this draft. | Revision `-07` published **October 15, 2025** and expired April 18, 2026; Datatracker status checked 2026-07-28. |
| [RFC 9421: HTTP Message Signatures](https://www.rfc-editor.org/rfc/rfc9421.html) | A, IETF Standards Track specification | Free | Specifying which HTTP components are covered, signature parameters, key identifiers, algorithms, verification, proxy transformations, and freshness material for signed webhook delivery. | A valid message signature provides bounded authenticity and integrity evidence; it does not by itself establish authorization, consent, confidentiality, replay prevention, duplicate suppression, event order, business validity, key lifecycle, or delivery success. Threat-model the complete webhook system and consult errata. | Published **February 2024**; official RFC and status checked 2026-07-28. |
| [FOCUS Specification 1.4](https://focus.finops.org/focus-specification/) | A, open technology-billing specification | Free | Normalizing provider cost and usage evidence, invoice reconciliation, commitments, effective versus billed cost, allocation, corrections, completeness, and configuration so a build-buy comparison can be audited instead of relying on one blended vendor bill. | FOCUS standardizes supplied billing data; it does not ensure vendor adoption, data correctness, workload comparability, total cost, future price, engineering capacity, opportunity cost, exit cost, or accounting treatment. Adoption and extensions differ, and a schema cannot decide build versus buy. | Version **1.4** ratified June 4, 2026; official specification and adoption caveats checked 2026-07-28. |
| [NIST SP 800-161 Revision 1 Update 1](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final) | A, government cybersecurity supply-chain guidance | Free | Structuring supplier criticality, product and service risk assessment, visibility, provenance, contractual controls, monitoring, incident coordination, continuity, concentration, and exit in build-buy and managed-service decisions. | Voluntary cross-sector guidance, not certification, a universal questionnaire, proof of a supplier's controls, a procurement decision, or a substitute for technical testing, contract rights, sector rules, and qualified risk owners. Tailor the multilevel practices to the system and relationship. | Revision 1 published May 2022 and updated **November 1, 2024**; a December 2, 2025 planning note added a fillable scoping questionnaire. Official route checked 2026-07-28. |
| [PostgreSQL 18 logical replication](https://www.postgresql.org/docs/18/logical-replication.html) and [documented restrictions](https://www.postgresql.org/docs/18/logical-replication-restrictions.html) | A for version-pinned PostgreSQL behavior; B as a transferable migration mechanism | Free | Reasoning about initial snapshots, continuing changes, publications and subscriptions, replication identity, order, conflicts, monitoring, security, schema synchronization, sequences, large objects, and cutover prerequisites in tenant migrations. | PostgreSQL is an example, not a prescribed stack or a managed-service guarantee. Version, extensions, topology, write patterns, schema, large objects, sequences, foreign keys, conflicts, replication slots, permissions, and failover design must be tested. Logical replication does not validate copied business data or make rollback lossless. | PostgreSQL **18** was the current supported release while 19 Beta 2 existed on July 28, 2026; version-pinned pages checked that day. |
| [NIST SP 800-209 final](https://csrc.nist.gov/pubs/sp/800/209/final) and [Revision 1 initial public draft](https://csrc.nist.gov/pubs/sp/800/209/r1/ipd) | A, government storage-security guidance and clearly labeled draft | Free | Inventorying data and storage services, access, isolation, configuration, encryption and keys, monitoring, backup, replication, sanitization, resilience, and migration risks across storage infrastructure. | The October 2020 publication remains the final source; Revision 1 is an **initial public draft**, not final guidance. Neither source supplies migration throughput, validates a target architecture, guarantees recovery, or replaces workload tests, privacy and records analysis, vendor documentation, and current security review. | Final published **October 26, 2020**; Revision 1 IPD published **July 22, 2026** with comments due September 8, 2026. Official final page and indexed draft record checked 2026-07-28; the draft page failed one direct renderer request. |
| [WHO Global Patient Safety Action Plan 2021-2030](https://www.who.int/publications/i/item/9789240032705), [ABDM Health Data Management Policy](https://abdm.gov.in/static/media/health_management_policy_bac9429a79.80f74bc3e039c00acd4f.pdf), [ABDM acts and rules portal](https://abdm.gov.in/actrules), and [FHIR Implementation Guide for ABDM 6.5.0](https://www.nrces.in/ndhm/fhir/r4/) | A, intergovernmental safety strategy and official Indian health-data/interoperability sources | Free | Governing safety-critical workflow replacement through avoidable-harm reduction, clinician and patient involvement, consent and grievance continuity, federated health-data controls, versioned interoperability, rare-case compatibility, overrides, incident fallback, evidence, and exception review. | WHO sets global strategic direction, not Indian clinical approval. The 2020 ABDM policy is a guidance document with stated ecosystem scope and must be read with current law; the portal is an index. FHIR profiles structure exchange but do not prove semantic correctness, clinical safety, consent, privacy, accessibility, or implementation conformance. Current Indian legal, clinical, security, records, and professional-authority review remains mandatory. | WHO plan adopted in 2021; ABDM policy dated **December 2020**; implementation guide package `ndhm.in#6.5.0`, based on FHIR 4.0.1, generated May 8, 2025 and marked current published release when checked 2026-07-28. Do not substitute the July 2026 version 7 preview for the stable release without a status recheck. |

## 11. AI/ML product management, evaluation, safety, and regulation

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) | A, government framework | Free | Trustworthy-AI risk management across Govern, Map, Measure, and Manage; includes links to the Generative AI Profile. | Voluntary and not a compliance certificate. AI RMF 1.0 was under revision in 2026, so version every citation. | AI RMF 1.0 published January 2023; revision activity current in 2026. |
| [NIST AI RMF Playbook](https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook) | A, government implementation aid | Free | Suggested actions for operationalizing Govern, Map, Measure, and Manage. | Suggestions are not exhaustive or universally required; the playbook still referenced 1.0 while revision was underway. | Page updated **June 10, 2026**. |
| [Updated EU AI Model Contractual Clauses — Public Buyers Community](https://public-buyers-community.ec.europa.eu/communities/procurement-ai/resources/updated-eu-ai-model-contractual-clauses) | A/B, European public-procurement templates and commentary | Free in 24 EU languages | Turning AI risk, data, documentation, transparency, oversight, audit, monitoring, supplier duties, and change governance into negotiable contract schedules, with full high-risk and lighter customizable versions. | Designed for public organizations and not a complete contract: intellectual property, acceptance, payment, delivery, governing law, liability, service levels, exit, and product-specific requirements still need qualified drafting. Using the clauses does not establish AI Act scope or compliance. | Updated package released **March 2025** and translations completed June 2025; official community route checked 2026-07-28. |
| [Guidelines for AI Procurement — GOV.UK](https://www.gov.uk/government/publications/guidelines-for-ai-procurement/guidelines-for-ai-procurement) | A, government procurement guidance | Free | Market and model questions, limitations, data provenance, impact assessment, explainability, end-to-end logs, substantial-change reassessment, testing, handover, and supplier onboarding for public AI acquisition. | UK public-sector guidance published before the current generative-AI market and later regulation. It supplies due-diligence questions, not a complete contract, legal conclusion, model assurance, or permission to delegate product accountability. | Published **June 8, 2020**; official page and current availability checked 2026-07-28. |
| [NIST AI 600-1: Generative AI Profile](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf) | A, government AI-risk profile | Free PDF | Applying AI RMF functions to generative-AI risks and actions across governance, content provenance, pre-deployment testing, incident disclosure, measurement, and lifecycle management. | Voluntary, cross-sector guidance rather than a compliance certificate, complete evaluation plan, model assurance, or legal conclusion; it explicitly describes its considerations as non-exhaustive. | Final NIST AI 600-1 published **July 2024**; checked 2026-07-28. |
| [Recommendation on the Ethics of Artificial Intelligence — UNESCO](https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence) | A, intergovernmental normative instrument | Free | Human-rights and dignity framing, impact assessment, inclusive governance, monitoring, redress, digital divides, cultural and linguistic context, education, environment, and stakeholder participation. | A 2021 recommendation to Member States, not directly applicable product law, certification, a model benchmark, or proof that a deployment is ethical. Translate it into jurisdiction- and context-specific controls with affected communities. | Adopted by UNESCO's General Conference **November 23, 2021**; official text checked 2026-07-28. |
| [OWASP Top 10 for LLM Applications: 2025](https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/) | A/B, open security project | Free | Prompt injection, sensitive information, supply chain, poisoning, output handling, agency, system prompt leakage, vector/embedding weaknesses, misinformation, and unbounded consumption. | Awareness taxonomy, not a complete AI safety, privacy, or governance program. Threats change rapidly. | Official **2025** edition current in July 2026. |
| [Machine Learning Crash Course — Google](https://developers.google.com/machine-learning/crash-course) | A/B, official technical course | Free | Core ML concepts, data, classification, neural networks, embeddings, LLMs, production ML, and fairness. | Google tools and examples; a course cannot replace experimentation, product discovery, domain expertise, or production experience. | Refreshed/current in 2025–2026. |
| [Production ML Monitoring — Google ML Crash Course](https://developers.google.com/machine-learning/crash-course/production-ml-systems/monitoring) | A/B, official technical guidance | Free | Real-world metrics, slices, training-serving skew, leakage, model age, live quality, and monitoring responsibilities. | Introductory production overview; generative and agentic systems need task-specific evaluation, security, and trace instrumentation. | Current documentation checked 2026. |
| [Define Success Criteria and Build Evaluations — Anthropic](https://platform.claude.com/docs/en/test-and-evaluate/develop-tests) | A for platform docs; B as general method | Free | Specific measurable criteria, task-relevant test cases, edge cases, automated grading, human judgment, latency, privacy, style, and cost. | Claude-oriented vendor documentation; model-based graders can share biases and need calibration against humans. | Living documentation checked July 2026. |
| [Evaluation Best Practices — OpenAI](https://developers.openai.com/api/docs/guides/evaluation-best-practices) | A for platform docs; B as general method | Free | Defining criteria, representative datasets, grading strategies, continuous evaluation, and error-driven iteration. | Product-specific and changing. The page warned that the then-current Evals platform would become read-only October 31 and shut down November 30, 2026; use the current workflow when implementing. | Checked **July 28, 2026**; deprecation makes near-term recheck mandatory. |
| [Working with Evals — OpenAI](https://developers.openai.com/api/docs/guides/evals) | A, vendor documentation | Free | Describing a task, running on test inputs, analyzing results, and iterating within OpenAI tooling. | Same platform-deprecation warning as above; conceptual method remains useful but implementation details are volatile. | Checked **July 28, 2026**; recheck before use. |
| [People + AI Guidebook — Google PAIR](https://pair.withgoogle.com/guidebook-v2/) | B, first-party human-AI design guide | Free | Deciding whether AI adds value, mental models, explainability, feedback and control, errors, and human-centered AI interactions. | Design guidance rather than a safety standard or evaluation protocol; examples may lag frontier capabilities. | Version 2 site live in 2026. |
| [EU AI Act — European Commission](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) | A, regulator/government | Free | Official risk-based framework, roles, prohibited practices, GPAI and transparency duties, governance, and implementation timeline. | Highly time-sensitive and legally complex. Read the regulation, official guidance, and qualified counsel for an actual product. | Page updated **July 7, 2026**; the AI Omnibus entered force **July 27, 2026**, changing high-risk timelines. |
| [Navigating the AI Act — European Commission](https://digital-strategy.ec.europa.eu/en/faqs/navigating-ai-act) | A, regulator FAQ | Free | Current applicability, dates, definitions, governance, standards, and implementation questions. | FAQ simplifies a large regulation and can change after political or standards developments. | Updated through **July 27, 2026** when checked. |
| [OECD AI Principles](https://www.oecd.org/en/topics/sub-issues/ai-principles.html) | A, intergovernmental standard | Free | Human rights, transparency, robustness, accountability, inclusive growth, and recommendations for trustworthy AI. | High-level principles, not product controls, technical tests, or jurisdiction-specific law. | Adopted 2019 and updated **2024** for generative AI, safety, information integrity, and sustainability. |
| [NIST AI 800-3: Expanding the AI Evaluation Toolbox with Statistical Models](https://www.nist.gov/news-events/news/2026/02/new-report-expanding-ai-evaluation-toolbox-statistical-models) | A, government measurement research | Free | Separating fixed-benchmark from generalized accuracy, stating evaluation assumptions and estimands, quantifying uncertainty, repeated trials, and considering generalized linear mixed models for benchmark analysis. | A statistical evaluation contribution, not a universal scoring formula, product threshold, causal field result, or endorsement of the 22 evaluated commercial systems; model assumptions still need checking. | Report announced **February 19, 2026**; NIST page updated March 18, 2026 and checked 2026-07-28. |
| [NIST AI 800-2 Initial Public Draft](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.800-2.ipd.pdf) and [NIST draft announcement](https://www.nist.gov/news-events/news/2026/01/towards-best-practices-automated-benchmark-evaluations) | A for provenance; B as draft government evaluation guidance | Free | Defining an automated benchmark's measurement target, task and scaffolding settings, tools, execution environment, stopping and resource budgets, number of attempts and trials, scoring, uncertainty, reproducibility, and reporting for language-model and agent evaluations. | An **initial public draft**, not a final NIST publication, system-safety standard, product acceptance threshold, field outcome, or certification. Automated benchmarks can omit real permissions, irreversible effects, people, recovery, adversaries, changing environments, and operational capacity; agent evaluations need deployment-specific end-task and harm evidence. | Initial Public Draft issued **January 30, 2026**; public-comment period closed March 31, 2026; draft status and routes checked 2026-07-28. |
| [BhashaDaan contribution terms](https://bhashini.gov.in/bhashadaan/en/terms-and-conditions), [AIKosh Kathbath dataset record](https://aikosh.indiaai.gov.in/home/datasets/details/bengali_multilingual_speech_recognition_dataset_kathbath.html), and [Lok Sabha Unstarred Question 486](https://sansad.in/getFile/loksabhaquestions/annex/186/AU486_qctfVt.pdf?source=pqals) | A, Indian government program, repository, dataset-record, and parliamentary sources | Free; some pages/previews may require JavaScript or registration | Inspecting the stated contribution purpose and licensing route; checking a versioned Indian speech dataset's task, language, license, organization, files, and benchmark label; and locating dated official statements about available language-model and corpus categories before designing a consented dialect/device/noise/task benchmark. | Contribution terms, repository metadata, and parliamentary reporting do not establish that a dataset is representative, consent-valid for a new purpose, leakage-free, correctly transcribed, safe, complete by dialect/device/task, or fit for a production decision. Licenses and contribution terms vary by dataset and version. Reproduce inventory claims from the dated source and audit the actual files, provenance, rights, speakers, splits, labels, access controls, and limitations. | BhashaDaan page exposes terms effective **April 1, 2021** and is JavaScript-dependent; Kathbath record showed version 1 and CC BY-SA 4.0; Lok Sabha answer dated **December 3, 2025**; all three routes returned HTTP 200 and were checked 2026-07-28. |
| [Guidelines for Secure AI System Development — UK NCSC and international partners](https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development) | A, government-led international security guidance | Free | Secure design, development, deployment, operation, maintenance, threat modeling, supply-chain controls, asset and technical-debt management, monitoring, updates, incident preparation, and responsible release. | Provider-focused lifecycle guidance rather than a model-quality benchmark, complete threat model, compliance standard, or certification; adapt it to the actual architecture, user harm, and jurisdiction. | Version **1.0**, published and reviewed November 27, 2023; live when checked 2026-07-28. |
| [Model versioning in Microsoft Foundry Models](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/model-versions?view=foundry-classic) | A for current Azure platform behavior; B as general lifecycle guidance | Free, though the page can request authorization | Separating model and API versions, selecting deployment update policy, identifying automatic-upgrade behavior, testing new versions, migration planning, notices, retirement, and rollback boundaries. | Living vendor documentation whose stated upgrade guidance is scoped to Standard deployments; model, provider, region, deployment type, contract, and policy can change, and a platform option does not guarantee a behavioral pin. | Page last updated **July 24, 2026**; checked 2026-07-28. |
| [Amazon Bedrock model lifecycle](https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html) | A for current AWS platform behavior; B as general lifecycle guidance | Free | Distinguishing Active, Legacy, extended-access, and End-of-Life states; mapping notices, availability, migration ownership, pricing changes, model IDs, regional differences, and failure after retirement. | Living AWS- and model-specific documentation; dates can differ from model-provider dates, tables change frequently, and migration is not automatic or a guarantee of equivalent behavior. | Current lifecycle page and dated model table checked **July 28, 2026**; recheck before every release or migration. |
| [Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks — Lewis et al.](https://papers.neurips.cc/paper_files/paper/2020/hash/6b493230205f780e1bc26945df7481e5-Abstract.html) | A, primary peer-reviewed research | Free | The original named RAG formulation combining parametric and non-parametric memory, retrieval-conditioned generation, provenance motivation, and the distinction between sequence- and token-conditioned retrieval. | A 2020 Wikipedia-index research setup, not evidence for today's proprietary models, enterprise corpus, passage count, latency, citation faithfulness, authorization, safety, or production performance. | NeurIPS **2020** paper; stable official proceedings page checked 2026-07-28. |
| [RAGAs: Automated Evaluation of Retrieval Augmented Generation — Es et al.](https://aclanthology.org/2024.eacl-demo.16/) | A, primary peer-reviewed system-demonstration paper | Free | Decomposing RAG evaluation into retrieval relevance and focus, generation faithfulness, and answer quality, with a reference-free automated metric framework. | Automated metrics and model-based judgments are not human ground truth, product assurance, or proof of downstream correctness; validate them against representative, independently adjudicated errors and current implementations. | EACL **2024** system demonstration, pages 150–158; official ACL Anthology page checked 2026-07-28. |
| [Artificial Intelligence Act — Regulation (EU) 2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) | A, primary legal text | Free | Reading the enacted EU AI rules directly, including roles, prohibited practices, risk classification, high-risk duties, transparency, GPAI, governance, enforcement, fundamental-rights impact assessment, and human oversight. | Highly complex, role-, system-, purpose-, date-, and jurisdiction-dependent law; never infer classification or compliance from a summary, and read the amended consolidated position with qualified counsel. | Entered into force **August 1, 2024**; application is phased and timelines were amended by Regulation 2026/1744, checked 2026-07-28. |
| [Digital Omnibus on AI — Regulation (EU) 2026/1744](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32026R1744) | A, primary amending legal text | Free | Current amendments to the AI Act, including revised high-risk application timelines, governance alignment, smaller-company treatment, testing and sandboxes, procedures, and related aviation and machinery regulation changes. | A new amending instrument, not a complete consolidated AI Act or product-specific legal conclusion; transitional provisions, delegated acts, standards, guidance, national enforcement, and facts must still be mapped. | Published **July 24, 2026** and entered into force **July 27, 2026**; verified 2026-07-28. |
| [Canada Directive on Automated Decision-Making](https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592) and [Algorithmic Impact Assessment tool](https://www.canada.ca/en/government/system/digital-government/digital-government-innovations/responsible-use-ai/algorithmic-impact-assessment.html) | A, official federal policy instruments | Free | Impact-level assessment, accessible publication, testing, bias and rights review, monitoring, documentation, explanation, human involvement, contingency, recourse, scheduled reassessment, and material-change governance for automated administrative decisions. | Canadian federal institutional and administrative-decision scope, not global law or a portable ethics score; low scores and mitigation points do not prove safety, fairness, legality, or suitability elsewhere. | Directive modified **June 24, 2025**; AIA guidance updated **May 28, 2026**; checked 2026-07-28. |
| [Algorithmic Transparency Recording Standard Hub — GOV.UK](https://www.gov.uk/government/collections/algorithmic-transparency-recording-standard-hub) | A, government transparency standard and guidance | Free | Publishing understandable records of how and why public bodies use algorithmic tools, with a template, completion guidance, scope and exemptions policy, and searchable examples. | Mandatory scope is limited to specified UK government departments and qualifying arm's-length bodies; transparency records do not prove legality, accuracy, fairness, accessibility, or meaningful remedy. | Published January 5, 2023; hub and template last updated **May 8, 2025**; checked 2026-07-28. |
| [Council of Europe Framework Convention on Artificial Intelligence](https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence) | A, official treaty source | Free | Human-rights, democracy, and rule-of-law principles; documentation, notice, challenge, complaint, safeguards, iterative risk and impact assessment, mitigation, oversight, and international governance. | Binding effect depends on ratification, entry into force, party status, declarations, scope choices, and domestic implementation; it is not universal product law or a technical evaluation standard. | Opened for signature **September 5, 2024**; the live page showed the EU as the sole Party at the July 28, 2026 cutoff, so status must be rechecked. |
| [Model Cards for Model Reporting: Mitchell et al.](https://research.google/pubs/model-cards-for-model-reporting/) and [Datasheets for Datasets: Gebru et al.](https://www.microsoft.com/en-us/research/publication/datasheets-for-datasets/) | A, peer-reviewed original documentation frameworks | Free publication records; article access varies | Creating model or system records for intended uses, excluded uses, evaluation procedures, subgroup results, limitations, and ethical considerations, alongside dataset motivation, composition, collection, preprocessing, distribution, use, and maintenance. | Documentation is disclosure, not validation, audit, safety, fairness, or fitness proof. Static cards drift; generative and agentic systems need system-level evaluation, provenance, incidents, dependencies, human controls, and continuous updates beyond the original supervised-ML framing. | Model Cards published at FAT* **2019**, pp. 220-229; Datasheets published in *CACM* **64(12), December 2021**, pp. 86-92; official research records checked 2026-07-28. |

## 12. Leadership, teams, writing, and current interview guidance

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [Risk communication, community engagement and infodemic management in humanitarian emergencies](https://www.who.int/europe/publications/i/item/WHO-EURO-2026-13295-53069-82872) and [WHO RCCE hub](https://www.who.int/emergencies/risk-communications) | A, intergovernmental operational guidance | Free | Two-way, community-centered crisis communication; local listening, uncertainty, protective action, accessible evidence, rumor and information-risk management, coordination, feedback, and adaptation across hazards. | Health and humanitarian emergency scope, with the 2026 tool derived from WHO European-region experience. It is not a corporate incident script, press strategy, political authority, or proof that a message is trusted; affected communities and local responders retain essential knowledge. | Operational tool published **April 22, 2026**; living RCCE hub checked 2026-07-28. |
| [OCHA Data Responsibility Guidelines 2025](https://centre.humdata.org/data-responsibility-guidelines-2025/) | A, UN humanitarian data guidance | Free | Safe, ethical, effective management of personal and non-personal operational data; assigning data-risk decisions, minimization, sharing boundaries, incident handling, and accountable stewardship during humanitarian action. | OCHA-scoped operational guidance, not a legal basis, universal retention schedule, security certification, or permission to publish sensitive beneficiary or partner information. Map organization policy, affected-party risk, local authority, and applicable law. | January 2025 revision published on the official Centre for Humanitarian Data route **February 20, 2025**; checked 2026-07-28. |
| [UNHCR Operational Guidance on Accountability to Affected People](https://www.unhcr.org/what-we-do/data-and-publications/handbooks-and-toolkits/aap-operational-guidance) and [IFRC Community Engagement and Accountability Toolkit](https://www.ifrc.org/document/cea-toolkit) | A/B, humanitarian operational guidance and toolkit | Free | Turning participation, inclusion, communication, transparency, feedback, response, learning, channel selection, community meetings, monitoring, emergency plans, and exit into funded operating mechanisms. | Institutional guidance designed for contextual adaptation; it is not evidence that a channel reaches every group, that a consultation transfers authority, or that an organization is accountable. Validate language, disability, power, safety, connectivity, representation, and response closure locally. | UNHCR guidance published **September 2020**; living IFRC toolkit and both official routes checked 2026-07-28. |
| [UNHCR Ethical Communications Guidelines](https://www.unhcr.org/publications/unhcr-ethical-communications-guidelines) and [ICRC Ethical Content-Gathering for Public Communications](https://www.icrc.org/en/publication/ethical-content-gathering-public-communications) | A/B, humanitarian institutional ethics guidance | Free | Dignity, do-no-harm editorial decisions, stereotypes and bias, affected-person voice, informed-consent dialogue, content choice, distribution, storage, withdrawal and accountability when gathering or publishing crisis stories. | Forced-displacement and armed-conflict institutional contexts; a template or signed form is not automatically informed, safe, revocable, representative, or lawful. Local protection expertise and the person's welfare outrank a communications asset. | UNHCR guidelines dated **December 2024**; ICRC guidelines finalized June and published **July 8, 2024**; checked 2026-07-28. |
| [Governance principles for agile service delivery — GOV.UK](https://www.gov.uk/service-manual/agile-delivery/governance-principles-for-agile-service-delivery) | A for documented UK government practice; B as a cross-domain pattern | Free | Giving service teams bounded decision authority, making evidence-based decisions at the right level, defining escalation, using light-touch sampling, reviewing little and often, and keeping governance tied to outcomes. | Stable but dated UK public-service guidance, not evidence that every executive review is waste or a complete research/safety/legal delegation model. Authority must match competence, risk, accountability, and applicable controls. | Published February 22 and last updated **May 23, 2016**; reopened 2026-07-28. |
| [What each role does in a service team](https://www.gov.uk/service-manual/the-team/what-each-role-does-in-service-team) and [how user research improves service design](https://www.gov.uk/service-manual/user-research/how-user-research-improves-service-design) — GOV.UK | A for documented UK government delivery practice; B as a cross-context operating pattern | Free | Turning already-collected evidence into an executable multidisciplinary delivery contract: preserving inclusive user evidence, distinguishing findings from requirements, assigning product, service, delivery, research, design, engineering, quality, performance, operations, and architecture responsibilities, and surfacing unresolved assumptions rather than voting them away. | The role set and “must” language are scoped to UK government service teams. A role list is not a universal RACI, staffing ratio, security review, implementation plan, acceptance contract, or proof that research evidence is valid; real authority, accountability, specialist assurance, and local organization design still govern. | Roles page updated **November 6, 2023**; research introduction is living guidance; both routes checked 2026-07-28. |
| [Loosely coupled teams](https://dora.dev/capabilities/loosely-coupled-teams/) and [software delivery performance metrics](https://dora.dev/guides/dora-metrics/) — DORA | A/B, first-party research-program synthesis | Free | Connecting team and technical boundaries to approval dependence, coordinated releases, testing dependence, handoffs, wait time, upstream effects, independent deployability, throughput, recovery, and deployment rework. | DORA reports predictors and cross-context research, not a causal guarantee for one reorganization. The metrics are application/service-level signals, can be gamed, and should not be blended into a league table across unlike teams; customer outcomes, reliability, cognitive load, and qualitative evidence remain necessary. | Metrics guide last updated **January 5, 2026**; capability and research routes checked 2026-07-28. |
| [Board responsibilities — G20/OECD Principles of Corporate Governance 2023](https://www.oecd.org/en/publications/g20-oecd-principles-of-corporate-governance-2023_ed750b30-en/full-report/component-8.html) | A, intergovernmental governance principles | Free | Board accountability, strategy and risk oversight, clear management accountability, executive selection and monitoring, CEO/key-executive succession, contingency, business continuity, talent development, and transparent nomination. | High-level principles across diverse jurisdictions, ownership structures, and board systems; they do not appoint an interim leader, allocate founder equity, settle grief-sensitive communications, or replace company law, governing documents, fiduciary advice, and human judgment. | 2023 edition; official full-text route and succession provisions checked 2026-07-28. |
| [Understand Team Effectiveness — Google re:Work](https://rework.withgoogle.com/en/guides/understanding-team-effectiveness) | A/B, first-party organizational research | Free | Project Aristotle findings: psychological safety, dependability, structure/clarity, meaning, and impact. | Observational internal research across Google teams; do not treat the factors as universal causal laws or use safety without accountability. | Living guide checked 2026. |
| [Core Humanitarian Standard on Quality and Accountability 2024](https://handbook.corehumanitarianstandard.org/en/chs/2024/) | A/B, multi-organization humanitarian standard | Free | Power-aware stakeholder participation, accessible communication, locally led decisions, do-no-harm analysis, safe complaints, complementary partnerships, feedback-driven adaptation, capable teams, and ethical resource allocation in crisis and vulnerability contexts. | Humanitarian scope is not ordinary product management, and applying the commitments is not the same as verified conformity. Transfer the accountability questions only with community, safeguarding, technical, legal, and local-context expertise. | Second edition launched **March 2024** after a stated two-year consultation with more than 4,000 contributors; interactive standard checked 2026-07-28. |
| [Structured Interviews — U.S. Office of Personnel Management](https://www.opm.gov/policy-data-oversight/assessment-and-selection/structured-interviews/structured-interviews.pdf) | A, government selection-method guide | Free PDF | Tying questions to job analysis and competencies; separating behavioral from situational questions; eliciting situation/task, personal action, and result; predefining neutral probes; building behaviorally anchored rating scales; and treating candidates consistently. | Written for U.S. federal selection and interview designers, not a PM-company scorecard or proof that past behavior perfectly predicts future performance. Candidates should use its probe model to clarify genuine evidence, not script an invented story. | Official 52-page OPM guide reopened and page-level content checked 2026-07-28; preserve the file and access date because the PDF does not expose a clear edition date. |
| [How to Apply: Job Interviews — UK Home Office Careers](https://careers.homeoffice.gov.uk/transcript/how-to-apply-job-interviews-transcript/) | A for this employer's candidate guidance; B as a general answer pattern | Free | Selecting examples against the stated criteria, using STAR, making personal contribution and difference explicit, adapting a prepared example to the actual question, pausing, and requesting reasonable adjustments. | UK Home Office process guidance, not a universal PM interview format or scoring rule. STAR improves evidence order but cannot compensate for a weak, unverifiable, or irrelevant example. | Living careers transcript checked 2026-07-28. |
| [Product Manager Interview Prep — Amazon Jobs](https://www.amazon.jobs/content/en/how-we-hire/product-manager-interview-prep) | A, current employer guidance | Free | Official role scope, traits, writing, stakeholder management, behavioral Leadership Principles, and loop structure. | Amazon-specific. Memorized Leadership Principle stories without product judgment will underperform, and process details can change. | Current when checked **July 28, 2026**. |
| [Meta Product Management Interview Prep Guide](https://d3no4ktch0fdq4.cloudfront.net/public/course/files/Meta_PM_interview_guide.pdf) | A if provenance is accepted; otherwise B | Free PDF | Product Sense, Analytical Thinking, Leadership and Drive, plus sample structures and evaluation dimensions. | The public artifact is circa 2021–2022 and hosted on CloudFront rather than a current Meta Careers page. Treat process details as stale and verify with the recruiter. | Historical guide; **not a current-process authority** in 2026. |
| [Microsoft Hiring Tips](https://careers.microsoft.com/v2/global/en/hiring-tips) | A, employer guidance | Free | Current general preparation, role examples, approach, skills translation, and interview expectations. | Not PM-specific and not an interview-question framework. | Current Careers page checked 2026. |
| [Amazon Product Management Ebook](https://d1.awsstatic.com/executive-insights/en_US/product-management-ebook.pdf) | B, first-party practitioner material | Free PDF | Working Backwards, customer focus, and product lifecycle concepts in Amazon/AWS language. | Promotional and curated; examples do not establish superiority or expose the full organization. | Available in 2026; record the PDF version/date when used. |
| [Results from TALIS 2024: The demands of teaching — OECD](https://www.oecd.org/en/publications/results-from-talis-2024_90df6235-en/full-report/the-demands-of-teaching_0e941e2f.html) | A, intergovernmental survey evidence | Free | Cross-system evidence on teacher workload, lesson planning, marking, administration, experience, and variation in professional context when evaluating education-product routines. | Self-reported, weighted survey aggregates with non-response and comparability cautions; task-hour sums can exceed the separately reported total. They do not set a product cadence or establish causality. | TALIS 2024 report published **October 7, 2025**; checked 2026-07-28. |
| [Recommendation concerning the Status of Teachers — UNESCO/ILO](https://www.unesco.org/en/legal-affairs/recommendation-concerning-status-teachers?hub=70224) | A, intergovernmental normative instrument | Free | Teachers' professional role, academic freedom, participation in materials and methods, supportive supervision, conditions of work, and responsibilities when designing education products. | A 1966 international recommendation across diverse national systems, not current local employment law or automatic product requirements; the text was under formal revision in 2026. | Adopted **October 5, 1966**; official text and revision status checked 2026-07-28. |
| [Revision of the 1966 and 1997 teaching-personnel Recommendations — UNESCO](https://www.unesco.org/en/articles/unesco-revises-landmark-1966-and-1997-recommendations-status-teaching-personnel) | A, official instrument-status update | Free | Determining which teacher-status text is currently adopted, what the 2026 consultation covers, and when revised instruments are expected rather than presenting an in-progress draft as final. | A process and status page, not a new adopted recommendation. The existing instruments remain the reference until the stated intergovernmental and General Conference decisions occur. | Published June 5 and updated **July 23, 2026**; adoption steps are scheduled through 2027. |
| [Plain Language Guide Series: U.S. GSA](https://digital.gov/guides/plain-language), [Data visualisation: charts](https://analysisfunction.civilservice.gov.uk/policy-store/data-visualisation-charts/), and [Charts: a checklist](https://analysisfunction.civilservice.gov.uk/policy-store/charts-a-checklist/) from the UK Government Analysis Function | A, government communication and statistical-presentation guidance | Free | Writing for the audience and testing comprehension; choosing a chart for the statistical relationship; using direct labels, sources, uncertainty, accessible alternatives, and restrained visual structure in metrics, experiments, RCA, strategy, and executive decisions. | Government-publication guidance does not replace statistical review, accessibility testing, user comprehension research, local disclosure requirements, or an organization's narrative and brand. Clear prose cannot rescue weak evidence. | GSA living migrated guide and UK guidance published **May 19, 2022** with checklist **May 2, 2023**; all official routes checked 2026-07-28. |

## 13. Guesstimate, market-sizing, and public-data sources

### Method and calibration

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [Fermi Problems — UC Berkeley Sense & Sensibility & Science](https://sensibility.berkeley.edu/index.php/8.2_Fermi_Problems) | A/B, university educational resource | Free | Decomposing an unknown into estimable quantities, dimensional reasoning, orders of magnitude, and causal importance. | Educational examples are not PM market models; add a business decision, uncertainty, and source replacement plan. | Site current when checked 2026. |
| [Fermi Competition](https://fermi.org/) | B, educational nonprofit/community | Free | Practice problems, confidence intervals, calibration, and Bayesian updating under uncertainty. | Not PM-specific and not an official statistical-data source. | Active in 2026. |
| [Forecasting: Principles and Practice, 3rd edition: Hyndman and Athanasopoulos](https://otexts.com/fpp3/) and [A New Product Growth for Model Consumer Durables: Bass](https://pubsonline.informs.org/doi/abs/10.1287/mnsc.15.5.215) | B, original-author open textbook; A, peer-reviewed original diffusion research | Textbook free; article abstract free and full text may require library access | Establishing naive baselines, time-series cross-validation, forecast-accuracy measures, intervals, decomposition, and honest uncertainty; selectively modeling aggregate innovation-and-imitation adoption and peak timing for an appropriate new-product market. | Textbook examples use R and fable and do not replace strategic judgment. Bass assumes aggregate first purchase in a relatively closed consumer-durable market; it is not a generic recurring-product, network, capacity, or causal model. Validate out of sample. | Textbook published **May 2021** and living online edition updated July 23, 2026; *Management Science* **15(5), January 1969**, pp. 215-227; routes checked 2026-07-28. |

### Global and national data

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [World Bank Indicators](https://data.worldbank.org/indicator) | A, international official data | Free | Population, income, infrastructure, health, education, technology, and macro priors across countries. | Definitions, revisions, missing years, and comparability vary; inspect metadata before using a number. | Living database checked 2026. |
| [World Bank Population Estimates and Projections](https://datacatalog.worldbank.org/search/dataset/0037655/population-estimates-and-projections) | A, official dataset | Free/API/download | Age, sex, urban/rural, and country population estimates/projections for demographic models. | Projections are model-based, not facts; state the scenario, vintage, geography, and year. | Metadata updated **July 1, 2026**. |
| [Data Commons Data Model and Provenance](https://docs.datacommons.org/data_model.html) | A/B, documented public knowledge graph | Free/API | Discovering statistical variables across official sources while preserving provenance. | Aggregation can hide definitional differences; follow every value to its original source and date. | Documentation current in 2026. |
| [Open Government Data Platform India](https://www.data.gov.in/) | A, Government of India portal | Free/API | Ministry and department datasets for India-specific estimates and cases. | Dataset quality, cadence, coverage, and portal metadata vary by publisher; verify the owning agency and update date. | Portal live in 2026; some site-level metadata displayed anomalies, so check each dataset. |
| [RBI Data Releases / Database on Indian Economy](https://statistics.rbi.org.in/) | A, Reserve Bank of India | Free | Indian banking, payments, credit, monetary, macroeconomic, and time-series data. | Definitions and vintages matter; use table notes and do not mix system, group, and bank-level series. | Data portal active with 2026 releases. |
| [NPCI UPI Product Statistics](https://www.npci.org.in/product/upi/product-statistics) | A, official network operator | Free | Monthly and daily UPI banks, transaction volume, value, and uptime for India fintech cases. | Network-reported aggregates do not reveal unique users, causality, merchant mix, or all excluded/reversed transactions; read footnotes. | Included FY 2026–27 and May 2026 data when checked. |
| [TRAI Performance Indicators Reports](https://www.trai.gov.in/release-publication/reports/performance-indicators-reports) | A, Indian regulator | Free PDF reports | Telecom subscribers, usage, internet, broadcasting, and market structure for India estimates. | Provider-reported regulatory aggregates; definitions, reporting periods, and revisions must be checked. | January–March 2026 report released June 22; page updated July 2026. |
| [US Census Data](https://www.census.gov/data.html) | A, national statistics agency | Free/API | US population, household, business, income, geography, and demographic priors. | US-only; survey margins, sampling, release vintage, and table universe matter. | Living portal; recheck each dataset's vintage. |
| [UN Data](https://data.un.org/) | A, international official data portal | Free | Cross-country demographic, economic, environmental, and social series. | Sources and update cadence differ by UN agency; inspect definitions and original series. | Living portal; date-stamp every extraction. |
| [Facts and Figures 2025](https://www.itu.int/itu-d/reports/statistics/facts-figures-2025/) and [mobile-phone-ownership indicator](https://www.itu.int/itu-d/reports/statistics/2025/10/15/ff25-mobile-phone-ownership/) — International Telecommunication Union | A, official international statistics | Free report, charts, and downloadable data | Global, regional, and income-group priors for Internet use, coverage, subscriptions, traffic, affordability, skills, and phone ownership; useful for challenging a smartphone-only B2B workflow or a connectivity guesstimate. | Estimates are revised and aggregates hide workplace, occupation, device, plan, and site differences. Phone ownership is not smartphone ownership, exclusive access, Internet use, affordable data, digital skill, or permission to use a device at work; validate the target workforce directly. | 2025 edition released **November 17, 2025**; report, indicator definition, and revision notes checked 2026-07-28. |

### Climate, energy, and research-data governance

| Source | Tier | Access | Best for | Limitations and viewpoint | Freshness |
| --- | --- | --- | --- | --- | --- |
| [Scaling Up Demand Flexibility — International Energy Agency](https://www.iea.org/reports/scaling-up-demand-flexibility) | A, intergovernmental sector analysis | Free online; account may be required for PDF | Demand flexibility, smart enablement, consumer participation, inclusion, interoperability, regulation, reliability, cost, and renewable-integration context across several electricity systems. | Scenario case studies for South Africa, Thailand, and Ireland are not observed benchmarks for a particular product, market, or cohort; energy regulation and grid conditions remain local. | Published **June 26, 2026** under CC BY 4.0. |
| [2025 Virtual Power Plants Update release and summary — U.S. DOE](https://www.energy.gov/technologycommercialization/articles/us-department-energy-releases-new-reports-highlighting) | A, government report release | Free | Official route summarizing the 2025 *Pathways to Commercial Liftoff: Virtual Power Plants Update*, aggregated distributed resources, deployment pathways, barriers, and market-development context. | US-specific summary, less detailed than the underlying report and not proof of a product's economics, participation, reliability, or regulatory eligibility. Follow future DOE links only after checking their liveness and version. | Official release published **January 10, 2025**; live HTTP 200 route confirmed 2026-07-28 after the former direct PDF returned 404. |
| [FERC Order No. 2222 explainer](https://www.ferc.gov/ferc-order-no-2222-explainer-facilitating-participation-electricity-markets-distributed-energy) | A, US regulator explainer | Free | DER aggregation, wholesale-market participation, roles, metering, telemetry, coordination, compensation, barriers, and regional implementation context. | Simplifies Orders 2222, 2222-A, and 2222-B and applies only within relevant US FERC/RTO jurisdiction. Read the orders and current docket or RTO rules for actual obligations and dates. | Page updated **September 25, 2025**; its implementation summary was based largely on August 2024 status. |
| [WMO Unified Data Policy — Resolution 1](https://public.wmo.int/wmo-unified-data-policy-resolution-res1) | A, intergovernmental data policy | Free | International exchange of weather, climate, hydrology, ocean, atmospheric, cryosphere, and space-weather data; core versus recommended data; implementation roles and public-private engagement. | A Member-state Earth-system data policy, not a product API contract, blanket open-data license, dataset-quality guarantee, or permission to ignore attribution, restrictions, funding, and local implementation. | World Meteorological Congress approved the policy **October 2021**; implementation hub checked 2026-07-28. |
| [Transparency — UNFCCC](https://unfccc.int/Transparency) | A, treaty-secretariat reporting hub | Free | Official routes to the Paris Agreement Enhanced Transparency Framework, reporting and review decisions, greenhouse-gas inventories, Biennial Transparency Reports, synthesis reports, and support information. | Party-level climate reporting is not a product-level data standard, live operating dataset, causal impact evaluation, or assurance that a partner feed is complete and decision-ready. | Living hub included 2025 BTR review and synthesis materials when checked **July 28, 2026**; cite the exact decision or report used. |
| [Access to research data from public funding toolkit — OECD](https://www.oecd.org/en/toolkits/access-to-research-data-from-public-funding-toolkit.html) | A, intergovernmental implementation toolkit | Free | Turning a normative research-data policy into practice across governance, technical standards, incentives, responsibility, infrastructure, skills, and sustainable access. | Publicly funded research-data scope; a toolkit does not establish rights to every dataset, settle privacy or community interests, fund operations, or make data fit for a product decision. | Implements the OECD Recommendation revised in **2021**; living toolkit checked 2026-07-28. |
| [Data governance for trust — OECD](https://www.oecd.org/en/toolkits/access-to-research-data-from-public-funding-toolkit/data-governance-for-trust.html) | A, intergovernmental implementation guidance | Free | Open access by default where appropriate, legitimate restrictions, tiered or secure access, risk mitigation, clear roles, and stakeholder consultation for publicly funded research data. | Not a demand for unrestricted release or a product-specific consent, privacy, licensing, security, or governance determination; it expressly recognizes legitimate private, public, and community interests. | Toolkit pillar and 2025 provision pages live when checked 2026-07-28. |

For an estimate, cite the source table—not only this catalog—and record:
publisher, series, definition, geography, period, release date, access date,
units, known exclusions, and whether the value is observed, estimated, or
projected.

## 14. Primary case-study and engineering libraries

These are especially useful for longitudinal cases, RCA, experimentation,
technical PM, and product-operating-model analysis. Treat company blogs as
first-party evidence about the company, then counter survivorship and public
relations bias with filings, postmortems, regulators, independent research, app
reviews, and dated product observation.

| Library | Tier | Best for | Limitation |
| --- | --- | --- | --- |
| [Google SRE Books and Resources](https://sre.google/) | A/B, first-party | Reliability, SLOs, incidents, postmortems, overload, and organizational learning. | Google scale and practice are not universal; published examples are selected. |
| [Microsoft Experimentation Platform Research](https://www.microsoft.com/en-us/research/group/experimentation-platform-exp/) | A, first-party research group | A/B testing, data quality, variance reduction, metrics, long-term effects, and experimentation culture. | Digital-platform and Microsoft context; some papers predate current systems. |
| [Netflix Technology Blog](https://netflixtechblog.com/) | A for Netflix accounts | Personalization, experimentation, media delivery, data, platform, and reliability cases. | Medium-hosted and curated; article date is essential because architecture changes. |
| [Airbnb Engineering & Data Science](https://airbnb.tech/) | A for Airbnb accounts | Marketplace search, ranking, experimentation, trust, infrastructure, and scaling. | Public narratives are selective and often explain successful systems after the fact. |
| [Uber Engineering](https://www.uber.com/blog/engineering/) | A for Uber accounts | Marketplace dispatch, geospatial systems, experimentation, payments, data, and reliability. | Company-scale complexity can encourage overengineering in smaller cases. |
| [LinkedIn Engineering](https://www.linkedin.com/blog/engineering) | A for LinkedIn accounts | Feed, experimentation, data platforms, developer infrastructure, and professional-network products. | Current URL structure and old article links can move; preserve title and access date. |
| [Spotify Engineering](https://engineering.atspotify.com/) | A for Spotify accounts | Personalization, experimentation, platform teams, developer experience, audio, and data. | Selected first-party stories; business outcomes and failed attempts may be missing. |
| [Stripe Engineering](https://stripe.com/blog/engineering) | A for Stripe accounts | APIs, reliability, developer products, payments infrastructure, migrations, and operational detail. | Stripe-specific quality bar and regulated-payments context; articles are selected. |
| [GitLab Handbook](https://handbook.gitlab.com/) | A for GitLab practice | Transparent examples of product roles, planning, remote collaboration, career ladders, security, and operations. | A living company's internal rules, not neutral standards; pages can change without a fixed edition. |
| [SEC EDGAR Search](https://www.sec.gov/search-filings) | A, regulator filing database | Verifying public-company strategy, risks, economics, segments, and dated management claims. | Filings are legal disclosures, not product telemetry; accounting definitions and risk language need care. |

### Case-study evidence template

For every branded case, record:

1. decision cutoff and facts available by that date;
2. product and business context;
3. user and non-user stakeholders;
4. first-party sources;
5. at least one independent or regulatory source when material;
6. public fact versus interpretation versus hypothetical extension;
7. decision options and constraints;
8. outcome evidence and counter-metrics;
9. survivorship, selection, and hindsight limitations;
10. what remains unknown because internal data is unavailable.

## 15. Recommended book route

Books deepen a topic but age differently. Prefer the latest legitimate edition,
use a library where possible, and pair every book with current primary sources.

| Stage | Books | Best use | Important caveat |
| --- | --- | --- | --- |
| Foundation | [INSPIRED — Marty Cagan](https://www.svpg.com/inspired-v2/); [The Lean Product Playbook — Dan Olsen](https://leanproductplaybook.com/book/); [The Design of Everyday Things — Don Norman](https://www.hachettebookgroup.com/titles/don-norman/the-design-of-everyday-things/9780465050659/) | Product-team vocabulary, product-market-fit process, and interaction fundamentals. | These are different schools, not a single canonical process; all predate the current generative-AI and regulatory landscape. |
| Discovery | [Continuous Discovery Habits — Teresa Torres](https://www.producttalk.org/continuous-discovery-habits/) | Turning discovery into a repeatable team habit. | Do not confuse interview frequency or tree completion with representative, ethical evidence. |
| Strategy | [Good Strategy/Bad Strategy — Richard Rumelt](https://www.richardrumelt.com/books); Playing to Win via [Roger Martin's strategy hub](https://rogerlmartin.com/thought-pillars/strategy); [Obviously Awesome — April Dunford](https://www.aprildunford.com/books) | Diagnosis and coherent action, strategic choices, and positioning. | Use current market evidence and economics; no strategy framework supplies them. |
| Organization | [Escaping the Build Trap — Melissa Perri](https://www.oreilly.com/library/view/escaping-the-build/9781491973783/); [EMPOWERED and TRANSFORMED — SVPG](https://www.svpg.com/books/) | Outcome orientation, leadership, empowered teams, and transformation. | Strong normative viewpoints; read against the learner's regulation, hardware, service, and organizational constraints. |
| Systems and experiments | [Thinking in Systems — Donella Meadows](https://www.penguinrandomhouse.com/books/801035/thinking-in-systems-by-donella-meadows/); [Trustworthy Online Controlled Experiments — Kohavi, Tang, Xu](https://www.cambridge.org/core/books/trustworthy-online-controlled-experiments/D97B26382EB0EB2DC2019A7A7B518F59) | Feedback, delays, unintended effects, causal experiment design, and quality controls. | Systems diagrams can become unfalsifiable; experiments cover only questions that the design can identify. |
| Delivery alternatives | [Shape Up — Basecamp](https://basecamp.com/shapeup); [Scrum Guide](https://scrumguides.org/scrum-guide.html); [Kanban Guide](https://kanbanguides.org/the-kanban-guide/) | Comparing fixed-time shaping, Scrum, and flow-oriented approaches from their original sources. | Select mechanisms for the constraint; do not turn one delivery system into product ideology. |

## 16. Coverage and source-quality checklist

Before a resource set is accepted for a roadmap or question bank:

- [ ] It contains an original or Tier A source for every time-sensitive factual
      claim.
- [ ] It includes a strong free route; paid material is optional depth.
- [ ] It distinguishes a framework's origin from evidence that it works.
- [ ] It includes user research, business economics, delivery, and operation,
      rather than only feature design.
- [ ] Accessibility, internationalization, privacy, security, abuse, ethics,
      reliability, and lifecycle are represented by specialist sources.
- [ ] Statistics and experimentation use primary research or a rigorous
      textbook, not analytics-vendor definitions alone.
- [ ] AI includes task-specific evaluation, human control, security, data
      provenance, monitoring, economics, and current regulation.
- [ ] Guesstimate anchors come from official data with definition and vintage,
      especially for India or other named geographies.
- [ ] Company cases include date and survivorship/PR limitations.
- [ ] Interview-process claims come from the employer or recruiter and carry an
      as-of date; old PDFs are labeled historical.
- [ ] Legal and regulatory sources identify jurisdiction, version, and
      effective date.
- [ ] No source is cited merely because it is popular.

## 17. Freshness watchlist as of July 28, 2026

These sources require special handling:

- **EU AI Act:** implementation details changed with the AI Omnibus entering
  force on **July 27, 2026**. Recheck the Commission's Act page and FAQ before
  every legal scenario.
- **OpenAI evaluation tooling:** the documentation checked on July 28 warned
  that the then-current Evals platform would become read-only on October 31 and
  shut down November 30, 2026. Keep the evaluation concepts, but update all tool
  instructions.
- **NIST AI RMF:** version 1.0 was under revision. Cite the exact framework,
  profile, playbook, and publication date.
- **NIST Privacy Framework:** 1.0 was stable while 1.1 was an initial public
  draft. Do not describe 1.1 as final without a new check.
- **Meta PM interview guide:** useful historical competency taxonomy, but not a
  reliable description of the 2026 process.
- **Scrum Guide:** the November 2020 guide was still the current official
  version. An old publication date is not the same as an obsolete version.
- **Vendor analytics and pricing material:** pages were current, but benchmark
  numbers and product features age quickly and reflect commercial incentives.
- **Official data:** World Bank, RBI, NPCI, TRAI, census, and UN values are
  revised. Store the table, series, period, release, and access date—not a
  memorized market number.