[M0-D02 follow-up] Confirm the licensed criteria catalog supplier and license scope

[smiggleworth]

Note

Follow-up discovery issue created 2026-09-22 when M0-D02 #59 closed. The product ships identifiers and original summaries only, so building R1-03 does not wait on this issue.

Decision needed

Identify who supplies licensed criteria text for the first client and confirm the firm's AICPA license covers its intended use.

Questions to answer

• Identify the first licensed catalog file supplier (firm or client) and its identifier scheme.
• Confirm with counsel that the firm's AICPA license permits storing and displaying the licensed text for each client organization it serves, including client-facing exports and firm templates.
• Record any restriction that must become a catalog-level usage flag (for example "not exportable").

Involve

Product owner, compliance lead, counsel.

Done when

• The supplier, license scope, and any usage restriction are recorded with owner and date.
• Any restriction is reflected in R1-03 and F1-04 acceptance criteria.
• If licensed overlay bulk import is required, create a separate P1 R1-03 delivery slice with backend and frontend children that cite the validated file shape and depend on EN-05 [EN-05 backend] Import with preview, reconciliation, and safe replay #195; the platform catalog selection backend [R1-03 backend] Select a traceable SOC 2 criteria catalog #209 remains independent.