You are not certified in The Nine. You apply them — continuously, yourself, in a way others can verify but no authority can grant.
The Nine are foundational — a discipline an organization applies, not a project it implements (and finishes), and never a status an authority approves. There is no certificate, no "Nine-compliant" badge, no qualifying body. The moment trustworthiness can be granted by an authority, that authority becomes the single point of trust the discipline exists to refuse (P5), and the badge becomes the false completion it refuses to claim (P9).
Where you start — the observance audit
You do not start by adding nine new things. You start by finding where your organization currently does the opposite of each refusal. For each of the Nine, ask one diagnostic question — the honest answers are your starting map.
- P1 — where do we hold complete, usable secrets in one place or one person's hands?
- P2 — where do we trust on say-so, role, or assertion instead of verified, recorded evidence?
- P3 — where have we built a primitive, key, or vendor in so deep we cannot replace it?
- P4 — where do our words exceed what we can actually demonstrate?
- P5 — where is a leader, founder, or operator above the rule the system imposes on others?
- P6 — where could we not safely wind something down?
- P7 — where do we obtain a "yes" through urgency, dark patterns, or no real ability to decline?
- P8 — where do we lock in, harvest, or extract more than the user knowingly gives?
- P9 — where do we imply our structure has removed the risk — that trust is no longer needed?
Every "yes, we do the opposite there" is a gap to close. That map — not a certificate — is where applying begins.
What applies where
The Nine live in different layers. P1–P4 (restraint) are built into architecture and engineering. P5 (reflexivity) lives in governance — the board, the ledger, separation of duties. P6–P8 (liberation) live in product and policy — exit plans, honest consent, no lock-in. P9 (the limit) lives in culture and language — it cannot be added as a control, only not violated, by never claiming the structure removed the need for trust.
How you know you are applying them
- Self-attested. You state, openly, where you apply each refusal and where you do not yet. The honest "not yet" is part of applying them (P4).
- Externally verifiable. Your claims are checkable: the ledger shows the architect is bound (P5); a stranger can verify what you said you do (P2, P4); your terms show no lock-in (P8).
- Never externally granted. No body certifies you. Verification is something others do to your claims, not a status they confer.
The certification trap. A certifying authority would become a single point of trust (violating P1 and P5), and a badge would imply a completion no one can grant (violating P9). If anyone — including its author — ever offers to certify compliance with The Nine, that offer is itself a violation of The Nine.
The unspoken framework
When applied well, the Nine stop being a document you consult and become the questions you ask without being told to: Are we about to hold more than we need? Can we prove this, or are we assuming it? Are we saying more than we can show? Are we exempting ourselves? Are we trapping, coercing, or extracting? Are we implying the risk is gone?
That is the difference between implementing a framework and keeping a discipline. Applied, not approved. Kept, not finished. Built in observance.