Treat the title as a hypothesis
Trust can be a competitive advantage when customers choose a provider because of credible, accumulated reasons to expect a dependable outcome. Calling it a cornered resource is a hypothesis about scarcity, not a settled new Power. A company still needs to demonstrate the customer benefit, the difficulty of matching its credibility and the conditions under which that position would disappear.
Within today's 7 Powers base, a demonstrated trust premium may fit branding; restricted access or a scarce authorisation may fit cornered resources. Security and compliance can also be ordinary requirements every credible supplier must meet. Keeping those roles distinct prevents an attractive trust-centre page from receiving the same interpretation as an accumulated history that customers explicitly rely on when selecting a provider.
Start by asking a buyer what decision trust changes. Does the record affect vendor eligibility, the scope of delegated work, willingness to pay or the need for human review? These are different claims and require different evidence. A statement that trust is important is a useful interview finding. A documented choice between comparable alternatives gives a reviewer more to investigate.
Make trust inspectable
An inspectable trust claim connects an assertion to an identifiable source, date, scope and accountable owner. A provider might document its incident process, access boundaries or correction history. Those records help a customer ask specific questions. They do not establish perfection, and a promise that the system never fails would undermine the care needed to assess how it actually behaves.
Consider a hypothetical agent that can change customer records. A useful disclosure explains what it can change, which actions need approval, how decisions are logged and how an error is corrected. The buyer can then decide whether those controls fit the intended task. Vague reassurance about advanced intelligence cannot answer the same questions because it leaves the action boundary and responsibility undefined.
Make the limits easy to discover. Distinguish tests from production observations, self-reported performance from independent evaluation and a security policy from evidence that the policy operates. Keep older incidents visible to authorised reviewers with their resolution status. The recommendation is to reduce uncertainty honestly. Whether doing so creates a durable commercial premium remains a company-specific question to measure.
Provenance proves a narrower thing
C2PA's Content Credentials explainer makes a critical distinction: provenance can provide evidence about the origin and history of content, but provenance alone cannot establish that the content is accurate or factual. That boundary matters for AI businesses. A signed assertion can preserve a record of who asserted something without making the assertion true. Its value depends on the question a customer is trying to answer.
For a moat review, specify the claim the provenance supports. A document history may help establish which version was supplied; it may not establish that the underlying experiment was well designed. A recorded source may enable correction; it may not grant rights to reuse the material. Evaluate origin, factual accuracy and permission separately, even when they appear together in one evidence package.
Open provenance standards are also available to competitors. Merely adopting one is not exclusive ownership of trust. A stronger hypothesis would concern the company's accumulated, useful record and the dependable process around it. Test whether customers value that record, whether a rival could obtain an equivalent and whether customers can verify it without having to accept the provider's own interpretation.
Keep controls, gates and moats separate
NIST's AI Risk Management Framework is voluntary guidance intended to help incorporate trustworthiness into the design, development, use and evaluation of AI systems. It is a risk-management reference, not evidence that a particular product is certified, compliant or competitively protected. A company can explain how it uses the guidance while remaining explicit about which controls have actually been tested.
OWASP's 2025 LLM risk list includes prompt injection, sensitive information disclosure, supply-chain risks and excessive agency. These are concrete reasons to examine an agent's permissions and failure paths. The list is expert guidance about hazards; its presence in a presentation does not prove a system is secure. Ask for the applicable tests, the findings, the fixes and the remaining limitations.
A buyer-mandated approval can create a market-access gate, but the company must document its scope and the rival's path to meeting it. Common requirements can be costly without being scarce. Conversely, an authorisation may be genuinely difficult to obtain yet irrelevant to the customer's intended use. Ask qualified advisers about applicable legal duties; this strategic analysis does not establish compliance or create a legal entitlement.
Measure what the record changes
A practical trust review should connect evidence to outcomes. Record when security review prevented or enabled a contract, what the customer required and which alternatives were considered. Follow renewals and departures after material incidents without assuming every change was caused by trust. Where possible, compare similar decisions under similar conditions. Explain sample limitations rather than treating a small set of favourable conversations as a universal result.
Test erosion as well as accumulation. A long record may lose relevance after an acquisition, a system redesign or a change in who carries responsibility. A new incident may reveal that a previously credible control did not operate as described. Keep the asset current by recording those changes. Trust that cannot be questioned or corrected is difficult for a reviewer to distinguish from an unsupported reputation claim.
MoatDefender's current Moat Index is a v5.0 defensibility method with AI-era tests. Broader treatment of trust and compliance, an expanded graph and the Global Moat Defender Index are coming. Our research direction is to make trust claims more specific and inspectable, while preserving the difference between a valuable barrier and a basic duty. A reading is an opinion based on evidence, not a security certification, legal opinion or investment recommendation.
Sources
Sources support the linked claims; our interpretation and checklists establish no outcome for your company.