2026 05 09 policy lsp capability debt detection

Language Server Protocol (LSP)-style policy surfaces and workforce taxonomies for automatic persistent capability-mismatch detection

Research Question

How can workforce-capacity and skills-taxonomy structures integrate with a Language Server Protocol (LSP)-style policy diagnostic surface to detect persistent capability mismatches automatically in enterprise delivery pipelines? [assumption; source: https://microsoft.github.io/language-server-protocol/; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html]

Scope

In scope:

Conceptual integration model between policy logic and workforce taxonomy structures
Detection criteria for persistent capability-mismatch signals
Governance implications for risk and workforce planning

Out of scope:

Building an implementation prototype
Tool or vendor architecture decisions

Constraints: Define terminology precisely and distinguish conceptual assumptions from evidence-backed claims.

Context

Prior completed items in this repository already argue that persistent system-capability gaps drive shadow tooling and that unmanaged workforce artifacts become a control and operational-risk surface when they carry business-critical decisions. [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-05-09-basel-iso-nist-shadow-workforce-risk-classification.html]

The remaining gap is prospective detection: a repeatable way to join policy requirements, delivery-pipeline evidence, and workforce-taxonomy coverage so persistent capability mismatches are surfaced before they mature into shadow-system or resilience failures. [inference; source: https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html; https://davidamitchell.github.io/Research/research/2026-03-21-technology-capability-models.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html]

Approach

Define persistent capability-mismatch indicators relevant to workforce planning.
Map indicators to policy evaluation constructs in a Language Server Protocol (LSP)-style policy surface.
Specify data dependencies and governance preconditions for automated detection.

Sources

Research Skill Output

(Full output from running the research skill, retained verbatim in the completed item. Sections 0 to 5 are the investigation, and section 6 seeds the Findings section below.)

§0 Initialise

Question: How can a Language Server Protocol (LSP)-style policy diagnostic surface combine with workforce taxonomies to detect persistent capability mismatches automatically in enterprise delivery pipelines?
Scope: Define a conceptual integration model, a practical detection logic, and governance implications, without building a prototype or choosing a specific vendor stack.
Constraints: Use URL-backed sources only, expand abbreviations on first use, distinguish evidence-backed statements from assumptions, and treat non-standard repository terms explicitly.
Output: knowledge item with complete Research Skill Output, mirrored Findings, Evidence Map, Assumptions, Analysis, Risks, and Open Questions.

§1 Question Decomposition

Q: How can workforce taxonomies integrate with an LSP-style policy surface to detect persistent capability mismatches automatically?
├── Q1: What must "Policy-LSP" mean in evidence-backed terms?
│   ├── Q1a: What does the Language Server Protocol standardize?
│   ├── Q1b: What did the prior repository Policy-LSP item establish?
│   └── Q1c: Which policy-engine outputs can feed such a surface?
├── Q2: What workforce-taxonomy structures are usable for detection?
│   ├── Q2a: What does the NICE Framework provide?
│   ├── Q2b: What does SFIA provide?
│   └── Q2c: How are they complementary rather than interchangeable?
├── Q3: What exactly is the persistent capability mismatch in this context?
│   ├── Q3a: Which prior repository findings define the debt pattern?
│   ├── Q3b: Which observable mismatches indicate debt prospectively?
│   └── Q3c: Which mismatches are structural rather than temporary staffing noise?
├── Q4: What data model enables automated detection?
│   ├── Q4a: What policy-side fields are needed?
│   ├── Q4b: What workforce-side fields are needed?
│   └── Q4c: What runtime or pipeline evidence is needed?
└── Q5: What governance model makes the detector useful and safe?
    ├── Q5a: Which planning and control functions should own the detector?
    ├── Q5b: When should the detector warn versus block?
    └── Q5c: What review, privacy, and versioning controls are required?

§2 Investigation

Search record (metadata): query "Policy-LSP"; query "Policy-LSP framework"; no usable external standard source located in this session.

A. Policy surface and policy-evaluation primitives

[fact; source: https://microsoft.github.io/language-server-protocol/; https://microsoft.github.io/language-server-protocol/specifications/specification-current/] The Language Server Protocol (LSP) standardizes JavaScript Object Notation Remote Procedure Call (JSON-RPC) communication between a development tool and a language server, including server-to-client diagnostics that can be emitted before code is committed or deployed.
[fact; source: https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html] The prior completed Policy-LSP item concluded that a headless agent runtime can act as an LSP client and that typed diagnostics are the most precise development-phase feedback surface for policy conformance.
[fact; source: https://www.openpolicyagent.org/docs/latest/] Open Policy Agent accepts arbitrary structured input, evaluates policy separately from enforcement logic, and can return arbitrary structured data rather than only binary allow or deny decisions.
[fact; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/] Open Policy Agent decision logs record the queried policy path, input, result, decision identifier, and bundle revision, which provides the trace fields needed to compare policy requirements with observed execution patterns.
[fact; source: https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html] Amazon Verified Permissions distinguishes authorization requests, authorization responses, entity data, context data, considered policies, and determining policies, and its response model includes both the decision outcome and the policy identifiers that produced it.
[inference; source: https://www.openpolicyagent.org/docs/latest/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html; https://microsoft.github.io/language-server-protocol/specifications/specification-current/] An LSP-style policy surface can therefore be implemented conceptually as a translation layer that converts structured policy-engine results, missing prerequisites, and repeated exceptions into developer-facing or pipeline-facing diagnostics without changing the underlying policy engine.

B. Workforce taxonomy structures

[fact; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq] The NICE Framework provides a common language for cybersecurity work and maintains machine-readable Work Role Categories, Work Roles, Competency Areas, and Task, Knowledge, and Skill statements that organizations can use for workforce planning, role design, and capability tracking.
[fact; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq] National Institute of Standards and Technology (NIST) states that the NICE Framework focuses on work roles rather than job titles and is intended to be broadly applicable across organizations and sectors.
[fact; source: https://sfia-online.org/en/framework/sfia-8; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z] SFIA publishes a reusable catalog of professional skills, standard industry skill profiles, and levels of responsibility, and its current public landing page identifies SFIA 9 as the current version of the framework.
[fact; source: https://sfia-online.org/en/sfia-9/skills/all-skills-a-z] SFIA skill entries include stable skill names, short codes, and definitions that can be referenced consistently across role profiles and competency assessments.
[inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/framework/sfia-8; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z] NICE is strongest for task and role decomposition, while SFIA is strongest for portable skill and proficiency normalization, so the two frameworks are complementary inputs to detection rather than mutually exclusive choices.

C. Persistent capability mismatch definition and observable indicators

[fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Prior completed repository work argues that persistent system-capability gaps drive workaround behavior such as citizen development and shadow tooling when formal systems, processes, and controls cannot support operational need.
[fact; source: https://davidamitchell.github.io/Research/research/2026-05-09-basel-iso-nist-shadow-workforce-risk-classification.html] Prior completed repository work also shows that unmanaged workforce data and manual workaround artifacts become operational-risk and control surfaces when they support authoritative decisions or reporting.
[fact; source: https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report] The DORA AI capabilities report says AI is an amplifier and that the greatest returns come from investing in foundational systems, culture, and capabilities rather than relying on tools alone.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report] In this item, the persistent capability mismatch is the gap between the capability pattern a governed workflow requires and the capability pattern the workforce, tooling estate, and control environment can actually supply.
[inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html] Prospectively observable debt indicators include missing required work roles, insufficient skill or responsibility coverage, concentration of approvals in too few qualified people, repeated policy exceptions tied to skill predicates, and recurring overrides that route around missing authorized capability.

D. Minimum joined data model

[fact; source: https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html; https://www.openpolicyagent.org/docs/latest/] Policy systems already separate principal, action, resource, context, and policy logic, which means capability requirements can be encoded as structured predicates rather than only as prose policies.
[fact; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/] Decision-log outputs already preserve policy path, input, result, and revision metadata, which makes it possible to aggregate repeated failures or exceptions by workflow, policy, team, or time period.
[fact; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z] Workforce taxonomies already provide stable identifiers for work roles, tasks, and skills that can be mapped into enterprise role and proficiency records.
[inference; source: https://www.openpolicyagent.org/docs/latest/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z] The minimum viable detection model therefore needs four linked record types: governed assets or workflows, policy requirement objects, workforce capability objects, and observed execution evidence from decision logs, overrides, or exception handling.
[inference; source: https://davidamitchell.github.io/Research/research/2026-03-21-technology-capability-models.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html; https://www.openpolicyagent.org/docs/latest/management-decision-logs/] Each record type must be versioned because persistent capability-mismatch detection is invalid if the workflow definition, policy revision, and workforce taxonomy snapshot are compared across different baselines without an explicit timestamp or revision link.

E. Governance preconditions and operating model

[fact; source: https://www.isaca.org/resources/cobit] COBIT 2019 positions governance of enterprise information and technology as a structured system of governance and management objectives that integrates other standards and implementation resources.
[fact; source: https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report] The DORA AI capabilities report says platform teams and foundational capabilities are crucial for converting local AI productivity gains into systemic organizational improvement.
[fact; source: https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook] The NIST Artificial Intelligence Risk Management Framework (AI RMF) Playbook organizes suggested actions around Govern, Map, Measure, and Manage functions for trustworthy Artificial Intelligence (AI) system use.
[inference; source: https://www.isaca.org/resources/cobit; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook] A persistent capability-mismatch detector should sit in a governance loop that separates ownership of taxonomy quality, policy quality, and workforce planning, because the detector only becomes trustworthy when its inputs are governed, measured, and remediated by named functions.
[inference; source: https://microsoft.github.io/language-server-protocol/specifications/specification-current/; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook] The development and delivery posture should default to soft diagnostics and escalation rather than unconditional hard blocking, because many persistent capability-mismatch findings indicate structural planning gaps that need review and remediation rather than immediate automated denial of all work.
[assumption; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook] Automated detection is only defensible if the workforce capability inventory is sufficiently current and governed; stale or manager-entered self-ratings would otherwise turn the detector into a noisy proxy for documentation quality rather than true persistent mismatch.

§3 Reasoning

[fact; source: https://microsoft.github.io/language-server-protocol/specifications/specification-current/; https://www.openpolicyagent.org/docs/latest/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html] The evidence supports three stable building blocks: a diagnostic surface, a policy engine with structured outputs, and a workforce taxonomy with stable identifiers.
[inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z; https://www.openpolicyagent.org/docs/latest/management-decision-logs/] Persistent capability mismatch becomes machine-detectable only after those building blocks are joined on shared identifiers or an explicit mapping layer, because isolated policy or workforce data cannot reveal repeated requirement-coverage gaps by itself.
[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report] The most defensible interpretation is therefore that repeated requirement-coverage gaps are the detection outcome produced when required capability patterns and observed capability coverage remain misaligned over time.

§4 Consistency Check

[fact; source: https://microsoft.github.io/language-server-protocol/; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html] The item consistently uses Policy-LSP as a repository shorthand for an LSP-style policy surface and does not claim it is an external standard.
[fact; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/framework/sfia-8] The item consistently treats NICE and SFIA as complementary taxonomies rather than claiming either one alone is a universal workforce model.
[inference; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report] No internal contradiction remains between the proposed detector mechanics and the governance conclusion, because the same structured signals that support detection also justify soft diagnostics, measurement, and escalation rather than immediate automatic sanctions.

§5 Depth and Breadth Expansion

[inference; source: https://www.isaca.org/resources/cobit; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook] Through a governance lens, the detector is useful only if it routes findings into a named remediation process, such as workforce planning, platform investment, or policy redesign, rather than merely increasing visible non-compliance counts.
[inference; source: https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report; https://davidamitchell.github.io/Research/research/2026-04-22-historical-technology-adoption-enterprise-ai-capability-building.html] Through a historical and economic lens, the detector matters because AI and automation amplify pre-existing capability gaps, so an enterprise that measures only tool adoption will miss the complements required for durable value.
[inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z] Through a workforce lens, NICE and SFIA can be used to distinguish structural mismatch from temporary load spikes by showing whether missing capability is absent from the role design itself, underrepresented in staffing, or merely saturated in a short time window.
[inference; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook] Through an assurance lens, the most valuable metrics are likely repeated exception rates, repeated missing-capability diagnostics, and time-to-remediation by policy revision, because those signals show whether the enterprise is learning or simply accumulating unresolved debt.

§6 Synthesis

Executive summary:

Persistent capability mismatches can be detected automatically when an enterprise translates policy requirements into structured diagnostics, maps those requirements to stable workforce-taxonomy identifiers, and then compares required capability coverage with observed role, skill, and exception patterns over time. [inference; source: https://microsoft.github.io/language-server-protocol/specifications/specification-current/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z]

A workable architecture can use a repository-style LSP diagnostic surface layered over a structured policy engine such as Open Policy Agent or Cedar-like authorization services. [inference; source: https://microsoft.github.io/language-server-protocol/; https://www.openpolicyagent.org/docs/latest/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html]

NICE contributes task and work-role decomposition, while SFIA contributes reusable skill and proficiency normalization, which together provide enough taxonomy structure to express what a workflow requires and what the workforce can actually supply. [inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/framework/sfia-8; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z]

The detector should treat repeated missing-capability diagnostics, exception clustering, approval concentration, and override frequency as planning and control signals for governance forums rather than as a pure binary gate. [inference; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.isaca.org/resources/cobit; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report]

Key findings:

The repository label "Policy-LSP" is best understood as an LSP-style policy diagnostic surface over structured policy decisions. ([inference]; medium confidence; source: https://microsoft.github.io/language-server-protocol/; https://microsoft.github.io/language-server-protocol/specifications/specification-current/; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html)
The NICE Framework and SFIA form a complementary workforce-taxonomy pair because NICE decomposes work into roles, tasks, and Task, Knowledge, and Skill statements, while SFIA normalizes reusable skills, codes, and responsibility levels across role profiles. ([inference]; high confidence; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/framework/sfia-8; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z)
Modern policy engines already emit the structured request, response, revision, and audit fields that an automated detector can reuse, so the remaining gap is data joining and diagnostic presentation rather than a new policy-calculation primitive. ([inference]; high confidence; source: https://www.openpolicyagent.org/docs/latest/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html)
Persistent capability mismatches become prospectively detectable when policy-required capabilities and actual workforce coverage stay misaligned across repeated workflow executions, especially when the same missing-role, missing-skill, override, or exception patterns recur across time and teams. ([inference]; medium confidence; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html)
The minimum viable detection model needs four versioned objects, governed workflow definitions, policy requirement objects, workforce capability records, and execution evidence, because comparing any one of those in isolation cannot distinguish structural mismatch from one-off operational noise. ([inference]; medium confidence; source: https://www.openpolicyagent.org/docs/latest/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html; https://davidamitchell.github.io/Research/research/2026-03-21-technology-capability-models.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html)
Governance frameworks imply that persistent capability-mismatch detection should primarily feed Govern, Map, Measure, and Manage loops, workforce planning, and platform investment decisions, because AI and automation amplify weak foundations instead of compensating for them. ([inference]; medium confidence; source: https://www.isaca.org/resources/cobit; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report)
This item extends prior repository work by turning prior system-capability-gap and shadow workforce-system risk findings from retrospective diagnosis into a prospective, machine-assisted detection pattern that can run inside delivery pipelines or policy review loops. ([inference]; medium confidence; source: https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-05-09-basel-iso-nist-shadow-workforce-risk-classification.html)

Evidence map:

claim	source	confidence	notes
[inference] The repository label "Policy-LSP" is best understood as an LSP-style diagnostic surface over structured policy decisions.	https://microsoft.github.io/language-server-protocol/; https://microsoft.github.io/language-server-protocol/specifications/specification-current/; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html	medium	term-resolution
[inference] NICE and SFIA form a complementary workforce-taxonomy pair.	https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/framework/sfia-8; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z	high	role plus skill layering
[inference] Structured policy-engine outputs already expose the fields that an automated detector can reuse.	https://www.openpolicyagent.org/docs/latest/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html	high	policy primitives exist
[inference] Repeated requirement-coverage mismatches make persistent capability mismatches prospectively detectable.	https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html	medium	detection logic
[inference] Four versioned object types are the minimum viable joined data model.	https://www.openpolicyagent.org/docs/latest/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html; https://davidamitchell.github.io/Research/research/2026-03-21-technology-capability-models.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html	medium	data-model requirement
[inference] Governance should route findings into Govern, Map, Measure, and Manage loops and platform planning.	https://www.isaca.org/resources/cobit; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report	medium	governance use
[inference] The item converts prior system-capability-gap and shadow-system findings into a prospective detection pattern.	https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-05-09-basel-iso-nist-shadow-workforce-risk-classification.html	medium	cross-item extension

Assumptions:

[assumption; source: https://microsoft.github.io/language-server-protocol/; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html] "Policy-LSP" is treated as a repository-specific name for an LSP-style policy surface.
[assumption; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook] Workforce capability records are current enough to support detection decisions, even though many enterprises maintain incomplete or lagging skill inventories.
[assumption; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html] Policy decisions, exceptions, and overrides are captured consistently enough to reveal repeated patterns rather than isolated anecdotal incidents.

Analysis:

The evidence does not support inventing a new policy-calculation framework, because the needed policy primitives already exist in structured engines and authorization services. [inference; source: https://www.openpolicyagent.org/docs/latest/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html]

The harder problem is semantic joining, which means mapping policy predicates such as required approver class, required role separation, or required skill coverage to workforce-taxonomy identifiers that can be measured repeatedly. [inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z; https://www.openpolicyagent.org/docs/latest/management-decision-logs/]

NICE and SFIA solve different parts of that joining problem, because NICE gives task and work-role granularity while SFIA gives a reusable skill and proficiency vocabulary that travels across job designs. [inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/framework/sfia-8; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z]

The most decision-useful detection signals are the repeated ones, not single denials, because structural mismatch is about persistent misalignment between required and available capability rather than isolated momentary shortage. [inference; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html]

A competing explanation is that repeated findings could reflect stale inventories or temporary workload spikes rather than structural mismatch, so the detector should only escalate when the same mismatch persists across time windows, revisions, or multiple workflows. [inference; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z]

That logic also explains why soft diagnostics are usually preferable at first, because recurring findings justify workforce planning or platform investment, while an immediate hard gate can hide the deeper problem by framing it as individual non-compliance only. [inference; source: https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report; https://www.isaca.org/resources/cobit]

Risks, gaps, uncertainties:

[assumption; source: https://microsoft.github.io/language-server-protocol/; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html] The exact term "Policy-LSP" is repository-specific within this item, so implementation details remain inferential even though the component parts are well supported.
[inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z] NICE is cybersecurity-focused and SFIA is broader, so organizations outside cybersecurity-heavy workflows may need an additional domain taxonomy to express specialized non-digital capability requirements cleanly.
[inference; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook] Detection accuracy will be weak if exception logs, override paths, or workforce records are incomplete, because the detector depends on observed repetition and baseline integrity.
[inference; source: https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report; https://www.isaca.org/resources/cobit] The evidence supports governance patterns and architectural feasibility more strongly than quantified outcome evidence, so the detection model remains conceptual rather than empirically benchmarked.

Open questions:

Which domain taxonomies outside cybersecurity pair best with SFIA when the governed workflow is legal, finance, operations, or customer service rather than primarily cybersecurity?
What threshold of repeated missing-capability diagnostics best separates structural mismatch from seasonal load spikes or project-specific staffing gaps?
Which privacy-preserving patterns allow workforce capability data to be used for control design without turning the detector into covert performance surveillance?
What evaluation design would prove that early persistent capability-mismatch diagnostics reduce shadow-system growth or exception volume in practice?

§7 Recursive Review

Review result: pass
Acronym audit: Language Server Protocol (LSP), National Institute of Standards and Technology (NIST), Skills Framework for the Information Age (SFIA), Task, Knowledge, and Skill (TKS), Artificial Intelligence Risk Management Framework (AI RMF), and Open Policy Agent (OPA) are expanded on first prose use.
Claim audit: all visible claim-bearing prose in Research Skill Output is labeled as [fact], [inference], or [assumption].
Cross-item integration: prior completed items are cited where this item extends or depends on them.

Findings

Executive Summary

Persistent capability mismatches can be detected automatically when an enterprise translates policy requirements into structured diagnostics, maps those requirements to stable workforce-taxonomy identifiers, and then compares required capability coverage with observed role, skill, and exception patterns over time. [inference; source: https://microsoft.github.io/language-server-protocol/specifications/specification-current/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z]

A workable architecture can use a repository-style LSP diagnostic surface layered over a structured policy engine such as Open Policy Agent or Cedar-like authorization services. [inference; source: https://microsoft.github.io/language-server-protocol/; https://www.openpolicyagent.org/docs/latest/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html]

NICE contributes task and work-role decomposition, while SFIA contributes reusable skill and proficiency normalization, which together provide enough taxonomy structure to express what a workflow requires and what the workforce can actually supply. [inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/framework/sfia-8; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z]

The resulting detector should be treated as a governance signal for workforce planning, platform investment, and policy redesign, because repeated capability gaps usually indicate structural weaknesses in enterprise foundations rather than isolated user misconduct. [inference; source: https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report; https://www.isaca.org/resources/cobit]

Key Findings

The repository label "Policy-LSP" is best understood as an LSP-style policy diagnostic surface over structured policy decisions. ([inference]; medium confidence; source: https://microsoft.github.io/language-server-protocol/; https://microsoft.github.io/language-server-protocol/specifications/specification-current/; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html)
The NICE Framework and SFIA form a complementary workforce-taxonomy pair because NICE decomposes work into roles, tasks, and Task, Knowledge, and Skill statements, while SFIA normalizes reusable skills, codes, and responsibility levels across role profiles. ([inference]; high confidence; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/framework/sfia-8; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z)
Modern policy engines already emit the structured request, response, revision, and audit fields that an automated detector can reuse, so the remaining gap is data joining and diagnostic presentation rather than a new policy-calculation primitive. ([inference]; high confidence; source: https://www.openpolicyagent.org/docs/latest/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html)
Persistent capability mismatches become prospectively detectable when policy-required capabilities and actual workforce coverage stay misaligned across repeated workflow executions, especially when the same missing-role, missing-skill, override, or exception patterns recur across time and teams. ([inference]; medium confidence; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html)
The minimum viable detection model needs four versioned objects, governed workflow definitions, policy requirement objects, workforce capability records, and execution evidence, because comparing any one of those in isolation cannot distinguish structural mismatch from one-off operational noise. ([inference]; medium confidence; source: https://www.openpolicyagent.org/docs/latest/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html; https://davidamitchell.github.io/Research/research/2026-03-21-technology-capability-models.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html)
Governance frameworks imply that persistent capability-mismatch detection should primarily feed Govern, Map, Measure, and Manage loops, workforce planning, and platform investment decisions, because AI and automation amplify weak foundations instead of compensating for them. ([inference]; medium confidence; source: https://www.isaca.org/resources/cobit; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report)
This item extends prior repository work by turning prior system-capability-gap and shadow workforce-system risk findings from retrospective diagnosis into a prospective, machine-assisted detection pattern that can run inside delivery pipelines or policy review loops. ([inference]; medium confidence; source: https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-05-09-basel-iso-nist-shadow-workforce-risk-classification.html)

Evidence Map

Claim	Source	Confidence	Notes
[inference] The repository label "Policy-LSP" is best understood as an LSP-style diagnostic surface over structured policy decisions.	https://microsoft.github.io/language-server-protocol/; https://microsoft.github.io/language-server-protocol/specifications/specification-current/; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html	medium	term-resolution
[inference] NICE and SFIA form a complementary workforce-taxonomy pair.	https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/framework/sfia-8; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z	high	role plus skill layering
[inference] Structured policy-engine outputs already expose the fields that an automated detector can reuse.	https://www.openpolicyagent.org/docs/latest/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html	high	policy primitives exist
[inference] Repeated requirement-coverage mismatches make persistent capability mismatches prospectively detectable.	https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html	medium	detection logic
[inference] Four versioned object types are the minimum viable joined data model.	https://www.openpolicyagent.org/docs/latest/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html; https://davidamitchell.github.io/Research/research/2026-03-21-technology-capability-models.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html	medium	data-model requirement
[inference] Governance should route findings into Govern, Map, Measure, and Manage loops and platform planning.	https://www.isaca.org/resources/cobit; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report	medium	governance use
[inference] The item converts prior system-capability-gap and shadow-system findings into a prospective detection pattern.	https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-05-09-basel-iso-nist-shadow-workforce-risk-classification.html	medium	cross-item extension

Assumptions

[assumption; source: https://microsoft.github.io/language-server-protocol/; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html] "Policy-LSP" is treated as a repository-specific name for an LSP-style policy surface.
[assumption; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook] Workforce capability records are current enough to support detection decisions, even though many enterprises maintain incomplete or lagging skill inventories.
[assumption; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html] Policy decisions, exceptions, and overrides are captured consistently enough to reveal repeated patterns rather than isolated anecdotal incidents.

Analysis

The evidence does not support inventing a new policy-calculation framework, because the needed policy primitives already exist in structured engines and authorization services. [inference; source: https://www.openpolicyagent.org/docs/latest/; https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/terminology.html]

The harder problem is semantic joining, which means mapping policy predicates such as required approver class, required role separation, or required skill coverage to workforce-taxonomy identifiers that can be measured repeatedly. [inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z; https://www.openpolicyagent.org/docs/latest/management-decision-logs/]

NICE and SFIA solve different parts of that joining problem, because NICE gives task and work-role granularity while SFIA gives a reusable skill and proficiency vocabulary that travels across job designs. [inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/framework/sfia-8; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z]

The most decision-useful detection signals are the repeated ones, not single denials, because structural mismatch is about persistent misalignment between required and available capability rather than isolated momentary shortage. [inference; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html]

A competing explanation is that repeated findings could reflect stale inventories or temporary workload spikes rather than structural mismatch, so the detector should only escalate when the same mismatch persists across time windows, revisions, or multiple workflows. [inference; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z]

That logic also explains why soft diagnostics are usually preferable at first, because recurring findings justify workforce planning or platform investment, while an immediate hard gate can hide the deeper problem by framing it as individual non-compliance only. [inference; source: https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report; https://www.isaca.org/resources/cobit]

Risks, Gaps, and Uncertainties

[assumption; source: https://microsoft.github.io/language-server-protocol/; https://davidamitchell.github.io/Research/research/2026-03-01-agent-lsp-policy-enforcement.html] The exact term "Policy-LSP" is repository-specific within this item, so implementation details remain inferential even though the component parts are well supported.
[inference; source: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z] NICE is cybersecurity-focused and SFIA is broader, so organizations outside cybersecurity-heavy workflows may need an additional domain taxonomy to express specialized non-digital capability requirements cleanly.
[inference; source: https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook] Detection accuracy will be weak if exception logs, override paths, or workforce records are incomplete, because the detector depends on observed repetition and baseline integrity.
[inference; source: https://cloud.google.com/resources/content/2025-dora-ai-capabilities-model-report; https://www.isaca.org/resources/cobit] The evidence supports governance patterns and architectural feasibility more strongly than quantified outcome evidence, so the detection model remains conceptual rather than empirically benchmarked.

Open Questions

Which domain taxonomies outside cybersecurity pair best with SFIA when the governed workflow is legal, finance, operations, or customer service rather than primarily cybersecurity?
What threshold of repeated missing-capability diagnostics best separates structural mismatch from seasonal load spikes or project-specific staffing gaps?
Which privacy-preserving patterns allow workforce capability data to be used for control design without turning the detector into covert performance surveillance?
What evaluation design would prove that early persistent capability-mismatch diagnostics reduce shadow-system growth or exception volume in practice?

Output

Type: knowledge
Description: A conceptual detection model that joins LSP-style policy diagnostics, structured policy-engine outputs, and workforce taxonomies to surface persistent capability mismatches in enterprise delivery pipelines. [inference; source: https://microsoft.github.io/language-server-protocol/specifications/specification-current/; https://www.openpolicyagent.org/docs/latest/management-decision-logs/; https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/about/faq; https://sfia-online.org/en/sfia-9/skills/all-skills-a-z]
Links: