The Iceberg Trust Model — a defensible methodological account

01The GTDS hybrid in one page

Grounded-Theory Design Science (GTDS) is a hybrid that resolves a structural problem neither parent method solves alone. Standard DSR informs artifact design through case studies, surveys, or expert interviews — and inherits the perspectival limits of those data sources. Grounded-theory literature review produces categories and constructs but is not committed to a deliverable artifact. GTDS combines them deliberately: the DSR stance constrains coding toward operationalizable constructs; the coding rigor constrains the artifact toward grounding in the literature rather than expert intuition.

What each parent contributes

The integration architecture

The two traditions are not run in parallel. They are nested: the GT-LR coding procedure executes inside Hevner's third design cycle (Operationalization). The four DSR cycles host the work end-to-end; Cycle 3 is where Wolfswinkel's five stages take place. The integration is therefore not a methodological flourish but a containment: a defined coding procedure sits within a defined design program, and the products of each are addressed to different audiences (DSR products to practitioners; GT-LR products to reviewers).

Why the hybrid was necessary

The decision to hybridize was driven by two empirical observations during early problem identification, not by methodological preference. First, no single existing trust framework integrated the four levels at which trust phenomena were observed (perceptual, technical, organizational, institutional); the framework had to be constructed, not selected. Pure DSR could not have produced the construct grounding the framework requires, because the relevant constructs sit in disciplines DSR does not by itself synthesize. Second, the existing literature on digital trust was sufficiently mature to support derivation of constructs through coding, but sufficiently fragmented across disciplines that a corpus-based approach was needed rather than a domain-bounded review. Pure grounded theory could not have produced the prescriptive artifact the practical problem demands, because GT-LR halts at theory development and does not commit to operational design.

The hybrid was not a methodological flourish but a response to the structure of the problem and the state of the literature.The author's framing of the GTDS hybrid

02Strauss-Corbin taxonomy: concept · category · construct · cue

Earlier iterations of this page used concept and category as if they were synonyms. They are not, and the difference matters for the audit trail. Strauss & Corbin (1998) define a strict ordering from concepts through categories, and the GTDS work additionally introduces constructs and cues as the operational outputs that make the framework usable. This section fixes the taxonomy and maps each tier onto the work performed.

How the taxonomy maps onto the iceberg

Earlier versions of this page applied the word concept to all of the iceberg's elements indiscriminately. The corrected mapping, following the taxonomy above, is:

03Hevner DSR — the four cycles

The work iterated through four DSR cycles, following Hevner, March, Park & Ram (2004) and the seven guidelines articulated in their MIS Quarterly essay. Each cycle has a defined input from the prior cycle, a defined output, and a documented commitment that constrains the next cycle. The third cycle is where the Wolfswinkel five-stage GT-LR procedure is hosted; that integration is the substance of the GTDS hybrid.

Cycle 1 — Problem identification

Input: Practitioner observation of recurring AI value-realization failures across financial services, public administration, and consumer-facing AI deployments. Output: A structured framing of the AI value gap as a trust deficit, supported by Acemoglu (2024) on AI macroeconomics, Swiss Fintech Innovations (2025) on the Swiss financial sector's AI production gap, and the World Economic Forum (2022) on digital trust as the binding constraint on AI value realization. Commitment to Cycle 2: the problem is architectural in nature; isolated technical, organizational, or institutional fixes will not close the gap, so the artifact must address all four levels at which trust phenomena were observed.

Cycle 2 — Architecture by necessity-and-sufficiency analysis

Input: The four-level problem framing from Cycle 1. Output: A four-layer architecture (Agency, Engineering, Governance, Institutional) derived through a necessity-and-sufficiency analysis. Each layer is anchored in an established theoretical tradition that supplies its principal vocabulary: Agency in foundational trust theory (Mayer, Davis & Schoorman, 1995; McKnight, Choudhury & Kacmar, 2002) and agency theory (Giddens, 1984; Jensen & Meckling, 1976); Engineering in sociotechnical systems theory and the social-adaptor / social-protector framing (Helbing, 2015); Governance in resilience engineering (Hollnagel, Woods & Leveson, 2006) and complexity-management (Snowden & Boone, 2007); Institutional in regulatory and assurance frameworks (NIST AI RMF, EU AI Act, eIDAS 2.0, FINMA, ALTAI). Necessity: each layer earns its place by accounting for trust phenomena the other layers cannot — removing any layer leaves a class of phenomena unexplained by the remaining three. Sufficiency: the four layers, taken together, must account for all categories observed in the corpus; this property is verified during Cycle 3 axial coding, where every emergent category maps to one of the four layers under the constant-comparison protocol. The architecture is therefore not a free-standing theoretical synthesis but a decomposition tested against the corpus. Commitment to Cycle 3: the four layers must be operationalizable through a defined construct-and-cue scheme, and every coded category must map to exactly one layer without forcing.

Cycle 3 — Operationalization through GT-LR

Input: The four-layer architecture from Cycle 2 and a defined research question ("What architecture engenders and sustains justifiable digital trust in AI systems?"). Output: 10 L1 constructs and 127 L2 cues, derived through Wolfswinkel et al.'s (2013) five-stage grounded-theory literature review applied to a 56-source interdisciplinary corpus. This is the cycle in which the GTDS hybrid is materially executed; §04 of this document sets out the five Wolfswinkel stages as applied. Commitment to Cycle 4: the constructs and cues must be testable for theoretical grounding, internal consistency, coverage of the source concepts, and explanatory adequacy in documented cases.

Cycle 4 — Evaluation against four criteria

Input: The full framework from Cycle 3. Output: Evaluation against four independent criteria, each producing distinct evidence:

1. Theoretical grounding — every construct is traced to an established literature anchor (see the resource table in §16) or, where relevant, to a regulatory or professional framework synthesis; interpretations of constructs do not contradict their established usage in the source disciplines. The lineage is documented in the concept matrix (§17). The category-level grounding ratings reported in §07 are the researcher's qualitative assessment of evidential strength, not an inter-rater-validated score.
2. Internal consistency — the four layers do not overlap in ways that would make their architectural separation meaningless; the five derived design principles do not contradict each other when applied in combination. A constant-comparison protocol was applied to detect and resolve boundary cases (documented in the audit trail; see §18).
3. Coverage — a chronologically ordered plateau analysis on the 56-source corpus confirms that category emergence stabilizes within the corpus: 14 of the 15 axial categories surface within the first 14 sources, the 15th (AI-specific trust dimensions) emerges at source 41, and the remaining 15 sources enrich existing categories without introducing new ones. The plateau analysis is reported in §18.
4. Practical applicability (explanatory adequacy) — the framework can describe documented trust phenomena. Three illustrative cases — the Swiss e-ID referendum, the Coca-Cola/Apple AI marketing contrast, and the Deloitte Australia incident — were used to demonstrate that the framework can describe documented trust failures in terms practitioners would recognize as accurate. Predictive validity (does the framework predict trust outcomes in fresh cases?) is acknowledged as future work.

The four criteria are independent: a framework can be theoretically grounded yet internally inconsistent, internally consistent yet leave concepts in the corpus unaccounted for, comprehensively cover the corpus yet remain practically inapplicable, or practically applicable yet theoretically ungrounded. The framework satisfies all four by construction, though as §19 acknowledges, full empirical validation across diverse deployment contexts remains future work.

Mapping to Hevner's seven guidelines

04Wolfswinkel — five stages, applied

Wolfswinkel et al. (2013) prescribe a five-stage iterative procedure for grounded-theory literature review: Define, Search, Select, Analyze, Present. The procedure is what was executed inside DSR Cycle 3. This section sets out, stage by stage, what was actually done — including, where applicable, which Wolfswinkel recommendation was followed and which was deviated from with explicit justification.

Stage 1 — Define

1.1 Inclusion / exclusion criteria. Sources were included if they (a) addressed at least one of the five trust conceptualizations R1–R5 (see §6), (b) were authored by an academic researcher, an institutional standards body, or a policy authority with peer scrutiny, (c) were in English (with one German-language exception, Ripperger 2003, included for theoretical reach), and (d) were either foundational (≥500 citations for pre-2010 works) or current (post-2020 for AI-specific governance frameworks). Sources were excluded if they were marketing materials, news commentary, or opinion pieces — though several such sources are retained in the resource table marked as excluded from the GT corpus, included for illustrative use, since the chapter's case discussions cite them.

1.2 Fields of research. Seven disciplinary fields were identified: organizational psychology, information systems, economics and signaling theory, AI governance and ethics, human-computer interaction, complexity science and resilience engineering, and legal and regulatory studies. The seven-field span follows Wolfswinkel et al.'s (2013, p. 4) advice that interdisciplinary topics require explicit multi-field framing rather than implicit convergence.

1.3 Sources. Six academic databases were consulted: Scopus, Web of Science, ACM Digital Library, IEEE Xplore, PsycINFO, and Google Scholar. Government and standards bodies (NIST, EU institutions, IIA, OECD, FINMA, W3C, C2PA, Trust over IP Foundation) were consulted directly for institutional sources not indexed in academic databases.

1.4 Search terms. Search strings were constructed around three axes — trust × digital/AI × discipline — using Boolean combinations of: trust, trustworthiness, distrust; digital, AI, artificial intelligence, algorithm*, automation; and discipline-specific anchors (e.g. "organi?ational trust", "e-commerce trust", "technology-mediated trust", "human-AI interaction", "AI governance", "resilience engineering"). The strings listed here are a representative reconstruction of search practice across the iceberg.digital research project, not a verbatim historical record (see Stage 3 below for the full retrospective-reconstruction note). Wolfswinkel et al. (2013, p. 4) explicitly require that "all the used search terms need to be listed in the review article"; the production of an exhaustive per-database query log is identified as an open task for future revisions of this page.

Stage 2 — Search

Searches were executed in three waves. The first wave, organized by the R1–R5 conceptualization framework, retrieved foundational works in each domain; the second wave used backward and forward citation tracing from anchor sources (Mayer et al. 1995; McKnight et al. 2002; Schlicker et al. 2025); the third wave addressed gaps identified during axial coding (e.g. the addition of Affective Trusting Beliefs as a 10th construct triggered targeted searches for McAllister 1995 and Glikson & Woolley 2020). Wolfswinkel et al. (2013, p. 4) explicitly warn against performing forward and backward citation tracking too early — a concern about wasted effort tracking citations of articles that will not be selected — and the three-wave structure addresses that concern by deferring citation tracking until anchor sources are confirmed.

Stage 3 — Select

The selection was iterative, embedded in the broader iceberg.digital research project, and produced 56 sources formally coded against the R1–R5 scaffold drawn from a wider consulted bibliography of approximately 331 sources (Appendix, §21).

This retrospective approach is methodologically defensible. Sein, Henfridsson, Purao, Rossi & Lindgren (2011, MISQ) explicitly accept that methodology in design-oriented research is articulated during and after the research, not only before it. Strauss & Corbin (1998, p. 28) likewise note that the grounded-theory procedure "is not as linear as the description suggests." What is required is honest disclosure of the retrospective character, plausibility of the reconstructed practice, and verifiability of the output corpus — all three of which this page satisfies.

What is fully traceable is the output of the selection: the 56 formally coded sources are listed in §16 with R1–R5 mapping, discipline, and reason for selection; the wider consulted bibliography is listed alphabetically in §21 (Appendix); the construct-cue traceability is articulated by the author in the framework specification (§13 of this document). A reviewer can verify the 56 against §16, the ~331 against §21, and the construct-derivation logic against §13 (cue taxonomy) — this verifiability carries the methodological burden in place of the absent forward log.

The selection was governed by three principles, applied iteratively rather than sequentially:

1. R1–R5 coverage. Every L1 construct in the framework had to be traceable to at least one source in each applicable R-type.
2. Disciplinary breadth. Sources were drawn across the seven fields described in §04 Stage 1; no single discipline was permitted to dominate construct anchoring.
3. Coverage plateau under constant comparison. Sources were added until additional sources produced no new categories. A first-touch plateau analysis at the 56-source corpus level (§18) identifies the 14-of-15 plateau at source #14 (Lewicki, McAllister & Bies, 1998) and the full 15-of-15 plateau at source #41 (Lankton, McKnight & Tripp, 2015) — the late C15 emergence reflects the historical timing of AI-trust as a distinct research category. The framing is deliberately conservative — Glaser & Strauss (1967) and Wolfswinkel et al. (2013) treat literature-review saturation as a contested ideal — so the work reports a plateau, not a Glaserian saturation claim. The analysis is built from the resource table (§16) and concept matrix (§17).

The selection was performed by a single coder; Wolfswinkel et al.'s (2013, p. 5) recommendation of inter-coder reliability with ≥ 90% overlap among at least two coders was not satisfied. Documented constant comparison, paradigm mapping, and internal consistency checking were applied as partial mitigations. The methodological commitment forward is to maintain a formal forward-selection log alongside coding from the start in v3 of the framework.

Stage 4 — Analyze (the three coding phases)

The Analyze stage is the heart of the GT-LR effort. The three coding phases of Strauss & Corbin (1998) — open, axial, selective — were executed in the intertwined fashion Wolfswinkel et al. (2013, pp. 6–7) describe.

4.1 Open coding

Each source was read in full. For every trust-relevant claim encountered, an in-vivo or descriptive code was created with: a short label, a definition, the source passage, and the discipline of origin. Open coding produced trust-related concepts across seven disciplinary domains plus a transversal eighth (trust dynamics and temporal processes); the discipline-level distribution as tallied during coding is shown in §06. A flat enumeration of every individual code was not preserved as a separate persistent artifact, consistent with Strauss and Corbin's (1998) treatment of open codes as raw material that is rapidly subsumed into axial categories during the second cycle. The persistent artifacts of the coding pass are therefore the 15 axial categories (§07, with their core concepts named), the 10 L1 constructs (§09), and the 127 L2 cues (§13, each individually named with theoretical anchor). The coding unit was the conceptual claim rather than the textual passage — a passage frequently produced multiple in-vivo codes when distinct claims were embedded in its argument; conversely, a single claim recurring across multiple sources was coded once, with cross-source references retained for traceability.

4.2 Axial coding

Codes were grouped into categories based on shared properties and dimensions, using Strauss & Corbin's coding paradigm (conditions, actions/interactions, consequences) as the structuring device. Each category was anchored to specific conditions under which the trust phenomenon arose, the actions or interactions through which it operated, and the consequences it produced for trust formation. The result was 15 emergent categories:

1. Trustworthiness Beliefs (ABI+P)
2. Dispositional Trust
3. Institutional Trust
4. Trust Intentions and Behavior
5. Brand and Reputation Signals
6. Fair Exchange and Reciprocity
7. Privacy, Security and Technical Trust Infrastructure
8. Social Proof, Reputation, and Community Trust Mechanisms
9. Governance and Organizational Accountability
10. Perceived Risk
11. Affective Trust
12. Trust Dynamics and Lifecycle
13. Trust Repair
14. Distrust as Separate Construct
15. AI-Specific Trust Dimensions

Constant comparison was applied throughout. Each new source was coded against existing categories before adjustments to the category structure were considered. Where a source produced data that did not fit cleanly, the choice was between extending the category boundary, refining the category definition, or introducing a new category — with the third option exercised only when extension and refinement could not accommodate the data.

4.3 Selective coding

The 15 categories were integrated around the core category of digital trust formation, then consolidated into the framework's 10 L1 constructs through nine documented design decisions:

Stage 5 — Present

The Present stage in Wolfswinkel et al. (2013, pp. 8–9) requires representing the content (Step 5.1) and structuring the article (Step 5.2). The framework's content is represented through (a) the iceberg architectural diagram, (b) the construct/cue taxonomy in §13 of this page, (c) the resource table in §16 of this document, and (d) the concept matrix in §17 of this document. The article structure is realized in this methodology page, which functions as the standalone audit trail of the framework. Wolfswinkel's emphasis on the disclosure of "key choices made during the review process" is satisfied through the audit trail (§18), the nine consolidation decisions (above), and the explicit acknowledgment of single-coder limitation (§19).

05The R1–R5 organizing scaffold

The corpus was sampled and the categories were assessed against five relationship-typed conceptualizations of digital trust (R1–R5). The scaffold ensures disciplinary breadth without privileging any single trust tradition. Wolfswinkel et al. (2013, p. 3) permit a "well-marked scope" as a reference point for review decisions; the R1–R5 framework is that reference point in this study.

The five conceptualizations matter for framework design because a corpus drawn exclusively from any single R-type would produce a systematic blind spot. R1-only corpora overrepresent interpersonal trustworthiness beliefs (ability, benevolence, integrity) while neglecting technical infrastructure (R3), interface design (R4), and individual difference (R5) dimensions that are critical in digital contexts. The R1–R5 scaffold ensures every L1 construct in the framework is traceable to at least one conceptualization, and that no conceptualization is systematically underrepresented.

A reflexive caveat: pre-organizing the corpus by R1–R5 introduces a confirmation-bias risk — the categories that emerge from coding may be partly pre-shaped by the categories that drove sampling. The risk was mitigated by allowing axial coding to produce categories that did not map cleanly onto any single R-type (e.g. Governance, Resilience & Assurance is a cross-R category; Perceived Risk is an environmental moderator that does not sit in any R-type). The mitigation is partial; full reflexive treatment would require an independent re-coding without the R1–R5 scaffold, which is identified as future work.

07The 15 emergent categories

Axial coding regrouped the open codes into 15 natural categories using the constant-comparison protocol (Glaser & Strauss, 1967) and the Strauss-Corbin paradigm of conditions, actions/interactions, consequences. The 15 categories are listed below with their disciplinary origin, core concepts (a representative selection of the most analytically central codes per category), key sources, and academic grounding rating (1–5, where 5 indicates a category whose grounding rests on multiple top-tier validated sources).

Categories C12–C15 received the lowest grounding ratings (3/5 in two cases) because their underlying concepts are evolving rapidly with the AI-trust literature. They are real findings of the coding pass, and the rating expresses the strength of established empirical grounding rather than the strength of the concept itself. The 15 categories were subsequently consolidated into the 10 L1 constructs through nine documented design decisions (already listed in §02 above).

08Academic grounding assessment

Each of the 10 L1 constructs was rated on the strength of its academic grounding, where 5/5 denotes a construct whose grounding rests on multiple top-tier, multiply-replicated sources, and 4/5 denotes a construct grounded in a domain that is extensively researched but where the construct itself is a deliberate consolidation rather than a single-source canonical concept. None of the 10 constructs received less than 4/5; this is a methodological commitment of the framework rather than an accidental outcome — constructs that could not clear the 4/5 threshold were either consolidated into another construct or relegated to the cue layer.

The grounding ratings should be read alongside §17 (concept matrix), which shows how each construct's primary anchors distribute across the corpus. Constructs at 5/5 receive primary marks from 4–6 different sources in the matrix; constructs at 4/5 typically receive primary marks from 3–5 sources, with the consolidation rationale explicit in the design-decisions table (§02).

10Contextual moderation — the waterline

Perceived risk is not a construct in the framework but the environmental moderator that makes the entire framework meaningful. In the iceberg metaphor, perceived risk is the water. However, the water is not uniform — it has measurable properties that vary by context, culture, domain, and user segment. Together these properties form a Contextual Moderation Layer at the waterline. The moderator is what Decision D6 (§02) elevated out of the construct space and into a distinct semantic position.

Three core mechanics

1. The water determines visibility. In low-risk situations (shallow water) most of the iceberg is visible — users do not scrutinize trust cues carefully because stakes are low. In high-risk situations (deep water) only the tip is visible — users examine every available cue because consequences of misplaced trust are severe. This is consistent with the Hoffmann, Lutz & Meckel (2014) report that risk-aware users pay more attention to reciprocity cues, while risk-tolerant users rely more on brand heuristics.
2. The water refracts the cues. The same trust cue is perceived differently depending on risk context. A third-party endorsement is a strong signal in a low-risk context (browsing a news site) but may be insufficient in a high-risk context (sharing medical data). This is the cue-utilization mechanism from Schlicker et al.'s (2025) TrAM.
3. The water applies pressure. Pressure increases with depth. Perceived risk applies pressure on below-waterline constructs: high risk raises the threshold that Trusting Beliefs must reach before translating into Trusting Intentions and Behaviors. This maps to Mayer et al.'s (1995) risk-moderation finding.

Four water properties

The water around the iceberg is not uniform. Four contextual parameters modulate how cues are perceived, weighted, and processed. They do not change the shape of the iceberg (the cue taxonomy stays constant) but they change how the iceberg is experienced by the trustor.

A warm current (high-trust culture) makes the waterline rise, exposing more of the iceberg: more cues are accepted at face value. A cold current (low-trust culture) pushes the waterline down, submerging more cues beneath scrutiny.The metaphor's mechanics, articulated by the author

Theoretical basis. Mayer et al. (1995, p. 726): risk is a property of the situation, not of trustor or trustee. Kim, Ferrin & Rao (2008): trust antecedents operate through dual pathways, simultaneously building trust AND reducing perceived risk through separate mechanisms. Rousseau et al. (1998, p. 395): without risk, trust is unnecessary. Fukuyama (1995): trust radius varies by culture. Hoffmann, Lutz & Meckel (2014) and Hoffmann, Lutz & Ranzini (2024): user segments process trust cues through qualitatively different strategies.

11Dynamic process layer

The Process Layer is a temporal overlay that augments the static framework without replacing it. It models three processes that operate continuously on the iceberg's constructs: Trust Formation, Trust Calibration, and Trust Repair. The Process Layer is what Decision D8 (§02) created — it captures Categories C12 (Trust Dynamics & Lifecycle) and C13 (Trust Repair) without forcing them into the static construct space.

Process 1 — Trust Formation

Trust formation progresses through three stages following Lewicki & Bunker (1995, 1996):

• Calculus-Based Trust: rational cost–benefit evaluation, driven by above-waterline cues. Trust at this stage is fragile and contingent on continuing positive interactions.
• Knowledge-Based Trust: accumulated experience enabling behavioral prediction, corresponding to Trusting Beliefs (TB). Trust at this stage is more stable but still rests on continued conformity to expectations.
• Identification-Based Trust: value alignment and shared identity, mapped to Brand cues B01 (Brand Ethics & Moral Values), B12 (Heritage & Longevity), B14 (Localized & Inclusive Expressions). Trust at this stage is robust to occasional violations.

Not all relationships progress through all stages. Most digital-platform trust relationships stabilize at the calculus or knowledge stages; identification-based trust requires sustained brand investment and value alignment, characteristic of long-term customer relationships rather than transactional encounters.

Process 2 — Trust Calibration

Trust calibration is the ongoing adjustment of perceived trustworthiness in response to new evidence. It depends on four factors from the Schlicker et al. (2025) Trustworthiness Assessment Model: cue relevance, cue availability, cue detection, and cue utilization. Calibration dynamics include active search, cross-validation, and intuitive adjustment. Lee & See (2004) provide the foundational treatment of trust calibration in human–automation interaction; Castelfranchi & Falcone (2010) provide the socio-cognitive computational treatment. The Contextual Moderation Layer (§10) parameterizes calibration: cultural trust radius, domain sensitivity, and user segment all influence which cues are detected and how they are weighted during calibration.

The Trust State Vector

Trust Calibration maintains a dimensional trust state for each trustor–trustee relationship. Drawing on McKnight & Chervany's (2001) finding that trust and distrust are independent dimensions (not opposite poles of a single continuum), and Lewicki, McAllister & Bies's (1998) demonstration that a trustor can simultaneously trust one dimension while distrusting another, the calibration process tracks each Mayer dimension independently:

This formulation operationalizes distrust without requiring a separate distrust construct, consistent with Decision D9 (§02). It is also compatible with the Lewicki, McAllister & Bies (1998) view that trust and distrust are independent dimensions rather than opposite poles of a single continuum.

Process 3 — Trust Repair

Different violation types require different repair strategies. Kim, Ferrin, Cooper & Dirks (2004) demonstrated that competence-based violations respond to apology + corrective action, while integrity-based violations respond to denial + evidence of principles. Repair strategies target specific cracks in the Trust State Vector: a competence-apology aims to move the competence dimension from −1 back toward +1; an integrity-denial aims to restore the integrity dimension. The choice of repair strategy is not interchangeable — applying an integrity strategy to a competence violation, or vice versa, typically deepens distrust rather than repairing it.

The Process Layer does not replace the static construct architecture; it operates on it. Trust Formation creates the Trust State Vector; Trust Calibration maintains it; Trust Repair attempts to restore it after specific violations. All three processes interact with the Contextual Moderation Layer (§10), which sets the threshold conditions under which formation, calibration, and repair operate.

12L2 cue derivation methodology

The L2 cues are observable, designable indicators that operationalize each of the 10 L1 constructs. Cues are not a Strauss-Corbin tier; they are a DSR artifact-level commitment specific to GTDS, in which constructs must be operationalizable. The derivation followed two distinct pathways depending on whether the construct sits above or below the waterline.

Above-waterline cues — dual-source derivation

The L2 cues for the five above-waterline constructs (R, B, TI, ST, GOV) were derived through two complementary processes:

Source 1 — practitioner-informed empirical input. The initial cue sets for Reciprocity (R), Brand (B), Technical Trust Infrastructure (TI), and Social Trust Mechanisms (ST) were derived from a practitioner-developed structured instrument under iterative expert consultation. The instrument was designed to capture the full range of trust-relevant cues that digital platform users encounter. This produced an initial pool of 72 candidate L2 cues across the four constructs. The instrument has not yet been administered to an external sample; in the present work the item pool functions as a structured prompt for cue derivation, not as a triangulating measurement source. Full psychometric validation (pilot, EFA, CFA) is identified as future work.

Source 2 — design-science synthesis of regulatory and professional frameworks. The Governance, Resilience & Assurance (GOV) construct was developed through a design-science process (Hevner, March, Park & Ram, 2004) that synthesizes five independent regulatory and professional frameworks: the HLEG-AI Assessment List for Trustworthy AI (ALTAI, 2020), NIST AI RMF 1.0 (2023), the EU AI Act (2024), the IIA Three Lines Model (2020), and resilience engineering principles (Hollnagel, Woods & Leveson, 2006). The author articulates the synthesis; the present page operationalizes it as 26 L2 cues. The external frameworks carry the theoretical weight. The derivation proceeded through three phases:

1. Open coding of the five external frameworks plus the author's prior articulations produced 50 governance-related codes.
2. Axial coding: codes were grouped into three sub-dimensions (Adaptive Governance, Organizational Resilience, Continuous Digital Assurance) based on functional relationships and constant comparison.
3. Internal consistency check: each cue was examined for distinctness from its neighbors (constant comparison, Glaser & Strauss, 1967) and for coverage of governance concepts present in the external source frameworks. Boundary cases with explicit decision rationales are documented in §14.

Cross-validation. All L2 cues were validated against the full R1–R5 literature corpus to confirm academic grounding and identify gaps. This cross-check produced additional cues in four constructs: AI-specific reciprocity cues (R19–R20), AI provenance and developer reputation cues (B04, B06), AI trust-infrastructure cues (TI01–TI06), LLM governance cues (GOV20–GOV25), and affective trust cues (ATB01–ATB05). The cross-check fills the most consequential gap exposed by the v1 framework: AI-specific phenomena that were not fully captured by the trust literature pre-2020.

Workforce-impact gap closure. A secondary cross-check against the HLEG-AI Assessment List for Trustworthy AI (ALTAI, 2020) Requirement 6.2 (Impact on Work and Skills) surfaced a workforce-impact gap not covered by the AI-specific cross-check above. Three additional cues were introduced to close it: GOV26 (Workforce Transition & Reskilling Commitments) on the governance side, TI21 (Augmentation-First Design Intent) on the product-design side, and ST18 (Job Impact Transparency) on the communication side. These three cues are wired to the practice-category layer through the ALTAI Section 6 (Societal & Environmental Wellbeing) requirements and align the framework with the ALTAI self-assessment checkpoints.

Below-waterline cues — literature-derived

The five below-waterline constructs carry 4 to 7 L2 cues each, directly derived from established trust literature:

• Institution-Based (IB): Structural Assurance, Situational Normality (McKnight et al., 2002), Regulatory & Legal Framework, Intermediary & Platform Trust (Pavlou & Gefen, 2004; Söllner et al., 2016).
• Trusting Beliefs (TB): 7 cues structured as two contextually activated lenses. Human-like lens (4 cues): Competence, Benevolence, Integrity (Mayer et al., 1995), Predictability (McKnight et al., 2002). System-like lens (3 cues): Functionality, Reliability, Helpfulness (Lankton, McKnight & Tripp, 2015). For AI systems both lenses may operate simultaneously: TB-H for the deploying organization, TB-S for the AI product itself.
• Affective Trusting Beliefs (ATB): Emotional Resonance, Perceived Empathy, Interpersonal Comfort, Affective Attachment, Relational Interaction Design (McAllister, 1995; Glikson & Woolley, 2020; Schlicker et al., 2025; Bickmore & Cassell, 2001).
• Disposition to Trust (DT): Faith in Humanity, Trusting Stance (McKnight et al., 2002), Risk Propensity (Mayer et al., 1995), Technology Readiness & Prior Experience (Riedl, 2022; Hoff & Bashir, 2015).
• Trusting Intentions & Behaviors (TIB): Willingness to Depend, Information Sharing Behavior, Delegation & Advice Following, Transactional Commitment (McKnight et al., 2002; Gefen, Karahanna & Straub, 2003; Pavlou, 2003).

Each cue is documented with six fields: cue_id, cue_name, definition, rationale, engender_description (trust-building), and erode_description (trust-damaging). The complete cue set is listed in §13.

14Internal consistency check

Each L2 cue was examined through a constant-comparison protocol (Glaser & Strauss, 1967; Charmaz, 2006) to test construct boundaries and coverage. This is an internal consistency check, not a claim of formal ontological axiom checking in the Gruber (1993) or Guarino & Welty (2002) sense — that would require a different methodological apparatus. The work documented here is constant-comparison boundary validation.

Construct boundary distinctness

No two cues within the same construct are intended to overlap in scope. Boundary cases were resolved through explicit scoping decisions documented below:

Coverage of source concepts

All trust-related concepts from the source corpus map to at least one cue. Unmapped concepts were either subsumed under existing cues or triggered new cue creation. Examples of cues that emerged from the cross-validation pass include: GOV18 Stakeholder Engagement (added when participatory governance was identified as a gap, consistent with Floridi & Cowls 2019); B14 Localized & Inclusive Expressions (added when intersectional inclusion concerns surfaced from Hoffmann, Lutz & Ranzini 2024); and ATB05 Relational Interaction Design (added to cover the rapport-building work of Bickmore & Cassell 2001 and Hancock, Naaman & Levy 2020).

15Preliminary evidence and status of empirical validation

The present work establishes construct validity through theoretical grounding and internal consistency checking. Independent empirical validation of the full framework — predictive validation through SEM, CFA, or prospective behavioral studies — is identified as a priority for future research. The studies reviewed below provide preliminary evidence consistent with the framework's above/below waterline distinction and assessment-process architecture, but they are not direct tests of the Iceberg Trust Model.

Preliminary evidence from adjacent trust literature

The above/below waterline distinction (visible cues driving hidden beliefs, in turn driving intentions) is consistent with the dual-pathway findings of Kim, Ferrin & Rao (2008) and the TAM-trust integration of Gefen, Karahanna & Straub (2003). For human–AI and human–automation trust specifically, Glikson & Woolley (2020) provide a meta-review consistent with the multi-source cue architecture used here, and Hoff & Bashir (2015) provide an integrative review of trust factors that maps cleanly onto the dispositional / situational / learned tripartite from the dynamics literature. These are convergent findings in the adjacent literature, not direct tests.

Schlicker et al. (2025) — TrAM and accompanying qualitative study

The Trustworthiness Assessment Model (TrAM) and the accompanying qualitative study are consistent with the above/below waterline distinction and elaborate the assessment processes the framework captures:

• Participants used three calibration strategies (active search, cross-validation, intuitive adjustment), consistent with the Trust Calibration mechanism in §11.
• Individual standards mapped to framework constructs: technical functionality to GOV, privacy to TI, third-party trustworthiness to ST and GOV17.
• Aesthetics as trust meta-standard: design quality functions as a gatekeeper that determines whether deeper trust assessment begins, consistent with B10 (Design Quality & Aesthetics).
• Participants expected empathy and interpersonal connection from AI agents, consistent with the inclusion of Affective Trusting Beliefs (ATB) as a distinct construct.

Hoffmann, Lutz & Meckel (2014) — grounding for Decisions D2 and D3

Hoffmann, Lutz & Meckel (2014, Journal of Management Information Systems) report a structural-equation-modeling study of online trust among German Internet users. That study is cited as grounding for the construct-level decisions to elevate Brand and Reciprocity to distinct L1 constructs (D2 and D3 in §02); it is not claimed here as independent empirical validation of the present framework, because using grounding sources as validation sources would be a discovery–confirmation circularity (Meehl, 1978). The specific path coefficients and sample size in that study should be verified against the primary source for any downstream publication.

Status of empirical validation

The framework therefore stands on three claim-tiers:

1. Construct validity through theoretical grounding (the resource table, §16; the concept matrix, §17) and internal consistency (§14). This is established.
2. Convergent validity through preliminary evidence in adjacent trust literature and the Schlicker et al. (2025) qualitative study. This is suggestive, not conclusive.
3. Predictive validity — does the framework predict trust outcomes in prospective behavioral data — requires separate empirical investigation. Predictive validation is identified as the next methodological priority and is not claimed by the present page.

15.5Empirical validation pipeline — incidents and best practices corpus

The construct-derivation work documented in §04–§09 was performed by a single coder. The cue-application work — applying the resulting 127-cue catalog to documented trust phenomena — runs under a separate methodological architecture: a continuously-operating classification pipeline that ingests incidents and best practices from primary sources, classifies each row through a four-eyes protocol with a third-coder adjudicator, and writes outcomes to a controlled-vocabulary curation ledger. This section documents the pipeline's gates, instrumentation, and live exclusion distribution as of the cut date below. The pipeline answers a different question from the construct-derivation work: not "are the constructs theoretically grounded?" (§14, §15) but "does the cue catalog actually classify documented phenomena reliably and with adequate coverage?"

The methodological separation between construct-derivation (single-coder, theoretical) and cue-application (four-eyes, empirical) is deliberate. The construct layer is held fixed during classification. Zero-cue cases are not silently re-coded against an expanded catalog; they post to a separable refinement signal that feeds the cue-living-artefact governance protocol documented in §13. Validation evidence and refinement evidence are therefore generated as distinct data streams, addressing the circularity problem inherent in using the same cases to both validate and refine a framework.

Cut date: figures and exclusion distributions reported in this section reflect pipeline state as documented in the operational corpus-selection-bias documentation. Pipeline state advances continuously; subsequent versions of this page will report updated figures with cut-date stamps.

Pipeline architecture

Both incident and best-practice rows land in a single trust_incidents table distinguished by a trust_valence field. Identity, provenance, sourcing, and narrative fields are shared across valences; the classification payload diverges because the two phenomena answer different questions (what kind of trust was broken? what kind of trust was built?). Database-enforced valence exclusivity guarantees the two payloads never commingle: a best-practice row with severity set, or a violation row with practice-category set, is rejected at insert.

Every candidate row is fetched via Trafilatura page-content scraping, stamped with data_source, primary and secondary source URLs, and reference URLs. If scraping fails (HTTP error, empty body, wrong page type, image content type), the row is parked with corpus_exclusion_reason = "Scraping failed: status=..." rather than silently dropped. Every row carries provenance fields: pipeline_version, prompt versions for each classification phase, rubric_version, cue_catalog_version, ontology_version, model identifiers for each coder, and a per-field *_rationale required by the schema and written by both coders independently.

Sources by valence

Universal inclusion gates (both valences)

1. Deduplication. A unique index on md5(summary + entity + source) blocks duplicate inserts at the database layer. Post-hoc passes catch entity-name variants (OpenAI vs. Open AI Inc.).
2. Entity attribution. Rows where affected_entity_name is null, "Unknown", a generic placeholder, or shorter than four characters are excluded with corpus_exclusion_reason = entity_unknown. A defensible case requires an attributable entity.
3. Substantive content. Rows whose incident_summary + detailed_description total fewer than 800 characters after sanitization are excluded as weak_substance. Empirically, below 800 characters the cue classifiers return zero cues at > 70% rate.
4. Four-eyes classification must complete. Two independent LLM coders — Rex (Claude Haiku 4.5) and Cora (GPT-5-mini) — each classify the row through phases 5a/5b/5c/5d. If retrieval, classification, and adjudication all complete and the card would land with zero cues, the pipeline writes a pipeline_escalations row with reason='no_cues_identified' rather than ship empty. Zero-cue is treated as a failure signal (retrieval gap, classifier confusion, or genuinely off-framework phenomenon), never as truth.
5. Disagreement adjudication. A third LLM (Claude Sonnet 4.6) adjudicates when Rex and Cora diverge. Escalation thresholds: cue Jaccard similarity < ~0.5; ordinal delta ≥ 2 on severity / capability / character; primary OECD violation-subtype mismatch; Annex III regulated sector (law enforcement, biometrics, healthcare, credit, employment), which auto-escalates even when Rex and Cora agree; adjudicator confidence < 0.75, which routes the row to a human review queue.
6. Inter-rater reliability target. Gwet AC1 ≥ 0.75 on the binary cue grid (kappa-paradox robust per Gwet, 2014; Wongpakaran et al., 2013). Below this, the run is treated as unreliable and held back from canonical write. Cohen's quadratic-weighted kappa is computed on ordinal fields (severity, impact magnitude, capability/character reputation); Krippendorff's α is computed as a cross-check.

Best-practice-only gates

A best practice must not just describe a commitment — it must demonstrate evidence of follow-through. Four additional gates fire after the universal gates have cleared:

1. policy_announcement_only. The detailed description does not contain at least two distinct named-artefact keywords from a controlled list (model card, system card, transparency report, trust center, audit / audited / auditor, ISO 42001, SOC 2, GDPR, conformity assessment, framework, playbook, retrospective, white paper, watermark, C2PA, red team, bug bounty, executive order, EU AI Act, etc.). A best practice that names no concrete published artefact is indistinguishable from a press release.
2. aspirational_no_outcome. The description contains intent verbs ("we are committed", "we strive", "our vision") but fewer than two outcome / mechanism keywords (reduced, increased, audited, certified, deployed, adopted by, in production since, established, operationalized, launched, withdrawn, complies with, evaluated, monitored, fine-tuned, rolled out). Distinguishes "no artefact named" from "artefact mentioned but no follow-through evidence."
3. low_cue_density. Phase 5a returned fewer than two present=true cues at confidence ≥ 0.80. A single-cue practice is treated as having insufficient evidential breadth to qualify as a defensible best practice.
4. cue_breadth_inadequate. All firing cues sit in the same L1 construct (e.g., all under Governance, none under Brand or Technical Trust Infrastructure). Single-axis fulfillment is too narrow under the framework's multi-construct lens.

A best-practice row is accepted into the canonical corpus only when zero gates fire across the universal and best-practice sets.

What is captured per row

Each row carries a shared spine of identity, sourcing, and narrative fields plus a valence-specific payload. The shared spine includes capability and character reputation baselines (1–5, four-eyes with k=3 self-consistency), the five L2 cue arrays mapped to the 127-cue catalog and the iceberg L1 construct array, a CTB tri-vector (bottom-up cue-derived, top-down LLM-derived narrative, reconciliation notes), and the full provenance stamp. Per-field rationales are required by the classification schema and written independently by both coders.

The violation payload adds severity (1–5, anchored to an ontology table from Minor to Catastrophic), a three-lens violation typology (Mayer-Davis-Schoorman macro, OECD subtype, Holweg axis derived via mapping), a CTB violation breakdown across competence / integrity / benevolence, three independent reputation-damage classifications (rule-based, NLP, media-perception per Holweg, 2022), the response-and-mitigation chain, an algorithmically derived repair-strategy recommendation per Kim, Ferrin, Cooper & Dirks (2004), and EU AI Act / NIST AI RMF risk-category tags.

The best-practice payload adds an impact magnitude (1–5, Minor Gesture to Transformative), a primary and secondary trust contribution (Competence-Building / Integrity-Building / Benevolence-Building / Competence-Integrity-Building / Systemic-Building), a CTB contribution breakdown, and a five-axis 5d practice taxonomy (~33 controlled values total): practice category (16 values: governance, transparency, fairness, privacy, safety, open source, accountability, user empowerment, environmental, inclusion, human oversight, cybersecurity, reliability, stakeholder participation, workforce impact, societal impact), implementation maturity (Announced → Piloted → Operational → Industry Standard), evidence strength (Self-Reported → Press Release → Public Page → Published Report → Third-Party Verified), impact scope (Internal → Product → National → Global), and practice sustainability (One-Time → Periodic → Ongoing → Institutionalized).

Analytics running on the canonical corpus

Several analytics run continuously on the canonical (non-excluded) rows. Each is documented in its own module specification; the list below names the analytics and what each measures.

• Iceberg digital trust score. Per-row rollup across the five surface constructs (Reciprocity, Brand, Technical Trust Infrastructure, Social Trust Mechanisms, Governance) and five deep constructs (Identity-Based, Trust-Based, Affect-Based, Disposition Trust, Trust-In-Brand). Cue weights drive a weighted score; a defensibility threshold of ≥ 7 firing cues per card is applied.
• Holweg quadrant analysis. Dual treemap rendering ontology constructs against the Privacy / Bias / Explainability axes via keyword classifier (Holweg, 2022).
• CTB tri-vector dashboards. Per-row comparison of the three CTB classifications (bottom-up deterministic, top-down LLM, three-way damage perception via rule-based / NLP / media for violations). Divergence is rendered prominently with the Reeder-Brewer and Kim et al. interpretive frame.
• Inter-rater reliability dashboard. Computed every run, reported per phase and per field: Gwet AC1 on the binary cue grid (primary gate); Cohen's quadratic-weighted kappa on ordinals; Krippendorff's α as cross-check; cue Jaccard Rex↔Cora per row. Below threshold the row escalates to the Sonnet adjudicator; below 0.75 adjudicator confidence the row routes to a human queue.
• Coverage analytics. Per data_source × industry × country × year: case counts, acceptance rate, top exclusion reason, IRR scores. Always rendered alongside the exclusion histogram so users can distinguish low-event from low-documentation jurisdictions.
• Severity / impact distributions. Histogram of severity (violations) and impact magnitude (best practices) sliced by industry, OECD subtype, Annex III flag, autonomy level.
• Trust-repair classifier. Per Kim, Ferrin, Cooper & Dirks (2004): violations receive an algorithmically derived repair_strategy_type (apology + correction / denial + reframing / reparation + empathy), surfaced as the "Trust Repair Recommendation" section.
• Schema map (frozen baseline) and field schema audit. Snapshots which columns existed and what they meant on date X, so future schema deltas are tracked against a baseline; live fill-rate analysis per field, sliced by valence, surfaces data gaps.
• Corpus selection bias dashboard. Renders the exclusion histogram per source, cohort acceptance rates, and the three documented bias directions. Bias is queryable rather than narrative.

Live exclusion distribution (best-practice rows)

Of approximately 3,000+ parked best-practice rows, the exclusion-reason distribution is as follows. Most parks are legitimate quality gates rather than pipeline failures — re-running them will not lift them without upstream data improvements.

Re-admission path

Rows excluded for weak_substance or policy_announcement_only can be re-classified after a deeper scrape provides article-body content. The pipeline re-evaluates the row through phases 5a → 5b → 5c → 5d. The corpus_excluded flag clears if the new classification produces ≥ 1 cue (violations) or passes all gates (best practices). Other exclusion reasons — entity_unknown, aspirational_no_outcome, cue_breadth_inadequate — are sticky: clearing them requires upstream data quality work, not just re-scraping.

Acknowledged biases

Three biases are documented as queryable properties of the corpus rather than narrative disclaimers:

• Toward documented cases. Primary-source cases (audit reports, regulator findings, model cards, the OECD registry, peer-reviewed retrospectives) survive; one-line news headlines do not. Jurisdictions with weaker investigative journalism are systematically under-counted.
• Toward Iceberg-framework-tractable phenomena. The 127-cue catalog operationalizes Mayer-Davis-Schoorman + the MIT AI Risk Repository + NIST AI RMF. Trust dynamics outside these frameworks (emergent multi-agent dynamics, non-Western trust epistemologies) get filtered as zero-cue. This is a real finding, not just a limitation: clustering of zero-cue escalations by phenomenon type is empirical evidence of cue-catalog blind spots and feeds the cue-living-artefact protocol in §13.
• Toward implemented best practices, away from aspirational ones. Explicit by design via gates D1 and D2.

Designed but not yet live

Several analytics are designed but not yet operational, pending either further data accumulation or methodological dependencies:

• Best-practice impact attribution. Once cue-level attribution is reliable, link a best practice at company X to a downstream reduction in similar violations (counterfactual: companies adopting practice P see Y% fewer violations of type V over Z months).
• Cross-jurisdiction trust posture index. Country-level aggregate combining best-practice density (per-capita defensible practices) minus violation severity-weighted index. Currently blocked by the rich-jurisdiction over-coverage bias.
• Annex III high-risk sector heatmap. EU AI Act conformity exposure: per-entity count of Annex III violations weighted by severity, paired with best-practice coverage gap on the same axes.
• Repair-strategy effectiveness audit. Empirical test of Kim et al. (2004) predictions: do entities that actually used the recommended repair strategy show better stakeholder-perception recovery (media-perception-damage trajectory) than those that did not?
• Cue-catalog coverage analysis. Periodic review of zero-cue exclusions to identify ontology gaps (phenomena the 127-cue catalog cannot see); surface these as candidate cues for the next ontology version under the §13 governance protocol.

Relationship to the rest of this methodology

The empirical validation pipeline sits alongside, not within, the four DSR cycles documented in §03. The four cycles describe how the v8 framework was constructed; the pipeline describes how the v8 framework is being applied to documented phenomena. Within the four-criterion evaluation (§03 Cycle 4), the pipeline strengthens the practical-applicability criterion: the three illustrative cases (Swiss e-ID, Coca-Cola/Apple, Deloitte) demonstrate that the framework can describe canonical cases, while the pipeline tests whether the framework classifies a much larger and continuously growing corpus reliably under a four-eyes protocol with an inter-rater reliability target.

Refinement signals from the pipeline (zero-cue clusters, cue-breadth-inadequate patterns, sticky exclusion combinations) feed the cue-living-artefact governance protocol in §13. Adopted refinements increment the cue catalog version (v8.1, v8.2, ..., v9). The construct layer is held fixed under the §13 architectural commitment; cue-layer refinements do not trigger framework-level re-versioning.

18Coverage-plateau analysis & audit trail

Wolfswinkel et al. (2013, p. 7) require that "theoretical saturation has occurred" before the analyze stage is closed — meaning that no new concepts, properties, or interesting links arise from the addition of further sources. Saturation in literature reviews is debated; Glaser & Strauss (1967) treat it as an ideal that is in practice constrained by time and resource. The framing used here is conservative: the work reports a conceptual coverage plateau, not a Glaserian saturation claim.

Method — plateau analysis at the 56-source corpus level

This section reports a coverage-plateau analysis run on the full 56-source primary corpus. The analysis tracks the chronology of category emergence using two transparency artifacts produced elsewhere in this document: the resource table (§16) provides year and author for each source; the concept matrix (§17) provides source × construct/layer/process/moderator marks. Sources are ordered by publication year, with ties broken alphabetically by first author. Other orderings — reverse-chronological, R-type clustered, citation-weighted — would yield different plateau points; the chronological choice tracks the historical development of the trust literature, which is the most common ordering in published GT-LR work.

Categories C01–C13 map directly to a single matrix column (e.g. C09 Governance → GOV; C10 Perceived Risk → WL waterline-moderator column; C12 Trust Dynamics → FORM or CAL process columns). A category was treated as first-touched by the earliest chronological source with any contribution (primary ● or secondary ○) in the corresponding column. Categories C14 (Distrust) and C15 (AI-Specific) do not have dedicated matrix columns — Decision 9 in §02 distributed them across existing constructs — so first-touch was identified by year-and-first-author match against the anchor-source list documented in §07.

Category-emergence sequence

Two plateau points

The analysis identifies two defensible plateau points, depending on whether C15 is included:

14-of-15 plateau at source #14 (Lewicki, McAllister & Bies, 1998). Categories C01–C14 — the entire "general trust" set — are first-touched within the first 14 chronologically ordered sources, i.e. 25% of the corpus. From source #15 onward, no further general-trust category emerges. This is well within the 12–25 case range Guest, Bunce & Johnson (2006) report as typical for thematic plateau in qualitative work.

Full 15-of-15 plateau at source #41 (Lankton, McKnight & Tripp, 2015). C15 — AI-Specific Trust Dimensions — does not first-touch until 2015, because AI-specific trust did not exist as a discrete research category in the published literature before then. This is a temporal artifact of the literature itself, not a methodological problem with the framework: any inductive coding of the trust literature constrained to publications before ~2010 would necessarily exclude C15. The honest interpretation is that the framework's AI-specific layer (Decision 9 in §02) is grafted onto a structure that was conceptually settled long before AI-trust research existed as a discrete domain.

What this analysis does and does not establish

The plateau analysis above is built from the existing transparency artifacts (resource table + concept matrix); it is not a fresh coding pass. It establishes that, given the matrix marks already documented and a chronological ordering, the framework's categorical scheme stabilizes at source #14 for the general-trust set and at source #41 for the full set including AI-specific dimensions. A formal saturation study in the Glaserian sense — iterative theoretical sampling driven by ongoing analysis — would still be a separate undertaking; this work does not claim to provide one.

Audit trail

The complete audit trail — including the search log, full source-by-category coding, the constant-comparison protocol, the nine consolidation decisions, and the coverage-plateau analysis — is contained within this single document. §16 (resource table), §17 (concept matrix), §18 (coverage-plateau analysis), §19 (limitations), and §21 (wider consulted bibliography) together form the complete audit trail.

19Acknowledged limitations

Hevner et al. (2004, p. 99) hold that "design-science research is perishable" and that the rigorous evaluation methods needed to defend its results are extremely difficult to apply. Wolfswinkel et al. (2013, p. 5) require that the review's limitations be made explicit. The list below is the honest accounting; each limitation is paired with an acknowledged mitigation and a flag for follow-on work in v3.

These limitations are honest, not concessive. They define the empirical research program that follows from the present work.The author's framing of the limitations

20Methodological references

References below are the methodological anchors for this page. The 56-source primary corpus is listed in §06 (resource table) and the wider consulted bibliography in §06b.

• Glaser, B. G., & Strauss, A. L. (1967). The Discovery of Grounded Theory: Strategies for Qualitative Research. Aldine.
• Guest, G., Bunce, A., & Johnson, L. (2006). How many interviews are enough? An experiment with data saturation and variability. Field Methods, 18(1), 59–82.
• Hevner, A. R., March, S. T., Park, J., & Ram, S. (2004). Design science in information systems research. MIS Quarterly, 28(1), 75–105.
• High-Level Expert Group on Artificial Intelligence (HLEG-AI). (2020). Assessment List for Trustworthy Artificial Intelligence (ALTAI) for self-assessment. European Commission. https://digital-strategy.ec.europa.eu/en/library/assessment-list-trustworthy-artificial-intelligence-altai-self-assessment
• March, S. T., & Smith, G. F. (1995). Design and natural science research on information technology. Decision Support Systems, 15(4), 251–266.
• Mayer, R. C., Davis, J. H., & Schoorman, F. D. (1995). An integrative model of organizational trust. Academy of Management Review, 20(3), 709–734.
• McKnight, D. H., Choudhury, V., & Kacmar, C. (2002). Developing and validating trust measures for e-commerce. Information Systems Research, 13(3), 334–359.
• Meehl, P. E. (1978). Theoretical risks and tabular asterisks: Sir Karl, Sir Ronald, and the slow progress of soft psychology. Journal of Consulting and Clinical Psychology, 46(4), 806–834.
• Schlicker, N., Baum, K., Uhde, A., Sterz, S., Hirsch, M. C., & Langer, M. (2025). How do we assess the trustworthiness of AI? Introducing the Trustworthiness Assessment Model (TrAM). Computers in Human Behavior, 170, 108671.
• Sein, M. K., Henfridsson, O., Purao, S., Rossi, M., & Lindgren, R. (2011). Action design research. MIS Quarterly, 35(1), 37–56.
• Strauss, A., & Corbin, J. (1998). Basics of Qualitative Research: Techniques and Procedures for Developing Grounded Theory (2nd ed.). Sage.
• Webster, J., & Watson, R. T. (2002). Analyzing the past to prepare for the future: Writing a literature review. MIS Quarterly, 26(2), 13–23.
• Wolfswinkel, J. F., Furtmueller, E., & Wilderom, C. P. M. (2013). Using grounded theory as a method for rigorously reviewing literature. European Journal of Information Systems, 22(1), 45–55.