---
id: c10-defensibility-map
title: Defensibility Map
module: GROW-S10
module_slug: grow-s10-commercialization-architecture
cluster: Coordination
type: map
version: v0.1.0
status: Gate-reviewed
tier: membership
contract_role: ""
canonical_url: "https://grow.goodcombinator.ai/library/registry/c10-defensibility-map"
download_url: "https://grow.goodcombinator.ai/library/registry/c10-defensibility-map.md"
license: CC-BY-4.0 (proposed — owner confirmation required)
source: GROW by Good Combinator
retrieved_at: 2026-05-29
---

# Defensibility Map

The Defensibility Map makes the moat / defensibility of a productized capability legible, measurable, and ownable. Most AI-capability commercialization efforts underinvest in moat construction because the team is focused on building features rather than accumulating advantages. This map forces explicit enumeration of each moat source, its current strength, the investment required to deepen it, and the risks that erode it. Moat types recognized in the glossary are: proprietary workflow, data advantage, distribution, integrations, compliance moat, and operational expertise. Each type has a different construction timeline and different decay rate. The compliance-moat category draws directly on `t7-govtech-package` artifacts: jurisdiction rule layers, audit-trail schemas, and expert-review policies are hard to replicate quickly and create genuine switching friction. Without an explicit defensibility map, commercialization produces a feature, not a business.

## Moat Source Taxonomy

| Moat source | Construction path | Decay risk | Govtech applicability |
|---|---|---|---|
| `proprietary-workflow` | Encode tacit expert process into `e4-workflow-artifacts`; version and lock | Fast decay if workflow is disclosed or commoditized; protect via trade secret or first-mover stickiness | High; permit-triage logic, compliance workflows |
| `data-advantage` | Accumulate labeled outcomes, correction history, edge-case library, jurisdiction rule history | Moderate decay; others can build data with time; first-mover data lead is durable for 18–36 months | High; historical determination records, parcel histories |
| `distribution` | Embed in existing procurement vehicles (state contracts, cooperative purchasing, FASD endorsement); build referral chains | Moderate decay if distribution channel shifts; durable when embedded in multi-year contracts | High; FL NASPO ValuePoint, FASD vendor relationships [VERIFY] |
| `integrations` | Deep, certified integrations into government ERP, GIS, portal, and records systems (e.g., Tyler Technologies, Esri, Granicus) | Low decay once integration is built; high switching cost for buyer | High; parcel GIS, FDEP portal, FL county permitting systems |
| `compliance-moat` | Build and maintain jurisdiction-specific rule layers via `t7-govtech-package`; hold the expert-review boundary via `t7-risk-expert-review-plan` | Slow decay when rule maintenance is a core competency; accelerates if a competitor builds the same layer | Very high; FS Chapter 119, FDEP delegation, FL DEP rule sets |
| `operational-expertise` | Hire/train staff with the domain + AI intersection; build playbooks that encode expertise | Fast decay as staff leave; must be systematized into workflows and playbooks before it becomes durable | Medium; specialized without playbook discipline |

## Map Template

```yaml
defensibility_map_id: <kebab-case>
capability_ref: <capability_id from c10-capability-inventory>
productization_ref: <productization_id from c10-productization-path>
version: <semver>
last_reviewed: <ISO date>

moat_entries:
  - moat_id: <kebab-case>
    moat_source: <from taxonomy>
    current_strength: <nascent | established | durable>
    strength_evidence: >
      <observable evidence supporting the strength assessment; cite artifacts,
      integrations, contracts, or eval results — not aspirations>
    construction_investment:
      status: <not-started | in-progress | complete>
      artifact_refs: [<canonical artifact ids that encode or depend on this moat>]
      next_action: <concrete step to advance moat construction>
      target_date: <ISO date or sprint>
    decay_risk: <low | medium | high>
    decay_triggers:
      - <condition that would erode this moat source>
    competitor_replication_time_est: <rough calendar time for a well-resourced competitor; (illustrative)>

moat_portfolio_assessment:
  primary_moat: <moat_id; the single strongest, most durable advantage>
  secondary_moats: [<moat_id list>]
  vulnerability_summary: >
    <one paragraph: where is the portfolio exposed? What is the minimum viable
    moat combination to remain defensible if the primary moat erodes?>
  investment_priority:
    - moat_id: <id>
      rationale: <why this moat deserves the next investment dollar>
```

## Worked Example — Stormwater Pre-Screener Defensibility Map

```yaml
defensibility_map_id: stormwater-prescreener-moat-v1
capability_ref: stormwater-permit-prescreener
productization_ref: stormwater-prescreener-productization
version: 0.1.0
last_reviewed: 2026-05-29

moat_entries:
  - moat_id: fdep-rule-layer
    moat_source: compliance-moat
    current_strength: established
    strength_evidence: >
      FL FDEP stormwater rule layer encoded in t7-govtech-package instance
      stormwater-fdep-v1; expert-review boundary enforced via
      t7-risk-expert-review-plan; FS Chapter 119 audit-trail schema validated
      against two district pilots (illustrative). Competitor would need to
      re-encode the rule set from scratch and earn FDEP delegation status or
      an attorney-reviewed opinion to match.
    construction_investment:
      status: in-progress
      artifact_refs: [t7-govtech-package, t7-compliance-workflow, t7-risk-expert-review-plan]
      next_action: >
        Extend rule layer to cover two additional FL FDEP-delegated jurisdictions
        via t7-multi-municipality-architecture; target Okaloosa County and Bay
        County as expansion sites (illustrative).
      target_date: "2026-Q3"
    decay_risk: low
    decay_triggers:
      - FDEP publishes a standardized AI-assisted pre-screener tool itself
      - A well-funded legal-tech competitor obtains the same FDEP rule mapping
        and publishes it as open source
    competitor_replication_time_est: "12–18 months (illustrative)"

  - moat_id: proprietary-triage-workflow
    moat_source: proprietary-workflow
    current_strength: established
    strength_evidence: >
      Triage decision logic encoded in e4-workflow-artifacts instance
      stormwater-permit-triage-v1; 85% deterministic coverage validated against
      engineer-reviewed holdout set; workflow versioned and locked. The
      documented-vs-actual divergence analysis from e4-workflow-discovery-protocol
      captured tacit senior-clerk judgment not findable in any public document.
    construction_investment:
      status: complete
      artifact_refs: [e4-workflow-artifacts, e4-task-decomposition-framework]
      next_action: >
        Extend workflow coverage to cover the 15% judgment-residual cases via
        a supervised HITL capture loop — record engineer decisions on edge
        cases, add to labeled training set, and reduce judgment residual to < 8%.
      target_date: "2026-Q4"
    decay_risk: medium
    decay_triggers:
      - Workflow logic disclosed in a public-records request under FS Chapter 119
        (requires legal review of what is disclosable vs. trade-secret-protected [ATTORNEY REVIEW])
      - A staff member with full workflow knowledge moves to a competitor
    competitor_replication_time_est: "6–12 months (illustrative)"

  - moat_id: historical-determination-data
    moat_source: data-advantage
    current_strength: nascent
    strength_evidence: >
      Two pilot districts have contributed labeled determination records
      (application → routing → engineer validation) covering ~240 applications
      (illustrative). Labeled edge cases are a unique training and eval asset.
    construction_investment:
      status: in-progress
      artifact_refs: [s3-provenance-metadata-schema, s2-scoring-system]
      next_action: >
        Define data contribution agreement with pilot districts; ensure
        FS Chapter 119 compliance for any record retention and sharing
        [ATTORNEY REVIEW]; target 1,000 labeled records by end of 2026-Q4.
      target_date: "2026-Q4"
    decay_risk: medium
    decay_triggers:
      - District withdraws data-sharing consent
      - A competitor creates a larger labeled dataset via a broader pilot network
    competitor_replication_time_est: "18–24 months to match dataset size (illustrative)"

  - moat_id: fasd-distribution-channel
    moat_source: distribution
    current_strength: nascent
    strength_evidence: >
      Elected commissioner seat provides credibility and access to FASD
      (FL Association of Special Districts) network; initial conference
      presentation delivered (illustrative). No formal procurement vehicle
      or endorsement yet.
    construction_investment:
      status: not-started
      artifact_refs: [c10-gtm-architecture]
      next_action: >
        Apply for FASD endorsed-vendor status [VERIFY eligibility criteria];
        explore FL NASPO ValuePoint cooperative purchasing schedule as a
        procurement vehicle [VERIFY]; target one formal referral agreement
        with a district manager network by 2026-Q4.
      target_date: "2026-Q4"
    decay_risk: medium
    decay_triggers:
      - Commissioner seat lost at election
      - FASD endorses a competing product in the same category
    competitor_replication_time_est: "12–24 months to build equivalent network access (illustrative)"

moat_portfolio_assessment:
  primary_moat: fdep-rule-layer
  secondary_moats: [proprietary-triage-workflow, historical-determination-data]
  vulnerability_summary: >
    The portfolio is defensible on compliance and workflow today but thin on
    distribution and data. If FDEP publishes a competing rule tool (the primary
    decay risk), the moat collapses to proprietary workflow + data, which at
    nascent stage is insufficient alone. The minimum viable moat combination is:
    compliance-moat (established) + proprietary-workflow (established) + one of
    distribution or data-advantage (established). The next investment dollar
    should go to distribution (FASD channel) because it is the hardest to
    replicate and has the longest construction timeline among the underdeveloped
    sources.
  investment_priority:
    - moat_id: fasd-distribution-channel
      rationale: >
        Distribution is the scarcest resource and takes longest to build.
        Once the compliance-moat and workflow are established, distribution
        determines whether the product reaches 5 customers or 50. The
        commissioner seat is a depreciating asset — it should be converted
        into institutional channel relationships before any electoral cycle.
    - moat_id: historical-determination-data
      rationale: >
        Labeled determination data becomes the long-term defensibility backstop.
        After distribution, data accumulation is the second hardest thing for
        a competitor to replicate. Each new pilot district contributes to the
        asset asymmetrically — the first 1,000 records are hardest to acquire.
```

## Moat Construction Investment Sequencing

Moat sources are not equally fast to construct. A useful heuristic for sequencing investment: build proprietary workflow first (fastest, enables everything else), then compliance moat (requires legal/expert investment but creates the strongest switching friction for govtech), then data advantage (requires time and labeled outcomes), then distribution (requires relationships and credibility), then integrations (expensive but durable). Operational expertise should be systematized into playbooks continuously rather than treated as a separate investment phase — expertise that lives in individuals is not a moat.

The compliance moat in govtech contexts is particularly powerful because it is intertwined with the `t7-govtech-package` artifact surface: the rule layers, the audit-trail schemas, and the expert-review boundaries are simultaneously product features and defensibility investments. Every dollar spent deepening `t7-compliance-workflow` and `t7-rule-change-tracker` is a dollar invested in the moat, not just in the product.