diff --git a/AGENTS.md b/AGENTS.md
index d706cbb..7417f58 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -54,20 +54,34 @@ the content without this map. None of it is self-evident from any single file.
 | **SCIF** | Sensitive Compartmented Information Facility — remote-access SCIF capability is a target |
 | **FOCI** | Foreign Ownership Control Influence — a concern (Cloudron VPS host Netcup is German-owned) |
 
-### Org reporting structure (as designed)
+### Org reporting structure (ruled 2026-09-07)
 
 ```
 TSYS Group (Board of Directors)
 ├── CTO  — Charles (R&D, architecture, tier-4 SME)
 └── COO  — AJ Lebsch (operations; oversees AI agents)
      ├── SVP KNEL  (owns ALL IT/business systems)
-     │    ├── VP TechOps        ← the only function with real content today
-     │    ├── VP SecOps         ← does not exist yet
-     │    └── VP TechCompliance ← Discourse cat 75 exists, empty
-     └── SVP TCTC
-          └── VP Finance / Accounting / Investing / Treasury / Trading
+     │    ├── VP TechOps → director → manager → {ic-builder, ic-reviewer}
+     │    ├── VP SecOps        (day-to-day alert triage, incident response)
+     │    ├── VP SecEng        (sec-vp; IaC and security build-out)
+     │    │      └─ SecOps ‖ SecEng are PARALLEL teams, each led by a VP
+     │    ├── SRE (sre-vp → director → manager → IC pair)  [stood up 09-07]
+     │    ├── VP TechCompliance (own lane — the single compliance-program
+     │    │                      owner, sitting across SecOps + SecEng)
+     │    ├── VP Facilities     (reports SVP KNEL; executed by OAM staff)
+     │    └── VP EngOps         (packaging #632, RDStack #836, STLP/RT platform)
+     └── SVP TCTC  (structure = founder ruling pending, week of 2026-09-14)
+          └── vp-investing / vp-trading / vp-compliance (provisioned, unchartered)
 ```
 
+Rulings of 2026-09-07 (founder, live in the COO C2 chat): VPEngOps reports to
+SVP KNEL (previously founder); SecOps and Security Engineering are parallel
+teams each with its own VP; VP TechCompliance is its own lane and the single
+identity owning the compliance program across both security teams; VP
+Facilities reports to SVP KNEL with OAM staff executing; VP TechOps gets a
+full staff (director + manager + the ic-builder/ic-reviewer pair). TCTC is
+intentionally left untouched until the founder rules on it.
+
 The AI **agents** are named after these roles (`vp-techops`, `vp-secops`,
 `vp-techcompliance`, `coo`, `svp-knel`, `svp-tctc`, etc.) — each is a separate
 Cloudron identity with its own API keys, SSH key, and Bitwarden collection.