diff --git a/README.md b/README.md
index fa9125c..473f951 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,12 @@
 # paved-org 🛣️
 
+![CI](https://github.com/ChrisInvictus/paved-org/actions/workflows/plan.yml/badge.svg) ![License](https://img.shields.io/github/license/ChrisInvictus/paved-org) ![Release](https://img.shields.io/github/v/release/ChrisInvictus/paved-org)
+
 *A GCP organization baseline as code: org-wide guardrails, a project factory that vends secure-by-default projects, and a zero-trust workload driving on the paved road — IAP-protected, deployed via a keyless WIF pipeline. 
 Prevention half of CloudCanary.*
 
+**At a glance:** org policies that make insecure states unrepresentable · a project factory vending secure-by-default projects · zero exported keys anywhere (keyless WIF/OIDC end-to-end) · a zero-trust workload (IAP) as living proof · extended into agentic AI: an ai-guardrails module, AI-workload detection in its sister project, and a published MCP trust-boundary threat model (v1.1 — STRIDE × OWASP LLM Top 10 2025, multi-agent extension) with a two-part applied security runbook. Detection half: [CloudCanary](https://github.com/ChrisInvictus/CloudCanary).
+
 ## The thesis
 
 Most organizations bolt security onto projects after they exist — a scanner here, a review checklist there, a policy document nobody reads. paved-org makes the **organization itself** the security boundary. Org policy constraints are enforced at the root and inherited by everything below; the project factory vends projects that are hardened before their first API call. Insecure states aren't forbidden by policy documents — they're **unrepresentable in the platform**.
@@ -63,7 +67,7 @@ A governance layer that violated its own policies would be theater.
 
 ## AI-workload security
 Extending the prevention/detection thesis to AI workloads:
-- [**MCP trust-boundary threat model**](docs/threat-models/mcp-trust-boundaries.md) — five boundaries (B1–B5), STRIDE × OWASP LLM Top 10 (2025), with an IAM lens.
+- [**MCP trust-boundary threat model**](docs/threat-models/mcp-trust-boundaries.md) — five boundaries (B1–B5), STRIDE × OWASP LLM Top 10 (2025), with an IAM lens and a multi-agent (agent ↔ agent) extension (v1.1).
 - [**MCP security runbook**](docs/runbooks/securing-mcp-setup.md) — a two-part applied audit: a managed-connector host and a self-hosted agent gateway, with host hardening, a fail-closed exec-approval gate, and a staging-validated container.
 - [**`modules/ai-guardrails`**](modules/ai-guardrails/) — org-policy guardrails for AI workloads (verified canned constraints), the prevention half of what [CloudCanary](https://github.com/ChrisInvictus/CloudCanary) detects.
 ## Cost & reproducibility