security.txt names a contact. The CVD Policy format adds a JSON file at an advertised HTTPS address: which assets accept reports, which testing rules the publisher states, and how to report. A tool can evaluate that before it sends its first request.
It does not prove ownership, grant legal authorisation or guarantee safe harbour. Nor is it a rating: no score, no maturity level, no comparison. It records a publisher statement, and nothing more.