AI and Data Governance Constitution

Role and use-case classification

Identify provider, deployer, importer, distributor, controller, processor, employer, public authority and sector roles. Classify the actual use case, affected persons, autonomy, data and consequences before selecting controls.

Lifecycle controls

1. mission and authority constitution;
2. data provenance, rights and minimization;
3. model/tool/provider inventory;
4. testing, evaluation and red-team evidence;
5. human oversight and contestability;
6. identity, least privilege and external-action approval;
7. logging, incident response and rollback;
8. change control, monitoring, expiry and retirement.

High-impact and prohibited practices

The public standalone does not authorize automated decisions about employment, credit, insurance, housing, education, health, public benefits, justice, migration or essential services. It does not authorize manipulative, discriminatory, unlawful biometric or covert surveillance practices.

Agentic governance

Advanced agents require bounded objectives, tool allowlists, short-lived credentials, action budgets, independent telemetry, step-up approval, containment, replay and clear human accountability.