How AI is used in your technology function.
AI is a production input under defined permissions. The accountable operator remains responsible for decisions and review. Before work starts, the engagement needs a tool and data-use register, tests for material outputs and a fallback for the workflows that depend on them.
01 / Approved tools and data.
The operator and client agree the tools, accounts, purposes and permitted data for the engagement. Approval must account for the provider’s data handling, retention and access terms. A new tool or material change requires review before it receives client information.
- Use only tools approved for the engagement and the stated purpose.
- Do not send credentials, secrets or client data to an unapproved tool.
- Do not send regulated or confidential information outside the agreed data permissions.
- Record who can grant, review and revoke access.
The engagement register identifies each tool, the permitted data, the approval owner and the date of review. Keep it with the Operations Record so the client and any replacement team can inspect the permissions.
02 / Human review and output testing.
Builders and agents work within standing permissions. Material outputs are reviewed by an accountable person and tested against the system’s acceptance criteria before use. Test representative inputs and failure cases, including actions the agent must not take.
An AI output should not gain authority merely because it looks plausible. The operating record must say who accepts it and what evidence is required.
03 / Model changes and fallback.
Record the model or service configuration used for a material workflow. Evaluate changes that could affect behavior, data exposure or permissions before approval. Keep a known fallback, such as the previous version, a manual process or a bounded pause, appropriate to the business dependency.
Failures, approvals and changes enter the Operations Record. The operator can restrict or stop an agent when the agreed criteria are not met.
04 / Make the use visible to the client.
Disclose the approved use of AI, the relevant data flows and the people accountable for it. Keep the register and permissions current as the system changes. AI does not remove the need for acceptance criteria, testing or an operating owner.
Read how approvals and changes are recorded. Read how changes are reviewed and how AI workflows enter coverage.
Updated September 6, 2026 · About the team
Your technology
Start with the business
Your business depends on it.
Tell us which system matters, what has changed and who controls it. We will define a reviewable next step. Read Foundation and the commitments and evidence.