AI governance
AI models read, extract and propose. They do not write to a governed record, release a certificate or sign anything. That boundary is in the architecture, not in a policy document, and this page is where it is drawn.
What the model touches
Four jobs, all of them upstream of a decision. Note what is missing from the list: nothing here writes, releases or signs.
Every dimension, tolerance, note and feature control frame on the sheet, found and returned as a ballooned drawing with a characteristic list beside it. The numbering itself is deterministic and done in code, not decided by the model.
Specifications, operation sheets and supplier documents, parsed into structured requirements rather than summarised into prose.
A question about a project document comes back with the exact passage it was drawn from, so the answer can be checked rather than trusted.
The assistant reads the same live data the operator terminal reads, and proposes where to look next. It has no write path to the machine.
The boundary
A proposal crosses from the model to a person. Nothing crosses the other way. Each crossing leaves something an auditor can follow.
Four artefacts, and where each one comes from in the drawing above. Two are produced by the model, one by the person, and one is the record itself.
From the model
Carries the drawing sheet and zone it came from, so a figure challenged in a review is traced back to the millimetre.
From the model
Carries the passage it was drawn from. An answer with no source is not an answer.
From the person
A person re-authenticating at the moment of signing. It lands in the signature manifest, together with what was signed.
The governed record
Append-only and hash-chained. Records are superseded, never edited or deleted, prior versions stay readable, and a sealed record cannot be removed by an administrator.
When it goes wrong
A model that is right most of the time is a liability if nothing catches the rest. These are the answers, and they are the reason the boundary above is drawn where it is.
It proposes; a person confirms, corrects and signs. A wrong proposal is corrected before anything is recorded, and the correction is part of the record.
The platform still works. Ballooning, inspection, the shop floor and the record do not depend on a model being reachable.
Interlocks refuse. An operation out of sequence, a gauge out of calibration, a certificate with a non-conformance open: the system returns early rather than warning and continuing.
Questions