We govern our own AI — and we show our work

Accountability structures and policies for AI risk

Separation-of-duties with dual control on irreversible AI actions; model cards record each model’s purpose and limits.

src/lib/governance/sod.ts · src/lib/ai-governance/model-cards.ts

Transparent, tamper-evident record of AI decisions

Every generation, fallback, cache hit and validation event is written to an append-only, hash-chained audit log.

src/lib/audit/log.ts · migration 086 (audit_log_hash_chain)

Establish the context and intended use of the AI system

Org context is loaded fresh per request and scoped to the tenant; the SOVEREIGN diagnostic frames maturity and risk before synthesis.

src/lib/ai/prompts.ts (buildOrgContext) · scorecard scoring

Verify claims against ground truth, not self-report

Telemetry verification checks self-reported maturity against live Jira/GitHub signals and flags contradictions as findings.

src/lib/telemetry/shared.ts (verifyDimensions)

Detect and mitigate hallucination / fabrication

Every number in generated prose must trace to a licensed source; framework citations are validated against a catalogue and stripped if invented.

src/lib/ai/numeral-provenance.ts · src/lib/ai/citation-validation.ts

Measure reliability of AI outputs

Board-tier outputs run dual-provider consensus with an adjudicating pass; a zero-AI-call eval harness gates schema/content regressions in CI.

src/lib/ai/consensus.ts · src/lib/eval (eval harness)

Manage AI risks from untrusted input

Untrusted context passes 6-category prompt-injection neutralisation and high-confidence PII redaction before it reaches a model.

src/lib/ai/untrusted.ts · src/lib/security/pii.ts

Resilience to provider failure

Per-provider circuit breakers with retry + automatic Claude→GPT-4o failover keep the system available under upstream faults.

src/lib/observability/circuit-breaker.ts · src/lib/ai/engine.ts

Operate a risk-management system across the lifecycle

The SOVEREIGN diagnostic and risk register continuously identify, score and track AI-programme risks.

src/lib/scorecard · src/lib/risks/service.ts

Data governance over inputs

Tenant isolation by deny-by-default RLS; PII redaction and injection neutralisation on all untrusted input.

RLS (get_current_org_id) · src/lib/security/pii.ts

Provide interpretable, well-founded output

Every insight carries a confidence band and a Vouli verdict with explicit counterarguments and cited sources.

src/lib/ai/schemas.ts (confidence_band, vouli_verdict)

Enable effective human oversight

Consensus disagreements and telemetry contradictions are surfaced to a human, never silently resolved; irreversible actions require dual control.

src/lib/ai/engine.ts (consensus) · src/lib/agents/executor.ts

Accuracy and robustness

Structured output is schema-validated with a corrective retry then hard rejection; numeric provenance blocks unsupported figures.

src/lib/ai/engine.ts (validation retry) · numeral-provenance.ts

Automatic record-keeping (logging)

Append-only, hash-chained audit log records AI events with tenant, actor, model and outcome.

src/lib/audit/log.ts · migration 086