DATA SECURITY & GOVERNANCE

Trust should be visible in how the system works.

You should be able to understand what the system knows, what it is allowed to do, when a person is required, what informed an important answer and what evidence remains after an action.

Trust is not a badge we place on top of the product. It is something the operating model has to demonstrate.

Customer control

Customer business data belongs to the customer. The system should avoid creating artificial switching costs through data lock-in, and portability, export and deletion should be supported where the governing product and legal requirements allow.

Standard
Customer business data belongs to the customer.

Evidence and provenance

The system should make important actions observable: what happened, who or what acted, what authority applied and what outcome was recorded. Evidence should help reconstruct an action without copying sensitive payloads unnecessarily.

Standard

Uncertainty is shown

Unknown, stale, conflicting, degraded, inferred and unverified information should not masquerade as certainty.

Designed authority

Consequential decisions need explicit ownership. AI, automation, memory or a prompt cannot silently grant themselves authority. A system may prepare, recommend or route work while still stopping at the boundary where a human decision is required.

Standard
Access should be purpose-bound and limited to what the capability requires. Higher-risk access calls for stronger identity, authorization, approval, scope, attribution, expiry and revocation controls.
Standard
Higher autonomy should be earned through bounded success and explicit approval. It may be reduced when conditions worsen. It should not silently expand itself.

How public claims are labelled

Standard: a governing design or operating requirement.
Implemented: a control exists in the current scoped system.
Verified: current evidence has tested the control in the stated scope.
Limited / Unavailable: a control is not universally available or has a known limitation.
Pending: proposed/drafted public wording or a claim whose evidence/owner approval is not complete.

We distinguish the standards we design for from the controls we can currently verify. We do not claim certifications or protections we cannot evidence.

What we will not claim without evidence

A target architecture, constitutional rule or planned control is not evidence that the property is currently implemented.

Talk about your requirements