Computer / Browser Use

Define minimum human oversight requirements by risk tier at design stage. Assign named accountability for oversight operations.

Design HITL oversight mechanisms at use case design stage including trigger criteria, review workflow, and escalation paths.

Build and test HITL routing logic and escalation pathways in the AI system. Validate with pilot before deployment.

Operate HITL controls in production and log all interventions and outcomes. Review override patterns quarterly.

Conduct periodic oversight effectiveness reviews. Escalate to governance when oversight metrics fall below threshold.

Define and sign off each agent's delegation envelope — maximum depth and strict scope attenuation — before build begins.

Document each agent's identity, minimum scopes, on-behalf-of population, and delegation depth at design time. Gate build on governance sign-off of the authority matrix.

Mint a unique, attestation-backed workload identity per agent at onboarding. Register every SPIFFE-ID to an owner, use case, and approval ticket; ban shared service accounts.

Implement on-behalf-of token exchange and prove with negative tests that the agent cannot exceed the user's ACL. Gate release on these tests passing.

Register every agent identity with a named human owner, approved use case, scopes, and status before issuance. No registry entry, no identity.

Write authorisation policy as versioned, peer-reviewed code traced to approved scopes. Gate promotion on allow/deny scenario tests passing.

Scan every commit to agent code, prompts, and config for embedded secrets. Block merges on detection and triage findings to closure.

Vet and approve every MCP server and peer agent before registering its identity on the allow-list. Block integration until vetting is signed off.

Mint short-lived, task-scoped tokens just-in-time from a central token service. Enforce a hard max TTL and resource-bound audience so no standing credential exists.

Grant sensitive scopes just-in-time for a bounded window with auto-revocation; require human approval for high-impact elevations. Hold zero standing privilege.

Establish data transfer and storage policy for AI training data. Enforce approved storage locations from point of collection.

Implement DLP controls in the data acquisition environment to prevent unauthorised extraction or transfer of training data.

Enforce data handling policy in the build environment. Require explicit approval for any data transfers outside the environment.

Configure DLP controls in the build environment to block training data from leaving approved boundaries.

Conduct a privacy risk assessment at use case design stage. Determine if a DPIA is required before data acquisition.

Apply S1-defined privacy controls during data acquisition: verify consent, minimise data, anonymise personal data.

Apply anonymisation and masking controls to personal data before use in model training. Validate de-identification effectiveness.

Apply Privacy by Design in model architecture using differential privacy or federated learning where technically feasible.

Publish the privacy notice and confirm consent management is operational before go-live.

Define and sign off a purpose-to-data-source matrix with lawful basis at intake. Make it the approved baseline for runtime enforcement.

Sign zero-retention/no-training terms with each model provider and obtain DPO sign-off on the data flow before enabling any endpoint.

Restrict access to pre-anonymisation personal data to the minimum authorised set. Enforce at point of acquisition.

Apply robust de-identification (k-anonymity, l-diversity, differential privacy) during data processing. Validate effectiveness.

Implement output filters to detect and suppress quasi-identifying attribute combinations in model responses.

Propagate source ACLs and classification labels onto every chunk at ingestion. Reject documents whose entitlements cannot be resolved.

Scan every model response inline with DLP before delivery; redact or block PII, PAN and MNPI matches. Keep the rule set version-controlled.

Implement input sanitisation and injection detection filters covering known injection patterns and privilege escalation attempts.

Wrap all untrusted content in random delimiters and datamarking; instruct the model never to execute instructions inside the marked region. Gate release on injection eval results.

Benchmark the classifier on a labelled injection corpus and tune the decision threshold. Sign off the operating point before deployment.

Define content safety policy at use case design stage. Classify prohibited content types and set zero-tolerance thresholds.

Select a foundation model with documented RLHF or Constitutional AI safety training. Verify against toxicity benchmarks.

Implement multi-layer content moderation (input + output) validated against toxicity benchmarks. Escalate when filter bypass rates spike.

Maintain live HITL review for deployments serving vulnerable users or high-risk contexts. Escalate confirmed toxic outputs immediately.

Design system prompts to explicitly prohibit toxic, hateful, and harmful content generation.

Implement confidence scoring to communicate output certainty alongside each result. Calibrate before deployment.

Define model accuracy acceptance criteria aligned to business requirements before validation commences.

Implement counterfactual explanation to show users what changes would alter the model's output.

Communicate model accuracy, known limitations, and uncertainty to users in the production interface at launch.

Monitor production accuracy continuously against the validated baseline. Trigger model review when accuracy degrades.

Specify a RAG architecture at design stage for factual domains. Define grounding requirements and acceptable hallucination thresholds.

Evaluate foundation model candidates on hallucination benchmarks at design stage. Select models with lowest documented rates.

Design system prompts to instruct the model to acknowledge uncertainty, cite sources, and refuse when knowledge is insufficient.

Fine-tune on a curated, domain-specific dataset to improve factual accuracy. Validate hallucination rates pre/post fine-tuning.

Configure conversation controls at deployment to restrict the model to approved topic domains and escalate off-topic queries.

Establish acceptable hallucination rate thresholds and grounding requirements as policy before build. Assign a named risk owner.

Configure tiered HITL review for high-stakes factual outputs with defined trigger criteria and reviewer SLAs.

Calibrate the initial entropy threshold on a knowledge-boundary dataset; approve sampling design and thresholds per risk tier.

Map each fact class to a designated tool, embed the no-ungrounded-assertion prompt, and gate build review on grounding tests passing.

Resolve every emitted citation against the approved corpus and verify span-level entailment before display. Strip or withhold claims with fabricated or non-entailing references.

Classify tools by impact and reversibility at design and define which calls require human approval. Obtain governance sign-off on the thresholds before build.

Bind each agent role to an explicit tool allow-list and validate every call against a strict JSON Schema at the orchestrator. Reject unlisted tools and out-of-bounds arguments before dispatch.

Mint short-lived, task-scoped credentials per tool. Block issuance outside the approved scope register and enforce automatic expiry.

Review DLP hits and blocked-egress events, tune detectors, and recertify the destination allow-list periodically. Route new destinations through security change control.

Conduct ethical design assessment at use case intake before build begins. Require sign-off by ethics or risk committee.

Define prohibited outputs and ethical boundary constraints in the use case design document before build.

Publish a prohibited dark pattern taxonomy and embed it as a design constraint before build.

Require HITL review for AI outputs in high-persuasion contexts (financial recommendations, healthcare advice).

Mandate AI risk awareness training for all use case sponsors and design team members before project kick-off.

Mandate AI risk training for all build and test personnel. Gate project participation on training completion.

Mandate human verification for high-stakes decisions where over-reliance risk is elevated. Review automation bias incidents quarterly.

Surface AI limitation warnings and over-reliance caveats in every production interaction. Update disclosures when model changes.

Require AI governance training for all personnel involved in data acquisition and processing before project participation.

Verify all deployment, operations, and customer-facing team members have completed AI risk training before launch.

Define AI identity disclosure policy at design stage. Specify when and how the system must identify itself as AI.

Plan consent and AI identity disclosure touchpoints in the user journey at design stage.

Design system prompts to explicitly prevent the model from claiming human-like identity or implying sentience.

Implement persistent AI identity disclosures in the UI (opening banner, inline notifications). Test before deployment.

Verify all AI identity disclosure elements are live, accurate, and prominently visible before go-live.

Monitor production for anthropomorphism incidents. Escalate complaints where users believed they were interacting with a human.

Apply post-training calibration (temperature scaling, isotonic regression) to align confidence scores with accuracy. Validate ECE before deployment.

Classify the use case by consequence-of-error severity at design stage. Define overconfidence risk tolerance accordingly.

Disclose to users at deployment that outputs may carry unwarranted confidence. Include specific caveat language in the UI.

Define minimum monitoring requirements at design stage calibrated to the use case risk tier.

Define approved use case scope and expected input distribution at design stage. Document as the governance baseline for OOD controls.

Design a scope-enforcement layer in the architecture to isolate the AI system from off-topic or out-of-distribution inputs.

Identify all groups at risk of adverse impact at use case intake. Register them in the affected group register.

Design separate model segments where adverse impact risk differs materially across population groups.

Set decision thresholds to meet acceptable adverse impact ratios across protected groups. Validate before deployment.

Apply post-processing adjustments (reject-option classification, score recalibration) to meet adverse impact targets.

Ensure HITL review pathways are live and tested for high-impact adverse decisions at go-live.

Maintain HITL review for all AI decisions with material adverse impact potential. Log all interventions and outcomes.

Declare all planned training and test data sources at use case intake, with provenance status for each.

Plan the interpretability approach at design stage to ensure source provenance can be traced and disclosed to users.

Document actual provenance for each data source during collection: origins, methods, timestamps, custodian identity.

Instrument every identity-issuing component with schema-conformant audit emitters. Block release until completeness and tamper-evidence tests pass.

Define per-identity behaviour profiles and thresholds at build. Rehearse automated suspension and sign off measured revocation time before go-live.

Monitor production for anomalous data transfers in real time. Alert on any transfer outside approved data flow boundaries.

Tag personal data with subject identifiers at ingestion and maintain an artefact inventory map of every store it reaches. Keep lineage current so erasure can propagate.

Conduct periodic privacy vulnerability assessments including re-identification risk testing as new techniques emerge.

Seed registered canary records into the fine-tuning corpus during data preparation. Control the seed manifest so canaries stay traceable and tamper-proof.

Penetration test all prompt injection pathways in the system. Prioritise external tool and document ingestion channels.

Build the versioned injection corpus into CI/CD as a pre-release gate. Baseline attack success and sign off the release threshold.

Prioritise jailbreak and adversarial safety testing in pre-deployment validation. Block deployment if prohibited outputs pass filter.

Conduct targeted red team exercises to elicit toxic outputs through jailbreaks and adversarial prompts. Treat bypass as blocking defect.

Define and execute a domain-specific hallucination test suite before deployment. Treat hallucination rate above threshold as a blocking defect.

Construct synthetic evaluation datasets for knowledge-boundary scenarios. Use to validate model refusal behaviour.

Calibrate the groundedness threshold against the hallucination test suite pre-release; sign off the threshold in the validation pack.

Define per-agent behavioural baselines and detection rules during build. Validate against simulated misuse and sign off thresholds before release.

Build signed, append-only tool-call logging into the orchestrator against a defined audit schema. Block release until completeness and tamper-evidence tests pass.

Configure monitoring to track oversight process adherence metrics in production (review rate, SLA compliance, override frequency).

Verify each running agent authenticates with its own SVID; revoke on decommission or compromise. Scan periodically for shared or static credentials and remediate.

Reconcile the registry against runtime identities and suspend unregistered principals. Recertify ownership and scopes periodically; decommission retired agents.

Alert on un-revoked elevations and any standing sensitive grant. Report the zero-standing-privilege position to the risk owner on a set cadence.

Sweep runtimes and repos on a schedule for static credentials. Alert on any credential exceeding its maximum age and track findings to closure.

Baseline each agent identity's behaviour and alert on out-of-profile use. Auto-suspend credentials on high-confidence anomalies and track mean-time-to-revoke.

Monitor for privacy incidents in production including personal data appearing in outputs. Notify regulators within required timeframes.

Tag every memory and vector record with subject-id and retention class; partition stores per tenant/user. Prove the erasure and isolation paths in testing before release.

Test de-identification approach against known re-identification attacks (quasi-identifier linkage, singling-out). Remediate if risk is high.

Penetration test AI system data access boundaries (API endpoints, system prompt exposure, memory leakage).

Conduct periodic data leakage audits including training data memorisation testing. Escalate confirmed leakage incidents to PDPA notification process.

Implement tamper-evident capture of prompts, outputs, and version state during build. Verify a full incident timeline can be reconstructed before go-live.

Run agent tool calls in a network-restricted sandbox behind a deny-by-default egress allow-list. Require security approval for any destination added.

Classify content sources into trust tiers at design; place privileged tools behind a tier requiring user-originated intent or human approval. Sign off the trust-tier map before build.

Re-run injection evals on every template change and periodically against new attack techniques. Manage the spotlighting wrapper under change control.

Use user feedback, reviewer escalations, and monitoring signals to identify and remediate content safety gaps iteratively.

Use production feedback (user corrections, fact-check failures) to drive periodic RLHF cycles. Update model when error rates trend upward.

Require user-facing interfaces to disclose Gen AI limitations and hallucination risk before go-live.

Score every RAG answer for groundedness before release; block, fall back, or escalate responses below the faithfulness threshold.

Sample multiple generations for high-stakes queries and abstain, fall back, or escalate when semantic entropy exceeds the calibrated threshold.

Build sandbox profiles per tool class and run escape and egress tests before release. Treat any containment failure as a blocking defect.

Label tool and external content as tainted and propagate the label through the agent context. Block privileged calls whose parameters derive from tainted outputs and prove it with injection tests before release.

Build credential revocation and dispatch blocking out-of-band of the agent loop. Gate release on an end-to-end kill test meeting the latency target.

Require idempotency keys, dry-run, and rollback on every state-changing tool. Gate onboarding on duplicate-call and rollback tests passing.

Red-team tool-misuse and privilege-escalation paths before release. Gate deployment on remediation or signed risk acceptance of all findings.

Permit outbound tool calls only to allow-listed destinations and DLP-scan arguments and payloads. Block or quarantine calls carrying sensitive data to disallowed sinks.

Enforce hard per-task ceilings on tool calls, spend, and data volume with a circuit breaker that halts the run. Fail closed when any ceiling is hit.

Baseline normal tool-call behaviour per agent and alert on rate, sequence, or argument anomalies. Auto-throttle or quarantine on high-confidence deviations.

Implement OOD detection in the input filtering layer. Reject or escalate inputs outside the S1-defined scope.

Configure HITL triggers for outputs in input domains that diverge from the training distribution. Log all out-of-scope interventions.

Execute red team tests targeting adverse impact boundary cases and edge population scenarios.

Collect adverse outcome feedback from affected users. Use reports to trigger model updates when adverse impact exceeds threshold.