Logging & Monitoring

Define minimum human oversight requirements by risk tier at design stage. Assign named accountability for oversight operations.

Design HITL oversight mechanisms at use case design stage including trigger criteria, review workflow, and escalation paths.

Build and test HITL routing logic and escalation pathways in the AI system. Validate with pilot before deployment.

Operate HITL controls in production and log all interventions and outcomes. Review override patterns quarterly.

Conduct periodic oversight effectiveness reviews. Escalate to governance when oversight metrics fall below threshold.

Define and sign off each agent's delegation envelope — maximum depth and strict scope attenuation — before build begins.

Document each agent's identity, minimum scopes, on-behalf-of population, and delegation depth at design time. Gate build on governance sign-off of the authority matrix.

Mint a unique, attestation-backed workload identity per agent at onboarding. Register every SPIFFE-ID to an owner, use case, and approval ticket; ban shared service accounts.

Implement on-behalf-of token exchange and prove with negative tests that the agent cannot exceed the user's ACL. Gate release on these tests passing.

Register every agent identity with a named human owner, approved use case, scopes, and status before issuance. No registry entry, no identity.

Write authorisation policy as versioned, peer-reviewed code traced to approved scopes. Gate promotion on allow/deny scenario tests passing.

Scan every commit to agent code, prompts, and config for embedded secrets. Block merges on detection and triage findings to closure.

Vet and approve every MCP server and peer agent before registering its identity on the allow-list. Block integration until vetting is signed off.

Mint short-lived, task-scoped tokens just-in-time from a central token service. Enforce a hard max TTL and resource-bound audience so no standing credential exists.

Grant sensitive scopes just-in-time for a bounded window with auto-revocation; require human approval for high-impact elevations. Hold zero standing privilege.

Establish data transfer and storage policy for AI training data. Enforce approved storage locations from point of collection.

Implement DLP controls in the data acquisition environment to prevent unauthorised extraction or transfer of training data.

Enforce data handling policy in the build environment. Require explicit approval for any data transfers outside the environment.

Configure DLP controls in the build environment to block training data from leaving approved boundaries.

Conduct a privacy risk assessment at use case design stage. Determine if a DPIA is required before data acquisition.

Apply S1-defined privacy controls during data acquisition: verify consent, minimise data, anonymise personal data.

Apply anonymisation and masking controls to personal data before use in model training. Validate de-identification effectiveness.

Apply Privacy by Design in model architecture using differential privacy or federated learning where technically feasible.

Publish the privacy notice and confirm consent management is operational before go-live.

Define and sign off a purpose-to-data-source matrix with lawful basis at intake. Make it the approved baseline for runtime enforcement.

Sign zero-retention/no-training terms with each model provider and obtain DPO sign-off on the data flow before enabling any endpoint.

Restrict access to pre-anonymisation personal data to the minimum authorised set. Enforce at point of acquisition.

Apply robust de-identification (k-anonymity, l-diversity, differential privacy) during data processing. Validate effectiveness.

Implement output filters to detect and suppress quasi-identifying attribute combinations in model responses.

Propagate source ACLs and classification labels onto every chunk at ingestion. Reject documents whose entitlements cannot be resolved.

Scan every model response inline with DLP before delivery; redact or block PII, PAN and MNPI matches. Keep the rule set version-controlled.

Define minimum monitoring requirements at design stage calibrated to the use case risk tier.

Configure monitoring hooks in the conversation layer at deployment to capture metrics required by S1 monitoring requirements.

Execute a controlled fine-tuning cycle on refreshed data when staleness is confirmed. Validate before promoting to production.

Define approved use case scope and expected input distribution at design stage. Document as the governance baseline for OOD controls.

Design a scope-enforcement layer in the architecture to isolate the AI system from off-topic or out-of-distribution inputs.

Implement input sanitisation and injection detection filters covering known injection patterns and privilege escalation attempts.

Wrap all untrusted content in random delimiters and datamarking; instruct the model never to execute instructions inside the marked region. Gate release on injection eval results.

Benchmark the classifier on a labelled injection corpus and tune the decision threshold. Sign off the operating point before deployment.

Define and approve the source allow-list and write-time scanning during build. Prove non-allow-listed and injection-bearing writes are rejected before go-live.

Conduct ethical design assessment at use case intake before build begins. Require sign-off by ethics or risk committee.

Define prohibited outputs and ethical boundary constraints in the use case design document before build.

Deploy content moderation controls aligned to S1 ethical constraints. Validate filter accuracy before deployment.

Select a foundation model with documented safety fine-tuning (RLHF, Constitutional AI). Verify alignment benchmarks.

Register a safety contract per integration — pinned version, schemas, side-effect class, latency/error envelope. Gate onboarding on contract review and sign-off.

Wire the agent tool layer to the CAB calendar at deployment. Test that a declared freeze blocks mutating calls before go-live.

Instrument every identity-issuing component with schema-conformant audit emitters. Block release until completeness and tamper-evidence tests pass.

Define per-identity behaviour profiles and thresholds at build. Rehearse automated suspension and sign off measured revocation time before go-live.

Monitor production for anomalous data transfers in real time. Alert on any transfer outside approved data flow boundaries.

Tag personal data with subject identifiers at ingestion and maintain an artefact inventory map of every store it reaches. Keep lineage current so erasure can propagate.

Conduct periodic privacy vulnerability assessments including re-identification risk testing as new techniques emerge.

Seed registered canary records into the fine-tuning corpus during data preparation. Control the seed manifest so canaries stay traceable and tamper-proof.

Construct synthetic evaluation datasets during build to serve as the ongoing monitoring baseline.

Build monitoring infrastructure during build: performance metrics collection, alerting thresholds, dashboards.

Penetration test all prompt injection pathways in the system. Prioritise external tool and document ingestion channels.

Build the versioned injection corpus into CI/CD as a pre-release gate. Baseline attack success and sign off the release threshold.

Simulate data poisoning attacks (backdoor, label flipping, gradient-based) to assess model resilience before deployment.

Verify a signed attestation and content hash on every dataset shard at ingestion. Reject unsigned or hash-mismatched data before it reaches the training pipeline.

Gate every model promotion on backdoor-trigger probes and a behavioral diff against the approved baseline. Block release on significant regressions or trigger-pattern anomalies.

Prioritise value-misalignment test scenarios in validation. Block deployment if prohibited outputs are produced.

Configure monitoring to track oversight process adherence metrics in production (review rate, SLA compliance, override frequency).

Verify each running agent authenticates with its own SVID; revoke on decommission or compromise. Scan periodically for shared or static credentials and remediate.

Reconcile the registry against runtime identities and suspend unregistered principals. Recertify ownership and scopes periodically; decommission retired agents.

Alert on un-revoked elevations and any standing sensitive grant. Report the zero-standing-privilege position to the risk owner on a set cadence.

Sweep runtimes and repos on a schedule for static credentials. Alert on any credential exceeding its maximum age and track findings to closure.

Baseline each agent identity's behaviour and alert on out-of-profile use. Auto-suspend credentials on high-confidence anomalies and track mean-time-to-revoke.

Monitor for privacy incidents in production including personal data appearing in outputs. Notify regulators within required timeframes.

Tag every memory and vector record with subject-id and retention class; partition stores per tenant/user. Prove the erasure and isolation paths in testing before release.

Test de-identification approach against known re-identification attacks (quasi-identifier linkage, singling-out). Remediate if risk is high.

Penetration test AI system data access boundaries (API endpoints, system prompt exposure, memory leakage).

Conduct periodic data leakage audits including training data memorisation testing. Escalate confirmed leakage incidents to PDPA notification process.

Implement tamper-evident capture of prompts, outputs, and version state during build. Verify a full incident timeline can be reconstructed before go-live.

Run agent tool calls in a network-restricted sandbox behind a deny-by-default egress allow-list. Require security approval for any destination added.

Implement a reinforcement learning feedback loop to continuously incorporate production signals and reduce staleness risk.

Implement OOD detection in the input filtering layer. Reject or escalate inputs outside the S1-defined scope.

Configure HITL triggers for outputs in input domains that diverge from the training distribution. Log all out-of-scope interventions.

Classify content sources into trust tiers at design; place privileged tools behind a tier requiring user-originated intent or human approval. Sign off the trust-tier map before build.

Re-run injection evals on every template change and periodically against new attack techniques. Manage the spotlighting wrapper under change control.

Scan every ingestion batch with spectral-signature and clustering detectors before training. Quarantine flagged clusters for human review against documented thresholds.

Bind the agent's default execution target to non-production environments at design time. Require a separately approved promotion configuration for any production-connected target.

Map every dependency failure mode to a defined safe behaviour at design. Require architecture sign-off on the fallback specification before build.

Run each agent task in an isolated, network-segmented sandbox scoped to the task's exact needs. Gate onboarding on fault-injection tests proving containment.

Build tracing, detection rules and breaker thresholds into the orchestrator. Prove via fault-injection tests that a failing agent is quarantined within target before release.

Engineer mutating actions with idempotency keys, transactions and pre-change snapshots; stage writes rather than committing directly. Gate release on tested dedup and rollback within RPO.

Cap each agent's rate, volume, concurrency, and spend per downstream dependency. Trip the breaker and fail closed when a ceiling is crossed.

Enforce hard caps on iterations, depth, wall-clock, and cost per agent run. Terminate the run on cap breach or detected loop signatures.

Roll out agent changes via shadow and canary stages gated on connected-system health signals. Auto-halt and roll back to last known-good on threshold breach.

Deploy revocation, tool-cutoff and fleet-halt mechanisms with the release. Test every tier end-to-end and record time-to-effect before go-live.

Register each release as a restorable known-good baseline and rehearse rollback at the release gate. Block promotion without a tested restore.