DecisionOS — Control · module

Governance

Whether each AI system we run can be seen, verified, supervised and stopped to the standard its consequence level demands.

When you reach for it

Quarterly, as an operating rhythm. Before a board or audit committee. Or after an incident anywhere in the industry, when someone asks whether it could happen here.

What it asks you

3 blocks, in this order. Each one exists for a stated reason, and the run tells you that reason as you answer it.

01
The system register
One row per AI system you run. Self-declared — this is not discovery, and the report says so wherever the register appears.
02
What each system is
Two facts and the consequence rating. The rating sets what coverage this system needs, and it is cross-checked against the other two rather than taken on trust.
03
Coverage, as evidence
Artefacts and dates, not agreement. What can you produce, and when was it last true. The top of each scale cannot be reached without a date, which is what makes a claim checkable — and what makes it decay.

The method

How the result is produced

Each system is assessed on the five Cognitive Coverage dimensions — Visibility, Verifiability, Interruptibility, Escalation Design and Supervision Retention — and each dimension resolves to one of four behaviourally defined levels. A system's actual coverage is the worst of its five dimensions, never the average: an organisation with excellent visibility, excellent verifiability and no stop mechanism does not have four-fifths of a control system. That level is compared against what the system's consequence rating requires, published in the table below. Any control claimed without a recent date is downgraded to claimed-but-unverified. Where the same question was put to more than one role and the answers differ, the disagreement is reported as itself and neither side is declared correct.

What this is not

This is a structured self-attestation, not an audit. Nothing here was inspected, tested or verified by anyone outside your organisation.

This is not discovery. The register is what you entered, and a system nobody named does not appear — which is why the See line is deferred rather than faked.

This is not the free Cognitive Coverage Diagnostic at greater length. That instrument gives one person one score for the organisation; this assesses each system against its own requirement, with dates, from up to three perspectives.

A control that exists is not a control that works. Only a drill establishes the difference, which is why the drill list is an output rather than a suggestion.

Where it stops

Everything here is what you told us. Nothing was read, inspected, profiled or connected to.

There is no peer comparison behind any statement in this report, and none is implied. We will not show one until there is enough real data to state an n.

Dates were given as bands rather than exact dates, so decay is assessed against the midpoint of the band you chose.

Where fewer than two roles answered, no disagreement could be detected — and that is not the same as agreement.

Completeness of the register cannot be established from inside this run. Where a Portfolio run exists, systems present there and absent here are named; that is the only automatic check available.

What it connects to

Answers established elsewhere are carried in with their age shown, so a stale answer reads as stale rather than being silently reused.

Reads saved results from

Operating ModelOpen

Its results carry forward into

The rest of the Control line

Risk

Which of the things that could go wrong we would find out about in time to do something, and which control would change the most of the ones we would not.

Open

See what it costs All twelve modules