01Ownership
Who is accountable?
Name the business owner, technical operator and person who can accept a risk or approve a consequential decision.
Governance & decision assurance
Technology can assist. Responsibility stays human.
Define who decides, what the system may do and what evidence is needed before a consequential action.
From a policy to an operating practice
Six questions. Explicit answers.
Governance should fit the consequence of the decision. These questions connect architecture to the people responsible for the outcome.
02Boundaries
What is the system allowed to do?
Define approved information, permitted actions, prohibited uses and the points where human approval is required.
03Evidence
What justifies the decision?
Agree evaluation criteria, record limitations and examine representative failures, not just the strongest demonstration.
04Intervention
How can a person stop it?
Make escalation, pause and recovery practical. Keep a fallback process and test it before relying on the system.
05Change
When must we reassess?
Identify model, data, permission and workflow changes that require renewed evaluation or approval.
06Value
Is the system still worth operating?
Review operating benefit alongside cost, control effectiveness and the burden on the people using it.
Aligned with recognised practice
Standards inform the method. The decision stays yours.
We use government guidance and international standards as lenses on a specific decision, not as a compliance checklist.
Australian Government
Australia’s AI Ethics Principles
Eight voluntary principles, from human-centred values and fairness to contestability and accountability.
How we use itA shared vocabulary for what “responsible” must mean in one specific decision.
Source (opens in a new tab)Australian Government, 2024
Voluntary AI Safety Standard
Ten guardrails covering accountability, risk management, data governance, testing, human oversight and transparency.
How we use itA practical test of which controls a proposed use should be able to evidence.
Source (opens in a new tab)ISO / IEC
ISO/IEC 42001:2023
The international management-system standard for organisations that develop, provide or use AI.
How we use itA management-system lens on policy, roles, risk treatment and continual improvement.
Source (opens in a new tab)NIST (US)
NIST AI Risk Management Framework
Four functions (Govern, Map, Measure and Manage) for identifying and treating AI risk across a system’s life.
How we use itStructure for evaluation evidence, limitations and ongoing monitoring.
Source (opens in a new tab)OAIC
Privacy Act 1988 and the APPs
The Australian Privacy Principles govern how covered organisations handle personal information, including in AI systems.
How we use itInformation-handling questions to raise early with your privacy and legal advisers.
Source (opens in a new tab)The Open Group
TOGAF Standard
A widely used method for enterprise architecture: capabilities, building blocks and governed change.
How we use itArchitecture discipline: boundaries, dependencies and decisions another person can review.
Source (opens in a new tab)Theory Y’s practical interpretation. Theory Y does not certify conformity with these frameworks, and this is not legal advice.
A practical boundary
Not every useful system needs more autonomy.
A system may retrieve approved guidance and draft a response while a responsible person reviews the evidence and decides what happens next.
Illustrative pattern, not a claim about a deployed client system.
Read the governance briefing- 1
Approved information
Relevant sources and clear access permissions.
- 2
Bounded assistance
Suggestions within an explicit operating scope.
- 3
Accountable decision
A named person with the authority to challenge, approve or stop.
The next right decision
A consequential decision deserves a clear basis.
Start with the business question. We will establish whether the Executive AI Value Architecture Review is the right next step.
Scope and commercial terms are agreed before paid work begins.