Govern (GV) · Approval gating

Approval gating at the Organizational charter layer

external · Outside the agent entirely

Who is allowed to put this agent into the world, under what authority, accountable to what policy, with what retirement criteria?

What this cell does

AI Governance Council approves new agent classes, ratifies risk-tier policy. Member roles named (CISO, Chief AI Officer, GC, Privacy, Domain Leads). Quorum and voting rules defined.

Artifacts (1)

checks.yamlview on GitHub

# ABOUTME: Machine-checkable definition of the Charter approval-gating / organizational cell.
# ABOUTME: The audit prompts in this cell's README, expressed so a validator can score them.

cell:
  id: approval-gating.server-side
  concern: approval-gating
  layer: server-side
  authority: organizational
  document: organizational-policy
  owner: "AI Governance Council itself; minutes ratified by the chair."
  question: "Does the org have a named AI Governance Council with member roles, quorum, voting rules, and recorded minutes?"

mappings:
  csf: "GV.RR-01, GV.OV-01, GV.OV-03"
  ai_rmf: "GOVERN 2.1, GOVERN 4.1"
  iso42001: "A.3, A.9"
  eu_ai_act: "Art. 17"

checks:
  - id: GV-AG-O-01
    description: "Council members are named with their roles."
    type: min_items
    target: "governance_council.members:3"
    document: organizational-policy
    severity: blocking
    evidence: "Named roles. A council of one is an officer."
  - id: GV-AG-O-02
    description: "Quorum is defined as a number or a fraction."
    type: required_field
    target: "governance_council.quorum"
    document: organizational-policy
    severity: blocking
    evidence: "A rule that can settle a disputed vote."
  - id: GV-AG-O-03
    description: "Minutes are recorded at a resolvable location."
    type: required_field
    target: "governance_council.minutes_location"
    document: organizational-policy
    severity: blocking
    evidence: "The most common emptiness pattern is a council that never meets."
  - id: GV-AG-O-04
    description: "The council has met within the last two quarters."
    type: date_within_days
    target: "governance_council.last_met:183"
    document: organizational-policy
    severity: blocking
    evidence: "A named council that has not met is not a control."

Cell notes

Charter, Approval gating / Organizational

Structural question. Does the org have a named AI Governance Council with member roles, quorum, voting rules, and recorded minutes?

Owner. AI Governance Council itself; minutes ratified by the chair.

Template fragment

§4.1 (AI Governance Council) of ../../templates/organizational-policy.md.

Audit prompts

- Who are the Council members by role? Are the named individuals current?
- When did the Council last meet? Were minutes recorded? Where are they stored?
- What decisions has the Council made in the last 12 months? Voting record?

Common failure mode

Council named but never meets. Minutes never recorded. ISO/IEC 42001 conformity assessment fails on §A.4.

Citation

NIST CSF 2.0 GV.RR-01, GV.RR-02, GV.RR-03 (organizational leadership, roles, adequate resources). NIST AI RMF GOVERN 2.1, GOVERN 2.2 (accountability). ISO/IEC 42001 §A.4 (leadership), §A.5 (planning). EU AI Act Art. 17(1)(b), Art. 26.

Crosswalk

NIST CSF 2 0	GV.RR-01, GV.RR-02, GV.RR-03
NIST AI RMF	GOVERN 2.1, GOVERN 2.2
ISO IEC 42001	§A.4, §A.5
EU AI ACT	Art. 17(1)(b), Art. 26

Cite this cell: https://agenticcovenants.com/govern/approval-gating/server-side/