Govern (GV) · Identity

Identity at the Domain charter layer

deterministic · Outside the model's reasoning

Who is allowed to put this agent into the world, under what authority, accountable to what policy, with what retirement criteria?

What this cell does

Domain leadership signs charter authorizing a class of agents. Names roles permitted to create agents and the escalation path.

Artifacts (1)

checks.yamlview on GitHub

# ABOUTME: Machine-checkable definition of the Charter identity / domain cell.
# ABOUTME: The audit prompts in this cell's README, expressed so a validator can score them.

cell:
  id: identity.client-side
  concern: identity
  layer: client-side
  authority: domain
  document: domain-charter
  owner: "Domain authority, counter-signed by the AI Governance Council."
  question: "Does each domain that operates agents have a signed domain charter naming who in the domain is permitted to create agents, what the escalation path is, and what audit trail location records charter signatures?"

mappings:
  csf: "GV.RR-01, GV.RR-02"
  ai_rmf: "GOVERN 2.1, GOVERN 3.2"
  iso42001: "A.3"
  eu_ai_act: "Art. 26"

checks:
  - id: GV-ID-D-01
    description: "The domain names who may create agents within it."
    type: min_items
    target: "agent_creation_authorized:1"
    document: domain-charter
    severity: blocking
    evidence: "Named roles, not 'engineering'."
  - id: GV-ID-D-02
    description: "An escalation path is recorded with a destination that is a person or a rota."
    type: required_field
    target: "escalation_path"
    document: domain-charter
    severity: blocking
    evidence: "Where a page goes at 03:00."
  - id: GV-ID-D-03
    description: "The audit-trail location for charter signatures is recorded."
    type: required_field
    target: "audit_trail_location"
    document: domain-charter
    severity: blocking
    evidence: "A repo path or record system, resolvable by a reviewer."

Cell notes

Charter, Identity / Domain

Structural question. Does each domain that operates agents have a signed domain charter naming who in the domain is permitted to create agents, what the escalation path is, and what audit trail location records charter signatures?

Owner. Domain authority (Platform Engineering Director, Security Director, Customer Engineering Director, etc.). Counter-signed by the AI Governance Council.

Template fragment

This cell is satisfied by §4 (Identity) and §1 (Scope) of ../../templates/domain-charter.md. Specifically:

- §1 names the agent classes the domain authorizes.
- §4 names the roles in this domain authorized to create agents and the escalation path.

Audit prompts

- Which domains operate agents? Is there a domain charter for each?
- Who in [domain] is allowed to create agents? Is that role-based or named-individual-based?
- Where is the audit trail of charter signatures for this domain?

Operational tie-in

The domain charter constrains who in the domain can sign new agent charters. When a [Domain] employee proposes a new agent, the named role here is who reviews and signs.

Citation

NIST CSF 2.0 GV.RR-02 (roles, responsibilities, and authorities); GV.OV-01 (oversight). NIST AI RMF GOVERN 2.1, GOVERN 5.1 (engaging stakeholders). ISO/IEC 42001 §A.6.2 (AI objectives). EU AI Act Art. 26 (deployer obligations).

Crosswalk

NIST CSF 2 0	GV.RR-02, GV.OV-01
NIST AI RMF	GOVERN 2.1, GOVERN 5.1
ISO IEC 42001	§A.6.2
EU AI ACT	Art. 26

Cite this cell: https://agenticcovenants.com/govern/identity/client-side/