Identity at the server side layer

Cell notes

Charter, Identity / Organizational

Structural question. Does the org have a written, signed AI Acceptable Use Policy that names the categories of agents permitted to exist, the body that authorizes new categories, and the named org-wide owner of the agent program?

Owner. AI Governance Council, signed by board representative or CEO.

Template fragment

This cell is satisfied by §1, §2, and §4 of ../../templates/organizational-policy.md:

• - §1 Purpose and scope: names what this policy covers.
• - §2 AI Acceptable Use Policy: names categories of agents permitted to exist and hard prohibitions.
• - §4 Roles and authorities: names the AI Governance Council, the Director of AI Workforce Transformation, and the domain leads.

Audit prompts

Reviewers will ask:

• - Who has authority to create a new class of agent? Where is that recorded?
• - Who is the named org-wide owner of the agent program? When did they accept the role?
• - Does the AUP exist as more than a one-time PDF? Has it been operationalized in domain charters?

Operational tie-in

The org-wide owner is the human ultimately accountable when an agent across any domain causes a serious incident. Their name flows into the org's incident-response runbooks, EU AI Act Art. 73 serious-incident reporting, and the board's annual AI risk briefing.

Citation

NIST CSF 2.0 GV.OC-01, GV.OC-02 (organizational mission, stakeholder priorities); GV.PO-01, GV.PO-02 (policy established and communicated). NIST AI RMF GOVERN 1.1 (cultural commitment), GOVERN 1.4 (risk management integrated). ISO/IEC 42001 §A.2 (AI policies), §A.3 (internal organization). EU AI Act Art. 9 (risk management system), Art. 17 (quality management system).