Governing for Answers

Pillar 02 · Scope

S2 Approved-Sources Register

Govern what AI reads, not every document.

Form Workbook

What it's for

Retrieval turns shared drives, wikis and policy libraries into production data overnight. Most firms hold millions of files, so governing every one isn't realistic. This register takes the framework's answer: AI may only retrieve from sources on an approved list, and every approved source has an owner, a sensitivity class, a review date and a statement of what it is authoritative for. Approved does not mean appropriate: a source can be approved and still be the wrong one for a given question.

The 'OK for AI to retrieve?' column tells engineers which sources a retrieval pipeline may connect to. Anything other than Yes stays out of the index.

What you get

  • Register One row per source, with approval, review and a retrieval yes or no.
  • Use-case links Which use cases read which sources, and whether each link is safe.
  • Summary Measures for your governance report, worked out from the register.

Worked out for you Next review due, Review status, Used by (use cases), OK for AI to retrieve?

How it connects

Sources are approved for the S1 use cases that read them, and an authoritative source is where M1's certified terms are implemented. A1's authority check keeps unapproved sources out of retrieval indexes, and M4's packs list only sources that are OK for AI to retrieve.

A flavour of the worked example

From the worked example S-002
Source nameAsset team shared drive: Leases (working)
How access is enforced at query timeService account (fix before approval)
Approval statusRejected
Conditions, or reason for rejectionHolds unsigned drafts next to final versions and has no owner. Executed leases live in S-001.
OK for AI to retrieve? worked outNo: not approved

A few fields from one record of the toolkit's worked example, with long text shortened.

Next step

Build it with the guided assistant

The guided builds are open to invited people: you sign in first.

See all the kits

Request access

Not invited yet? Ask for access to the guided builds.

Your name, email and organisation are kept for up to 12 months so Duncan can reply to your request and, only if you tick the box, email you about Governing for Answers. The internet address the request comes from is used only to count requests a day and is not kept with your details. To withdraw your consent or have your details removed, say so through the comment form on the Toolkits page, giving the email you used.