This preview is password protected.
Pillar 02 · Establish AI Policies · Proof artifact
Every engagement under the Govern pillar starts here. The Charter is the constitution: short, durable, and signed by a human. Policy, rules, and processes sit beneath it and change faster. This is the actual template structure, with client fields marked.
Adopted [date] · Version 1.0 · Reviewed annually or on material change
This Charter establishes how [Organization] identifies, approves, builds, and oversees artificial intelligence agents and AI assisted workflows. It exists so that every agent acting in our name is known, owned, bounded, and answerable.
Every agent and AI assisted workflow has one named human owner, recorded in the registry. The owner answers for the agent's purpose, data, tools, and output. An agent without a named owner does not run.
No agent operates unless it is registered and holds a current, signed attestation (its Know Your Agent passport) covering its identity, tool scope, and data scope. Attestation expires; renewal requires the governance score to pass. Systems that interact with agents check the passport at the boundary and deny what cannot present one.
Data owners declare the posture of their data: RED (no agents), AMBER (attested agents only), or GREEN (open). A declaration binds every agent regardless of its own scope or attestation. Zone declarations are made at onboarding, before the first build, and are enforced at design, at attestation, and in continuous detection.
Actions that move money, change records, contact outsiders, or cannot be undone require a human approval checkpoint designed into the workflow before it is built. Destructive tools are never present in a configuration without a gate.
Every registered agent records, at attestation, how it is stopped: session termination, permission revocation, rollback of reversible changes, and full deactivation. The layers are drilled quarterly. An irreversible action already taken is flagged for human follow-up, never reported as undone.
Attestations, approvals, incidents, and retirements are written to a hash chained ledger. Findings become tracked items with owners and due dates. What cannot be evidenced did not happen.
Vendor agents enter through the intake standard: declaration, data terms, exit terms, and security attestation before connection. Employee built agents are welcome and follow the same registration path. Discovery of an undeclared agent is treated as a governance finding, not a disciplinary shortcut.
This Charter is amended by [named authority] with notice to [oversight body]. Policy, rules, and processes under it may be updated by the named AI owner within the Charter's bounds. Every amendment is ledgered.
[Executive sponsor] · [Named AI owner] · [Data owner] · Date: [date]
Template notice: this Charter is a governance template prepared by the GSIS AI practice. It is reviewed by the client's own counsel before adoption and is not legal advice.
The constitution. Principles and authority. Changes rarely, signed at the top. This document.
The statute. What is allowed, what is prohibited, who decides. Includes the control policy defaults: block, monitor, allow.
The regulation. Concrete thresholds, scopes, zone lists, and approval requirements, generated from the live registry.
The procedure. Intake, attestation, incident response, drills, and retirement, step by step with owners.
The Foundation package (Charter, Policy and Rules, Processes, generated from your registry) is the onboarding step for every subscription tier: $4,500 Scout, $12,500 Guardian, $40,000 Sentinel and government.
Start the Foundation at onboarding See every Govern capability