Assistant data scope
- 0 sources, 0 documents.
- 2 restricted sources excluded.
AI governance, security and trust
Govern the AI your organisation uses
Teams adopt AI tools faster than anyone records them, who approved them or what they may touch.
Demonstration: Pellam Diagnostics Ltd (fictional) · Medical devices. Fictional data and a scripted answer.
The situation
- Organisation
- Pellam Diagnostics Ltd (fictional)
- Who is asking
- Head of AI governance
- Industry
- Medical devices
- What happened
- Staff want an AI assistant that can answer questions from company documents, and the committee must decide which data it may read.
The question asked
Which company data may the AI assistant be allowed to read, and which must be kept from it?
What it reads, and who can see the result
- Data source inventory registerSources with their classification.
- AI use policy documentWhat AI tools may and may not access.
- Reads
- The inventory and the AI use policy.
- Does not read
- The content of any source at this step.
- Permission
- AI governance access to the inventory.
- Who sees it
- The head of AI governance, the CISO and the data protection officer.
Try it
Choose what the platform may read. Restricted material cannot be put in scope here, and a classification the analysis is unsure of must be verified by a person.
| Read it? | Source | Holds | Sensitivity | What the analysis thinks it is |
|---|---|---|---|---|
| Published product documentation Public site | 540 documents | open | Product manuals and datasheets clear | |
| Internal procedures Quality system | 1,900 documents | internal | Approved procedures clear | |
| Support knowledge base Helpdesk | 3,200 documents | internal | Support articles check | |
| Clinical evaluation files Regulatory share | 410 documents | restricted | Clinical data and evaluations clear | |
| Board minutes Governance system | 260 documents | restricted | Board papers clear | |
| Shared team folders File server | 15,800 documents | internal | Mixed working files check |
- Sources in scope
- 0 of 6
- documents in scope
- 0
- Restricted, kept out
- 2 sources
- To verify
- 0
The answer
Simulated answer. Written for this fictional case, not produced by a live model. Only the figures in it are computed, from what you decided above.
0 of 6 sources are open to the assistant, 0 documents.
The policy allows an assistant to read open and internal material but never restricted material, whatever the convenience [S1][S2]. Clinical evaluation files and board minutes are restricted and cannot be added here.
Two classifications are uncertain, and mixed team folders are the usual place restricted material hides, so a person must verify them: 0 included source(s) still need that check.
Relies on: S1 · Data source inventoryS2 · AI use policy v1
Review and approval
The head of AI governance with the data protection officer decides. Approving sets the data the assistant may read. It does not switch the assistant on, and it can be narrowed or revoked at any time.
Not ready to approve. Choose at least one source to read first.
In the product this is a different person with the right permission. Here you play that role to see the rule.
What it produces
Governance decision
- The decision, the person who verified each uncertain source and the policy applied.
Limits of this example
- Scope limits what the assistant can read; it says nothing about how well it answers.
- Answers still need the evidence checks described elsewhere on this site.
- This is a scripted demonstration on fictional data. No model was called and no real organisation, person or result is shown.
More in AI governance, security and trust
- A Trust and Security area for customersSecurity and procurement teams ask the same questions again and again, and the answers are scattered.
- Permissions, approvals and an audit trailWhen something goes wrong, nobody can say who could do what, who approved it and when.
- Answers that show their evidenceA fluent answer that cannot show where it came from is a risk, not a help.
- Retention, holds and where work is processedRecords are kept too long or deleted too soon, and nobody can show why.
The AI governance, security and trust story · This capability in the full register