Demonstration · AI governance, security and trust · 4 steps
From what the AI may read to answers with evidence
Set what an assistant may read, audit who has access, answer a customer's security questions with evidence, and check what the Trust area can honestly say.
Example: Brightwater Software (fictional) · Head of security and trust. Fictional data and a scripted answer.
- What happened
- A customer wants to use the company's AI assistant on its own data and has sent a security questionnaire.
- The question
- What may the assistant read, who can reach it, what can we honestly answer, and what do we say we do not hold?
The journey, step by step
Simulation. A scripted journey on fictional data, not produced by a live model. Each step uses what you decided in the steps before it, and only the figures are computed.
What the assistant may readChoose the data sources the assistant may read. Restricted material stays out; an uncertain classification needs a person.Open
Choose the data sources the assistant may read. Restricted material stays out; an uncertain classification needs a person.
Choose what the platform may read. Restricted material cannot be put in scope here, and a classification the analysis is unsure of must be verified by a person.
Read it? Source Holds Sensitivity What the analysis thinks it is Published product documentation
Public site540 documents open Manuals and datasheets clear Internal procedures
Quality system1,900 documents internal Approved procedures clear Support knowledge base
Helpdesk3,200 documents internal Support articles check Board minutes
Governance system260 documents restricted Board papers clear Customer contracts
Contract system840 documents restricted Commercial terms clear - Sources in scope
- 0 of 5
- documents in scope
- 0
- Restricted, kept out
- 2 sources
- To verify
- 0
0 of 5 sources are open to the assistant, 0 documents.
The assistant reads open and internal material and never restricted material [S1]. 0 included source(s) still need a person to verify their classification.
Relies on: S1 · Data source inventory
The head of AI governance decides. Approving sets what the assistant may read. It does not switch the assistant on, and it can be narrowed or revoked at any time.
Not ready. Choose at least one source to read first.
Next: Who can reach it. It opens when the step above is complete.
Limits of this example
- Nothing here claims a certification, an audit result or any assurance the company does not hold, and the journey shows absence as absence.
- A scripted journey on fictional data.
- This is a scripted demonstration on fictional data. No model was called and no real organisation, person or result is shown.
The capabilities this draws on
- Govern the AI your organisation usesTeams adopt AI tools faster than anyone records them, who approved them or what they may touch.
- Permissions, approvals and an audit trailWhen something goes wrong, nobody can say who could do what, who approved it and when.
- Answers that show their evidenceA fluent answer that cannot show where it came from is a risk, not a help.
- A Trust and Security area for customersSecurity and procurement teams ask the same questions again and again, and the answers are scattered.
The AI governance, security and trust story · All demonstrations
The other journeys
- From a recording to a verified practitionerA line changeover is captured with consent, drafted from its sources, reviewed, released with its gates, and checked in practice.
- Finding and understanding your data, read onlyApprove which folders the platform may read, classify what a database holds, and see what depends on each source.
- From supplier findings to a recovery planReview invoice findings against contract terms, see what recovering them is worth, and decide whom to approach first.
- From a new market to an evidenced obligation registerEstablish which obligations apply to a planned expansion, check the evidence for them, and see whether you will be ready by the audit date.
- From a legal notice to a reviewed responseRead a letter before action, protect the evidence it asks you to keep, and settle the wording of the reply.
- From a what-if to a board resolutionTest an acquisition under assumptions, compare the options, and settle the resolution put to the board.