Abstract
This disclosure describes a single governance point through which an AI system must pass both the actions it takes on the world and its automated access to data and resources. Actions include physical commands, tool and API calls that change state, transactions and messages sent. Access includes reading or querying data, retrieving documents, obtaining credentials, and using compute, storage or network capacity. Every such request is classified by its effect rather than by the channel it arrives on, checked against one policy, one identity and one current governor level, and either admitted, narrowed, held for human approval or refused. Access is granted only as short-lived, purpose-bound grants tied to the governor level in force when they were issued; when the level rises, outstanding grants are narrowed or revoked at once. Because actions and access are judged together, the point can also detect a sequence of individually permitted requests whose combined effect is one the policy forbids, such as an agent that is refused a payment action but tries to write the same instruction into the payment system's queue. Every decision is recorded in one tamper-evident record, so that an auditor sees a single account of what the AI system did and what it touched.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Wang, Edward D. H., "SI Regulator™: One Governance Point for an AI System's Actions and Its Automated Access to Data and Resources", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/12138