AI governance and assurance

Cue 1 Three concentric access tiers with the population of each shrinking inwards

AMARA 00:00 Access used to be a licence. Why has it turned into tiers?

NADIA 00:04 Because a single capability now serves defence and attack equally well, and a binary switch cannot express that. So it has settled into three levels: broad access for ordinary work, a verified tier an organisation applies for, and a restricted tier negotiated with a handful of partners.

AMARA 00:23 Do the names matter?

NADIA 00:25 Not at all, and that is why this course does not teach them. They change every few months and they differ by provider. The structure is stable. Somebody who understands why the middle tier exists can assess any provider's version of it in an afternoon.

AMARA 00:43 Define dual use, then, since the middle tier depends on it.

NADIA 00:47 Capability whose defensive and offensive uses are the same capability. Not an edge case. Most of security work.

Cue 2 The same request written twice, defender and attacker, appearing identical

AMARA 00:54 Give me a concrete example.

NADIA 00:56 Understanding an attack technique in enough detail to write a detection for it is the same understanding needed to carry it out. Building a tool that simulates an adversary to test your defences produces a tool that attacks. There is no version of that work that is safely one sided.

AMARA 01:16 So why not just read the request and judge it?

NADIA 01:20 Because there is nothing in the request to judge. The defender's question and the attacker's question are the same words. The only thing that separates them is who is asking and why, and that information is not in the sentence. It is at the organisation.

AMARA 01:38 Which is what verification collects.

NADIA 01:40 Precisely. It supplies the missing context once, up front, instead of arguing it in every interaction. That is the whole design.

Cue 3 A prohibited and a restricted example separating into two different paths

AMARA 01:49 People assume verification unlocks everything. Does it?

NADIA 01:52 No, and the distinction is worth being firm about. Prohibited use is conduct with no legitimate version: extortion tooling, mass exfiltration, anything whose only purpose is harm. No tier grants that. Restricted dual use is legitimate work that is gated until context exists. Only the second is what applying is for.

AMARA 02:12 Why does the confusion matter?

NADIA 02:14 Because a policy that blurs them teaches your staff that the whole subject is arbitrary, and people who believe a rule is arbitrary route around it. Being able to explain why one thing is gated and another is refused outright is what makes the rules survivable.

AMARA 02:32 Verification is granted to an organisation, not a person.

NADIA 02:36 And that has consequences people miss. The organisation is accountable for everything done under it, including by staff who never saw the application. So access has to be bound to individual accounts inside the organisation.

Cue 4 Organisational verification fanning out to individual named accounts

AMARA 02:50 Why not a shared key? It is simpler.

NADIA 02:53 Because a shared key means accountability stops at your front door. You can prove your organisation did something and never prove who. In an incident that is the difference between a conversation and an investigation.

AMARA 03:07 What about leavers?

NADIA 03:08 A leaver holding a credential still holds your verification. Offboarding on the day, not at the next quarterly review. Treat the credential as a controlled asset with a named owner, because that is exactly what it is.

AMARA 03:23 Now the sentence you said matters most.

NADIA 03:26 Access is not authorisation. Being permitted to use a capability is completely separate from being authorised to use it against a particular target.

Cue 5 A verification badge and a signed authorisation letter shown as two separate documents

AMARA 03:35 Unpack that.

NADIA 03:36 A provider grants verification. Only the owner of a system can authorise you to test that system, in writing, with a scope, dates and named contacts. In this country, accessing a system without the owner's authorisation is an offence under the Computer Misuse Act, and no provider tier alters that by one word.

AMARA 03:57 Does anyone genuinely get that wrong?

NADIA 04:00 Rarely on purpose. It happens as drift. A test authorised for one range extends to an adjacent one that belongs to somebody else. Or a supplier's system is assessed as part of due diligence and the supplier was never asked. Both are honest, and neither is a defence.

AMARA 04:19 Last thing. What should a small organisation's policy say?

NADIA 04:22 Short enough that people read it. Name an owner. Say what these tools are for and give two or three concrete examples of what they are not for. Say what data may be sent to them, which is where most firms have an exposure they have never examined.

AMARA 04:42 And when something is not covered?

NADIA 04:44 Name the person to ask. If there is no named person, the decision still gets made, quietly, by whoever is under the most pressure at the time. That is the outcome a policy exists to prevent.

Cue 1 The four control questions with an example answer building beneath each

AMARA 04:58 An organisation has the access it wanted. What comes next?

NADIA 05:02 The half that decides whether holding it is an asset or a liability. Four questions. Who is this. What may they reach. What was done. How long do we keep that.

AMARA 05:15 That sounds like ordinary access management.

NADIA 05:17 It is ordinary access management, and that is reassuring rather than disappointing. Organisations that already do this well for other systems have most of the work done. The ones that struggle here were struggling before.

AMARA 05:31 You singled out retention.

NADIA 05:33 Because it is the one answered by accident. You are sending content out and receiving content back. Both are records. Almost nobody has decided what happens to them.

Cue 2 A retention timeline showing the cost of keeping everything and of keeping nothing

AMARA 05:44 What is the risk in keeping it all?

NADIA 05:47 You accumulate a large, attractive store of precisely the material you would least like read, and it is discoverable. Keep nothing and you cannot investigate an incident or answer an assessor. Neither extreme is a position. A stated period with a stated reason is.

AMARA 06:05 And where personal data is involved?

NADIA 06:07 Then data protection law is already answering the question. No longer than necessary for a defined purpose, and people can be told what happens to it. A deliberate period applied consistently is defensible. An accumulation nobody chose is not.

AMARA 06:23 You said something earlier about auditing what is being sent.

NADIA 06:27 Ask that before anything else. Most organisations worrying about an access tier have never audited what ordinary staff are pasting into these systems on a Tuesday. That is usually the larger exposure and it is entirely unglamorous.

Cue 3 An assertion moving through validation into a confirmed finding, and one failing

AMARA 06:41 Move to output. How much should people trust it?

NADIA 06:45 Treat an assertion as evidence to investigate, not as a finding. That holds no matter how confident it sounds, and confidence of expression carries no information at all about accuracy.

AMARA 06:57 In security work specifically.

NADIA 06:59 There is a clean version of the distinction. Identifying what could be exploited is a different problem from establishing what is actually happening in your environment. Exploitability depends on reachability, configuration, compensating controls, whether the affected path ever executes. None of that is visible from the artefact.

AMARA 07:17 So validation is a control in its own right.

NADIA 07:21 A named step with an owner, not a hope that somebody sensible will check. And size it to the consequence. A recommendation that reorders a backlog needs a glance. A recommendation that blocks traffic needs somebody who understands what is behind that address.

Cue 4 A workflow with reversible steps running freely and a gate before state change

AMARA 07:38 The human gate. Where does it go?

NADIA 07:41 In front of anything that changes state. Reading, analysing, drafting, recommending can all run freely. Deploying, blocking, deleting, paying, publishing wait for a person.

AMARA 07:51 Why draw the line at state change rather than at importance?

NADIA 07:55 Because reversibility is the property that matters. An analysis that is wrong costs an hour of somebody's time. A configuration change that is wrong costs an outage. A block on the wrong identifier costs you a customer, and you find out from the customer.

AMARA 08:13 Most approval steps become rituals.

NADIA 08:15 They do, and it is a design failure rather than a human one. Present somebody with two hundred items and one confirmation button and you have manufactured consent without understanding. It will be granted at four in the afternoon by a person who has approved the last thirty without incident.

Cue 5 A framework clause table with arrows pointing to where each piece of evidence lives

AMARA 08:35 What does a real one look like?

NADIA 08:38 It shows the specific change, not a batch summary. It shows what happens if this is wrong, not only what it does. And the approver has genuine standing to refuse without it counting against them.

AMARA 08:52 How would you audit whether a gate is real?

NADIA 08:55 Count the refusals. In the last quarter, how many proposals were turned down at that gate. If the answer is none, you do not have a control, you have an unreviewed automation with a confirmation screen in front of it.

AMARA 09:11 Frameworks. Which one should an organisation pick?

NADIA 09:14 They are complementary rather than competing, and the choice matters less than writing the mapping down. There is a management system standard for artificial intelligence shaped like every other management system standard. There is a risk framework built around governing, mapping, measuring and managing. There is national guidance on building and deploying securely. And there is European legislation that classifies by risk and reaches organisations outside the union whose systems are used inside it.

AMARA 09:44 Why does writing the mapping matter so much?

NADIA 09:47 Because an assessor arrives holding a framework and is trying to find your controls inside it. A table pointing from each clause to where the evidence lives saves several days, and it shows you your own gaps before somebody else finds them.

AMARA 10:04 Last question. What is the giveaway that an organisation is not really doing this?

NADIA 10:09 No incidents recorded. An organisation with a clean incident log is rarely an organisation with no incidents. It is usually one with no route for reporting them, and every experienced assessor reads it exactly that way.