# AI governance and assurance

*Tiered access, dual use capability, human control points, and the evidence an auditor will ask for.*

## Production summary

- Modules to record: 2
- Total script: 1560 words, about 10 minutes of finished audio
- Voices: Amara (host) and Nadia (practice educator)
- Level: Level 4 to 6. Security, risk, compliance, engineering and technology leadership

## Accreditation wording that must appear in the description

- **The CPD Certification Service** (planned): Application scheduled.
- **BS ISO/IEC 42001 artificial intelligence management systems** (aligned): Written to sit against the published management system requirements. This is our own mapping and implies no certification or endorsement.
- **Cyber Essentials access control requirements** (aligned): The access control material is written consistent with the published scheme requirements. Our own mapping, not an assurance by the scheme.

> Do not upgrade any of these words in a description or a thumbnail. Aligned is not accredited, and planned is not approved.


---

## Tiered access, dual use capability, and who is allowed to do what

**Runtime** about 5 minutes. **Words** 747. **Starts at** 00:00 in the full course recording.

### Learning outcomes to state on camera

- Explain why capability access is tiered rather than binary
- Define dual use capability with examples from defensive work
- Distinguish prohibited use from restricted dual use
- Distinguish organisational verification from individual authorisation
- Explain why permission to use a capability is not permission to act on a target

### Script


`[CUE 1]` *Three concentric access tiers with the population of each shrinking inwards*

**AMARA**  [00:00]
Access used to be a licence. Why has it turned into tiers?

**NADIA**  [00:04]
Because a single capability now serves defence and attack equally well, and a binary switch cannot express that. So it has settled into three levels: broad access for ordinary work, a verified tier an organisation applies for, and a restricted tier negotiated with a handful of partners.

**AMARA**  [00:23]
Do the names matter?

**NADIA**  [00:25]
Not at all, and that is why this course does not teach them. They change every few months and they differ by provider. The structure is stable. Somebody who understands why the middle tier exists can assess any provider's version of it in an afternoon.

**AMARA**  [00:43]
Define dual use, then, since the middle tier depends on it.

**NADIA**  [00:47]
Capability whose defensive and offensive uses are the same capability. Not an edge case. Most of security work.


`[CUE 2]` *The same request written twice, defender and attacker, appearing identical*

**AMARA**  [00:54]
Give me a concrete example.

**NADIA**  [00:56]
Understanding an attack technique in enough detail to write a detection for it is the same understanding needed to carry it out. Building a tool that simulates an adversary to test your defences produces a tool that attacks. There is no version of that work that is safely one sided.

**AMARA**  [01:16]
So why not just read the request and judge it?

**NADIA**  [01:20]
Because there is nothing in the request to judge. The defender's question and the attacker's question are the same words. The only thing that separates them is who is asking and why, and that information is not in the sentence. It is at the organisation.

**AMARA**  [01:38]
Which is what verification collects.

**NADIA**  [01:40]
Precisely. It supplies the missing context once, up front, instead of arguing it in every interaction. That is the whole design.


`[CUE 3]` *A prohibited and a restricted example separating into two different paths*

**AMARA**  [01:49]
People assume verification unlocks everything. Does it?

**NADIA**  [01:52]
No, and the distinction is worth being firm about. Prohibited use is conduct with no legitimate version: extortion tooling, mass exfiltration, anything whose only purpose is harm. No tier grants that. Restricted dual use is legitimate work that is gated until context exists. Only the second is what applying is for.

**AMARA**  [02:12]
Why does the confusion matter?

**NADIA**  [02:14]
Because a policy that blurs them teaches your staff that the whole subject is arbitrary, and people who believe a rule is arbitrary route around it. Being able to explain why one thing is gated and another is refused outright is what makes the rules survivable.

**AMARA**  [02:32]
Verification is granted to an organisation, not a person.

**NADIA**  [02:36]
And that has consequences people miss. The organisation is accountable for everything done under it, including by staff who never saw the application. So access has to be bound to individual accounts inside the organisation.


`[CUE 4]` *Organisational verification fanning out to individual named accounts*

**AMARA**  [02:50]
Why not a shared key? It is simpler.

**NADIA**  [02:53]
Because a shared key means accountability stops at your front door. You can prove your organisation did something and never prove who. In an incident that is the difference between a conversation and an investigation.

**AMARA**  [03:07]
What about leavers?

**NADIA**  [03:08]
A leaver holding a credential still holds your verification. Offboarding on the day, not at the next quarterly review. Treat the credential as a controlled asset with a named owner, because that is exactly what it is.

**AMARA**  [03:23]
Now the sentence you said matters most.

**NADIA**  [03:26]
Access is not authorisation. Being permitted to use a capability is completely separate from being authorised to use it against a particular target.


`[CUE 5]` *A verification badge and a signed authorisation letter shown as two separate documents*

**AMARA**  [03:35]
Unpack that.

**NADIA**  [03:36]
A provider grants verification. Only the owner of a system can authorise you to test that system, in writing, with a scope, dates and named contacts. In this country, accessing a system without the owner's authorisation is an offence under the Computer Misuse Act, and no provider tier alters that by one word.

**AMARA**  [03:57]
Does anyone genuinely get that wrong?

**NADIA**  [04:00]
Rarely on purpose. It happens as drift. A test authorised for one range extends to an adjacent one that belongs to somebody else. Or a supplier's system is assessed as part of due diligence and the supplier was never asked. Both are honest, and neither is a defence.

**AMARA**  [04:19]
Last thing. What should a small organisation's policy say?

**NADIA**  [04:22]
Short enough that people read it. Name an owner. Say what these tools are for and give two or three concrete examples of what they are not for. Say what data may be sent to them, which is where most firms have an exposure they have never examined.

**AMARA**  [04:42]
And when something is not covered?

**NADIA**  [04:44]
Name the person to ask. If there is no named person, the decision still gets made, quietly, by whoever is under the most pressure at the time. That is the outcome a policy exists to prevent.

### Sources for the on screen credit

- Computer Misuse Act 1990, United Kingdom legislation
- BS ISO/IEC 42001 Artificial intelligence management system, British Standards Institution
- Guidelines for secure AI system development, National Cyber Security Centre

---

## Controls, evidence and the human gate

**Runtime** about 5 minutes. **Words** 813. **Starts at** 04:58 in the full course recording.

### Learning outcomes to state on camera

- Specify identity, scoping, logging and retention controls around access
- Explain why model output must be validated before it is acted upon
- Place a human approval point correctly in an automated workflow
- Design an approval that produces informed consent rather than a reflex
- Map controls onto published AI management and risk frameworks
- Describe the evidence an assessor will ask for and where it comes from

### Script


`[CUE 1]` *The four control questions with an example answer building beneath each*

**AMARA**  [04:58]
An organisation has the access it wanted. What comes next?

**NADIA**  [05:02]
The half that decides whether holding it is an asset or a liability. Four questions. Who is this. What may they reach. What was done. How long do we keep that.

**AMARA**  [05:15]
That sounds like ordinary access management.

**NADIA**  [05:17]
It is ordinary access management, and that is reassuring rather than disappointing. Organisations that already do this well for other systems have most of the work done. The ones that struggle here were struggling before.

**AMARA**  [05:31]
You singled out retention.

**NADIA**  [05:33]
Because it is the one answered by accident. You are sending content out and receiving content back. Both are records. Almost nobody has decided what happens to them.


`[CUE 2]` *A retention timeline showing the cost of keeping everything and of keeping nothing*

**AMARA**  [05:44]
What is the risk in keeping it all?

**NADIA**  [05:47]
You accumulate a large, attractive store of precisely the material you would least like read, and it is discoverable. Keep nothing and you cannot investigate an incident or answer an assessor. Neither extreme is a position. A stated period with a stated reason is.

**AMARA**  [06:05]
And where personal data is involved?

**NADIA**  [06:07]
Then data protection law is already answering the question. No longer than necessary for a defined purpose, and people can be told what happens to it. A deliberate period applied consistently is defensible. An accumulation nobody chose is not.

**AMARA**  [06:23]
You said something earlier about auditing what is being sent.

**NADIA**  [06:27]
Ask that before anything else. Most organisations worrying about an access tier have never audited what ordinary staff are pasting into these systems on a Tuesday. That is usually the larger exposure and it is entirely unglamorous.


`[CUE 3]` *An assertion moving through validation into a confirmed finding, and one failing*

**AMARA**  [06:41]
Move to output. How much should people trust it?

**NADIA**  [06:45]
Treat an assertion as evidence to investigate, not as a finding. That holds no matter how confident it sounds, and confidence of expression carries no information at all about accuracy.

**AMARA**  [06:57]
In security work specifically.

**NADIA**  [06:59]
There is a clean version of the distinction. Identifying what could be exploited is a different problem from establishing what is actually happening in your environment. Exploitability depends on reachability, configuration, compensating controls, whether the affected path ever executes. None of that is visible from the artefact.

**AMARA**  [07:17]
So validation is a control in its own right.

**NADIA**  [07:21]
A named step with an owner, not a hope that somebody sensible will check. And size it to the consequence. A recommendation that reorders a backlog needs a glance. A recommendation that blocks traffic needs somebody who understands what is behind that address.


`[CUE 4]` *A workflow with reversible steps running freely and a gate before state change*

**AMARA**  [07:38]
The human gate. Where does it go?

**NADIA**  [07:41]
In front of anything that changes state. Reading, analysing, drafting, recommending can all run freely. Deploying, blocking, deleting, paying, publishing wait for a person.

**AMARA**  [07:51]
Why draw the line at state change rather than at importance?

**NADIA**  [07:55]
Because reversibility is the property that matters. An analysis that is wrong costs an hour of somebody's time. A configuration change that is wrong costs an outage. A block on the wrong identifier costs you a customer, and you find out from the customer.

**AMARA**  [08:13]
Most approval steps become rituals.

**NADIA**  [08:15]
They do, and it is a design failure rather than a human one. Present somebody with two hundred items and one confirmation button and you have manufactured consent without understanding. It will be granted at four in the afternoon by a person who has approved the last thirty without incident.


`[CUE 5]` *A framework clause table with arrows pointing to where each piece of evidence lives*

**AMARA**  [08:35]
What does a real one look like?

**NADIA**  [08:38]
It shows the specific change, not a batch summary. It shows what happens if this is wrong, not only what it does. And the approver has genuine standing to refuse without it counting against them.

**AMARA**  [08:52]
How would you audit whether a gate is real?

**NADIA**  [08:55]
Count the refusals. In the last quarter, how many proposals were turned down at that gate. If the answer is none, you do not have a control, you have an unreviewed automation with a confirmation screen in front of it.

**AMARA**  [09:11]
Frameworks. Which one should an organisation pick?

**NADIA**  [09:14]
They are complementary rather than competing, and the choice matters less than writing the mapping down. There is a management system standard for artificial intelligence shaped like every other management system standard. There is a risk framework built around governing, mapping, measuring and managing. There is national guidance on building and deploying securely. And there is European legislation that classifies by risk and reaches organisations outside the union whose systems are used inside it.

**AMARA**  [09:44]
Why does writing the mapping matter so much?

**NADIA**  [09:47]
Because an assessor arrives holding a framework and is trying to find your controls inside it. A table pointing from each clause to where the evidence lives saves several days, and it shows you your own gaps before somebody else finds them.

**AMARA**  [10:04]
Last question. What is the giveaway that an organisation is not really doing this?

**NADIA**  [10:09]
No incidents recorded. An organisation with a clean incident log is rarely an organisation with no incidents. It is usually one with no route for reporting them, and every experienced assessor reads it exactly that way.

### Sources for the on screen credit

- BS ISO/IEC 42001 Artificial intelligence management system, British Standards Institution
- Artificial Intelligence Risk Management Framework, National Institute of Standards and Technology
- Guidelines for secure AI system development, National Cyber Security Centre
- Data protection principles: storage limitation, Information Commissioner's Office

---

*Copyright WAJD Group. Built by WAJD AI.*