Name the Owner and the Human Decision
Work through the explanation, apply it to the example, and complete the quick check before continuing.
Text description of the visual
The figure contrasts weak review, which only says that a human will review the result, with meaningful oversight that provides authority, evidence, criteria, time, competence, and the ability to revise, reject, stop, or escalate. It maps control areas to example owners: task and benefit to the programme owner, data permission and retention to a data owner or privacy role, access and security testing to a security owner, accessibility testing to an accessibility lead, final content approval to a communications owner, and high-impact decisions to an authorised decision-maker. It also shows that policy becomes practice only when supported by training, technical restrictions, logs, testing, and response procedures. The final reminder says to record decisions without creating unnecessary sensitive logs.
Responsibility must be specific
A human will review it is incomplete.
Meaningful oversight names a person or role with:
- Authority to decide.
- Relevant information and criteria.
- Enough time and competence.
- Ability to revise, reject, stop, or escalate.
- Responsibility recorded in the workflow.
Assign control owners
Different controls may need different owners:
| Control | Example owner |
|---|---|
| Task and benefit | Programme owner |
| Data permission and retention | Data owner/privacy role |
| Access and security testing | Security owner |
| Accessibility testing | Accessibility lead |
| Final content approval | Communications owner |
| High-impact decision | Authorised decision-maker |
One person may hold several roles in a small organisation, but the responsibilities still need to be named.
Policy is a starting control
An organisation should define approved tools, permitted data, prohibited uses, review levels, incident reporting, retention, and responsible owners.
A policy that nobody understands or enforces is not enough. Training, technical restrictions, logs, testing, and response procedures turn policy into practice.
Record accountability
For material workflows, record who approved the task, tools, data, controls, final output, and changes. Keep only necessary records and protect them according to their sensitivity.
Remember
- Name a role, not an imaginary generic human.
- Give the reviewer evidence, criteria, time, authority, and a real action.
- Combine policy with technical and operational controls.
- Record decisions without creating unnecessary sensitive logs.
Next, we will define when AI should not be used.