Name the Owner and the Human Decision
Work through the explanation, apply it to the example, and complete the quick check before continuing.
Responsibility must be specific
A human will review it is incomplete.
Meaningful oversight names a person or role with:
- Authority to decide.
- Relevant information and criteria.
- Enough time and competence.
- Ability to revise, reject, stop, or escalate.
- Responsibility recorded in the workflow.
Assign control owners
Different controls may need different owners:
| Control | Example owner |
|---|---|
| Task and benefit | Programme owner |
| Data permission and retention | Data owner/privacy role |
| Access and security testing | Security owner |
| Accessibility testing | Accessibility lead |
| Final content approval | Communications owner |
| High-impact decision | Authorised decision-maker |
One person may hold several roles in a small organisation, but the responsibilities still need to be named.
Policy is a starting control
An organisation should define approved tools, permitted data, prohibited uses, review levels, incident reporting, retention, and responsible owners.
A policy that nobody understands or enforces is not enough. Training, technical restrictions, logs, testing, and response procedures turn policy into practice.
Record accountability
For material workflows, record who approved the task, tools, data, controls, final output, and changes. Keep only necessary records and protect them according to their sensitivity.
Remember
- Name a role, not an imaginary generic human.
- Give the reviewer evidence, criteria, time, authority, and a real action.
- Combine policy with technical and operational controls.
- Record decisions without creating unnecessary sensitive logs.
Next, we will define when AI should not be used.