Governance
2026-09-08 · 8 min read
Key takeaways
- No agent approves its own action.
- Every logged interaction carries an integrity hash.
- Risk class and human oversight are configuration, not policy documents.
ERP, PLM, CRM and documents keep provenance and version.
Authority is data
Each role has an approval limit, each action a threshold, each Super App a list of authorized users with geography, category and read/write limits.
Above the threshold the decision routes to a second approver; the agent cannot bypass it.
Integrity and retention
Interactions are logged with an SHA-256 compliance hash; encrypted content storage is opt-in and retention is configurable per company.
That combination lets legal teams answer what was kept, for how long, and whether it was altered.
EU AI Act in practice
Use cases are classified by risk, high-risk ones require documented human oversight, and each model carries its provenance.
Configuration changes are logged as Change Requests, so an audit reads the history, not a slide deck.
FAQ
Frequently asked questions
Why does “Authority is data” matter?
Each role has an approval limit, each action a threshold, each Super App a list of authorized users with geography, category and read/write limits. Above the threshold the decision routes to a second approver; the agent cannot bypass it.
How does “Integrity and retention” work?
Interactions are logged with an SHA-256 compliance hash; encrypted content storage is opt-in and retention is configurable per company. That combination lets legal teams answer what was kept, for how long, and whether it was altered.
What should a team know about “EU AI Act in practice”?
Use cases are classified by risk, high-risk ones require documented human oversight, and each model carries its provenance. Configuration changes are logged as Change Requests, so an audit reads the history, not a slide deck.