Governance, policy and approvals

AI IT House 26.10.5 uses layered enforcement. Prompt text may reinforce expected behavior, but the high-value controls are intended to sit in data contracts, tool permissions, provider adapters, deterministic validators and human authority boundaries.

Enforcement order

The intended precedence is:

Enterprise policy
→ sandbox / host controls
→ agent permission set
→ MCP / tool allowlist
→ managed hooks
→ prompt instructions

A prompt is the weakest enforcement tier in that chain.

JAI policy responsibilities

• L1 binds work to accountable purpose and authority scope.
• L3 owns policy constraints, acceptance criteria, evidence obligations, exceptions and escalation rules.
• L5 binds design to permitted tools/implementation controls.
• L6 records actual observations, failures and execution evidence.
• L0 remains the external authority for consequential acceptance/exception/revision decisions.

High-value operating rules

The packaged policy is designed to uphold these principles:

• reviewers do not edit the artefact they are approving;
• authors do not self-approve;
• policy mutation requires controlled approval;
• restricted provider/MCP capabilities should not be bypassed through shell indirection;
• high-consequence authority actions remain human-controlled;
• publication separates semantic ownership, evidence/rationale review, publication editing, visual review and final authority;
• layered rework/reformulation/escalation follows deterministic bounds rather than model-selected retry loops.

Human authority acts

Examples include:

• accepting a risk instead of fixing it;
• granting a time-bounded exception;
• approving a protected library change;
• accepting a consequential final L1 product;
• choosing revise, reject or terminate for an escalated engagement.

These decisions are not ordinary model outputs. See Human authority and escalation.

Authority-hook behavior

guard_authority.py protects common authority commands and protected records. In normal Claude interactive mode it can ask the operator to approve an authority command. In Codex the same path fails closed and asks the human to run the authority command manually because the hook cannot elevate to an interactive approval prompt.

In non-interactive modes that would hide the approval question, authority acts are denied.

Security boundary of hooks

Managed hooks are useful enforcement but are not the whole sandbox. The authority hook itself describes its protection as a string-level guard. Deployments with stronger threat models should enforce the same rules through operating-system/container permissions, restricted credentials and network controls.

Data classification and network behavior

The default managed policy assumes enterprise caution: network access is deny-by-default and permitted through controlled/provider contract paths. Organisations must adapt classification, network, evidence-retention and provider-use rules for their environment.