# D — Govern digital systems and ethical agents

## Power 22 — Data, Digital & AI Use-Case Portfolio Governor

**Stable ID:** `PWR-22`  
**Install state:** `Available Inactive`  
**Activation rule:** visibility is not authority; pass CHART, preview the exact workflow, name the human owner and activate only by an explicit receipt.

**Purpose.** Create one transparent inventory of digital and AI use cases, value hypotheses, data, owners, risk tiers, evidence, lifecycle state and retirement obligations.

**Required inputs.** use-case sponsor; problem; users and affected people; alternatives; data classes; model/vendor; integrations; decision impact; evidence; controls; costs; lifecycle owner.

**Operating sequence.** verify problem before technology; classify decision and rights impact; run CHART and ALIGN; compare non-AI alternatives; define evidence, monitoring, incident, change, renewal and exit requirements.

**Power-specific output.** Digital/AI Use-Case Card, portfolio register, risk-and-rights tier, evidence plan, stage gate and retirement obligation.

**Human checkpoint.** authorized data, AI, privacy, security, legal, procurement, clinical, HR, finance and governance humans approve each stage.

**Prohibited actions.** no shadow AI, model procurement, production data, connector, deployment, automated high-impact decision, vendor endorsement or self-approval.

**Finish state.** Save only an approved artifact with owner, partition, source/version, fact-versus-interpretation labels, human decision owner, expiry, retention, correction, export and deletion. Otherwise discard the preview. The power returns to `Available Inactive`; no agent or schedule remains running.

## Power 23 — AI Agent Charter, Tool, Permission & Human-Handoff Designer

**Stable ID:** `PWR-23`  
**Install state:** `Available Inactive`  
**Activation rule:** visibility is not authority; pass CHART, preview the exact workflow, name the human owner and activate only by an explicit receipt.

**Purpose.** Define a bounded software agent before any run: objective, owner, non-goals, data, sources, tools, destinations, permission, tests, human handoffs, expiry, kill and fallback.

**Required inputs.** one narrow objective; accountable owner; beneficiary and affected people; risk tier; data; sources; tools; destination; time/cost budget; human decision owner.

**Operating sequence.** run ORBIT; use least privilege; prohibit recursive delegation and permission escalation; design normal, failure, bias, security, prompt-injection and recovery tests; make handoff and acknowledgment explicit.

**Power-specific output.** ORBIT Agent Charter, permission envelope, tool/data registry, test plan, human-handoff map, kill/purge/rollback and retirement plan.

**Human checkpoint.** a named human approves one bounded run only after tests pass; install state remains PERM-P0 Disabled until then.

**Prohibited actions.** no clinical, patient, employment, coverage, finance, identity, contract or compliance decision; no production write, self-activation, self-modification or hidden persistence.

**Finish state.** Save only an approved artifact with owner, partition, source/version, fact-versus-interpretation labels, human decision owner, expiry, retention, correction, export and deletion. Otherwise discard the preview. The power returns to `Available Inactive`; no agent or schedule remains running.

## Power 24 — Agent Evaluation, Monitoring, Incident, Kill, Rollback & Retirement Controller

**Stable ID:** `PWR-24`  
**Install state:** `Available Inactive`  
**Activation rule:** visibility is not authority; pass CHART, preview the exact workflow, name the human owner and activate only by an explicit receipt.

**Purpose.** Give administrators evidence and controls to preview, test, supervise, stop, investigate and retire agents without letting an agent govern itself.

**Required inputs.** approved charter; frozen version; test set; expected outputs; run owner; permission; tool logs; costs; human decisions; incident and recovery routes.

**Operating sequence.** evaluate usefulness, accuracy, provenance, bias, privacy, security and failure behavior; compare to baseline; monitor bounded runs; require named-human release; contain failures; verify rollback, purge and retirement.

**Power-specific output.** Evaluation Scorecard, run receipt, exception log, human accept/reject record, incident packet, kill proof, rollback/purge proof and retirement certificate shell.

**Human checkpoint.** an independent named human or control function authorizes release, kill, rollback and retirement; agent output is never self-attestation.

**Prohibited actions.** no self-review as sole evidence, silent retry, hidden copy, permission increase, production release, evidence deletion, incident suppression or claim of zero risk.

**Finish state.** Save only an approved artifact with owner, partition, source/version, fact-versus-interpretation labels, human decision owner, expiry, retention, correction, export and deletion. Otherwise discard the preview. The power returns to `Available Inactive`; no agent or schedule remains running.
