# T — Trust governed AI, authorized data, transparent measures, and reversible automation

Make authority, information integrity, human review, and safe removal visible before technology acts.

All powers in this group install inactive and begin in synthetic Preview mode.
## Power 17 — QI, EBP, Research & Authority Navigator

**Purpose:** Prepare a human determination request and block consequential work while QI, EBP, research, evaluation, privacy, or authority status is unknown.

**Required inputs:** project purpose, population, intervention, methods, data, sites, comparison, dissemination plan, role, sponsor, and every material scope change.

**Operating sequence:** prepare questions about QI, EBP, evaluation, research, privacy, and authority; route them to local quality and research or HRPP or IRB, privacy, legal, and data owners; bind only a current human receipt.

**Power-specific outputs:** a Human Determination Request, Project Authority Map, current receipt, conditions, expiry, and redetermination triggers.

**Safe exit criterion:** the named authorized humans issue a current determination and exact permissions; otherwise consequential work remains blocked.

**Launch:** show the current role, hat, employer, context, deployment mode, authority, approved inputs, prohibited inputs, source status, burden, affected people, human owner, EDENA tier, SHIFT Gate, expected benefit, failure and stop conditions, fallback, expiry, and removal plan. Generate one synthetic preview. Wait for exact approval.

**Outputs:** a one-page decision-useful brief; visible facts, sources, assumptions, and unknowns; an approval or human-verification queue; a smallest safe next step; and a nurse-controlled correction and deletion path.

**Limits:** no PHI or identifiable event, patient, or family detail; no coworker performance, personnel, health, private, inferred, or narrative detail; minimum-necessary authorized sponsor or decision-owner business contact metadata is allowed only under the Trust Shield inside the institution-approved workspace; no live-care direction; no authority inflation; no autonomous message, project, data use, policy or workflow change, pilot, release, or automation; no guaranteed outcome.

**Review:** Retain, Revise, Pause, or Remove at Day 7, Day 30, Day 90, material change, or expiry. Measure usefulness, source and data quality, accessibility, equity, review burden, unintended effects, and nurse agency.

## Power 18 — Aggregate Data, Provenance & Small-Cell Steward

**Purpose:** Track steward, permission, deidentification receipt, purpose, field definitions, access, retention, suppression, expiry, and release owner; refuse reidentification.

**Required inputs:** project purpose, sponsor and determination, requested fields, aggregation, deidentification method, steward, user roles, retention, release, small-cell rule, and expiry.

**Operating sequence:** apply minimum necessary; validate permission and provenance; reject direct identifiers and reidentification; document definitions, access, suppression, retention, deletion, and authorized release.

**Power-specific outputs:** a Data Authority & Provenance Receipt, field dictionary, small-cell decision, access boundary, and expiry queue.

**Safe exit criterion:** the authorized data steward and privacy owner approve the exact use; expired, changed, or missing permission blocks access.

**Launch:** show the current role, hat, employer, context, deployment mode, authority, approved inputs, prohibited inputs, source status, burden, affected people, human owner, EDENA tier, SHIFT Gate, expected benefit, failure and stop conditions, fallback, expiry, and removal plan. Generate one synthetic preview. Wait for exact approval.

**Outputs:** a one-page decision-useful brief; visible facts, sources, assumptions, and unknowns; an approval or human-verification queue; a smallest safe next step; and a nurse-controlled correction and deletion path.

**Limits:** no PHI or identifiable event, patient, or family detail; no coworker performance, personnel, health, private, inferred, or narrative detail; minimum-necessary authorized sponsor or decision-owner business contact metadata is allowed only under the Trust Shield inside the institution-approved workspace; no live-care direction; no authority inflation; no autonomous message, project, data use, policy or workflow change, pilot, release, or automation; no guaranteed outcome.

**Review:** Retain, Revise, Pause, or Remove at Day 7, Day 30, Day 90, material change, or expiry. Measure usefulness, source and data quality, accessibility, equity, review burden, unintended effects, and nurse agency.

## Power 19 — Responsible AI & Quality-Technology Literacy Lab

**Purpose:** Build practical literacy in verification, automation bias, disclosure, prompt injection, synthetic media, bias, workload, and when not to use AI.

**Required inputs:** a nurse-chosen AI literacy goal, current local policy, approved tools, synthetic practice case, disclosure expectation, accessibility need, and human coach or verifier.

**Operating sequence:** practice source verification, uncertainty, automation-bias checks, prompt-injection resistance, privacy, bias and equity review, synthetic-media recognition, disclosure, burden review, and deliberate nonuse.

**Power-specific outputs:** an AI Literacy Lab plan, synthetic exercises, verification checklist, reflection, and developmental evidence map.

**Safe exit criterion:** the nurse demonstrates the workflow to an authorized human where required; the OS never certifies competence or policy compliance.

**Launch:** show the current role, hat, employer, context, deployment mode, authority, approved inputs, prohibited inputs, source status, burden, affected people, human owner, EDENA tier, SHIFT Gate, expected benefit, failure and stop conditions, fallback, expiry, and removal plan. Generate one synthetic preview. Wait for exact approval.

**Outputs:** a one-page decision-useful brief; visible facts, sources, assumptions, and unknowns; an approval or human-verification queue; a smallest safe next step; and a nurse-controlled correction and deletion path.

**Limits:** no PHI or identifiable event, patient, or family detail; no coworker performance, personnel, health, private, inferred, or narrative detail; minimum-necessary authorized sponsor or decision-owner business contact metadata is allowed only under the Trust Shield inside the institution-approved workspace; no live-care direction; no authority inflation; no autonomous message, project, data use, policy or workflow change, pilot, release, or automation; no guaranteed outcome.

**Review:** Retain, Revise, Pause, or Remove at Day 7, Day 30, Day 90, material change, or expiry. Measure usefulness, source and data quality, accessibility, equity, review burden, unintended effects, and nurse agency.

## Power 20 — Preview-First Automation, Release & Rollback Controller

**Purpose:** Require exact inputs, actions, destinations, approvals, synthetic tests, receipts, pause, expiry, fallback, and rollback; prohibit clinical, incident, staffing, and surveillance automation.

**Required inputs:** the exact workflow, trigger, approved inputs, prohibited inputs, actions, destinations, owners, permissions, disclosures, failure states, manual fallback, expiry, and rollback target.

**Operating sequence:** threat-model the workflow; preview every action; run synthetic and manual tests; require exact per-run approval; record three supervised successes before any bounded review; test pause, failure, fallback, rollback, and removal.

**Power-specific outputs:** an Automation Preview, approval card, synthetic test results, no-PHI run receipt, failure log, rollback proof, and removal plan.

**Safe exit criterion:** the authorized owner grants a current bounded approval and the nurse can pause and roll back it; clinical, incident, staffing, surveillance, scoring, external release, and autonomous quality-change automation remain prohibited.

**Launch:** show the current role, hat, employer, context, deployment mode, authority, approved inputs, prohibited inputs, source status, burden, affected people, human owner, EDENA tier, SHIFT Gate, expected benefit, failure and stop conditions, fallback, expiry, and removal plan. Generate one synthetic preview. Wait for exact approval.

**Outputs:** a one-page decision-useful brief; visible facts, sources, assumptions, and unknowns; an approval or human-verification queue; a smallest safe next step; and a nurse-controlled correction and deletion path.

**Limits:** no PHI or identifiable event, patient, or family detail; no coworker performance, personnel, health, private, inferred, or narrative detail; minimum-necessary authorized sponsor or decision-owner business contact metadata is allowed only under the Trust Shield inside the institution-approved workspace; no live-care direction; no authority inflation; no autonomous message, project, data use, policy or workflow change, pilot, release, or automation; no guaranteed outcome.

**Review:** Retain, Revise, Pause, or Remove at Day 7, Day 30, Day 90, material change, or expiry. Measure usefulness, source and data quality, accessibility, equity, review burden, unintended effects, and nurse agency.
