FairByDesign Operational Decision Tools

Governance Stopgate

Mark the controls you can evidence today. Critical items must have an evidence description to clear.

Gate 0 — Problem and ownership
Defined operational problem

Technology chosen before the problem is understood wastes money and hides the real issue.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Named business owner critical

Without accountable ownership no one can accept or stop the work.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Named system or process owner

Operational changes need an owner who can act on the system.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Measurable desired outcome critical

An unmeasurable goal cannot be evaluated or stopped.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Decision or action boundary

The allowed decision or action scope must be explicit.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Gate 1 — Data and evidence
Source inventory

Unknown data sources cannot be governed or traced.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Lawful and permitted access confirmed critical

Unauthorised data use is a legal and ethical failure.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Essential data available critical

If essential data does not exist the use case cannot function.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Provenance or source trace

Material decisions must be traceable to their source.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Retention and deletion rules

Data kept without rules creates privacy and security exposure.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Access model for sensitive data critical

Sensitive data with no access model is a critical exposure.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Gate 2 — Authority and security
Allowed and forbidden actions defined critical

Without an action boundary the system's authority is unbounded.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Least-privilege credential model critical

Unrestricted production credentials allow unbounded damage.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Secrets management critical

Secrets in client code or prompts are immediately compromised.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Logging for material actions critical

Material actions that are not logged cannot be reconstructed.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Containment mechanism critical

Without containment a failure cannot be stopped.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Vendor and external-model exposure assessed

External models may receive sensitive operational data.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Gate 3 — Human oversight and escalation
Accountable owner for oversight critical

Oversight without a named person is not oversight.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Defined review points and timing critical

'Human in the loop' is meaningless without timing and authority.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Escalation route

Exceptions need a defined path to a person who can act.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Override capability

Reviewers must be able to override an incorrect result.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Accessible review interface with evidence

Reviewers cannot challenge a result they cannot see the evidence for.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Gate 4 — Performance and business outcomes
Baseline critical

Without a baseline there is nothing to compare performance against.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Target

A target defines what success means.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Quality metric

Output volume is not a measure of quality.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Stop threshold critical

Without a stop threshold a failing system keeps running.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Comparison with current process

Performance must be comparable to the process it replaces.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Metric owner and frequency

Metrics without an owner and cadence are not maintained.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Gate 5 — Testing and validation
Functional and exception tests

Happy-path-only testing hides real failures.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Permission and unauthorized-action tests critical

Untested permissions allow unauthorised actions in production.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Injection and misuse tests

Instruction-injection and misuse are common failure modes.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Rollback and containment test critical

Containment that has never been tested may not work.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Gate 6 — Runtime evidence and incident response
Runtime action and I/O logging critical

Material actions that cannot be reconstructed cannot be governed.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Model, ruleset, and prompt versioning

Without versions, incidents cannot be attributed or reproduced.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Pause or kill mechanism critical

A system that cannot be paused cannot be made safe.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Incident owner and response critical

Incidents with no owner are not resolved.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Alerting and detection window

Failures that are not detected in time cause compounding harm.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Gate 7 — Deployment decision
Approved scope matches tested scope critical

Deploying beyond the tested scope ships untested risk.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Pilot duration and review date

A pilot with no expiry becomes an ungoverned production system.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Named approver critical

A deployment with no approver has no accountability.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Success and stop thresholds for the pilot

A pilot needs pre-agreed success and stop thresholds.

Selecting “Verified” only takes effect with a full evidence set below — a selection alone is never treated as verified.

Cancel