Appearance
AI Principles
OrviQ uses AI extensively. It uses it for exactly one class of work.
The authority boundary
AI assists. AI suggests. AI extracts. AI summarises.
A human, through a governed workflow, decides.
No AI model determines compliance, effectiveness, satisfaction or a pass
Nothing in OrviQ permits an AI model to:
- Determine that a requirement is satisfied
- Determine that a control is effective
- Produce an indicator pass or fail
- Approve a mapping, an exception, an applicability decision or a policy
- Close a finding, an incident or an audit
- Set a risk rating or a recovery objective
- Submit anything to a regulator
Every one of those is a governed act performed by a person, or a deterministic computation performed by an engine.
Why the boundary is where it is
Two reasons, both practical.
Reproducibility. A compliance determination has to be recomputable. An assessor must be able to take the same evidence and the same rules and arrive at the same answer. A model that might phrase the question differently on a second run cannot provide that. This is why indicator evaluation is entirely deterministic.
Accountability. A governed decision carries somebody's name. When a supervisor asks why a control deviation was permitted, "the model classified it as low risk" is not an answer anyone can stand behind. Every approval in OrviQ has a person on it.
Where AI is deliberately absent
| Area | Why |
|---|---|
| Indicator evaluation | Pass and fail must be deterministic and reproducible |
| Control effectiveness derivation | Derived from indicator results by rule |
| Requirement satisfaction | Derived from evidence, coverage and effectiveness by rule |
| Evidence freshness | Deterministic date arithmetic |
| Coverage calculation | Counting against a declared denominator |
| Any approval | Governance requires an accountable person |
| Recovery objectives | Business decisions about acceptable harm |
| Regulatory reportability | A legal test |
| Loss figures | Financial facts, never inferred |
Enforcement, not convention
The boundary is structural, not a guideline.
Permission separation. The permission to generate is always separate from the permission to adopt.
| Generate | Adopt |
|---|---|
mapping.ai_propose | mapping.review |
expected_evidence.ai_suggest | expected_evidence.accept |
adequacy.run | adequacy.review |
inspection.ai_assist | inspection.canonicalize, inspection.signoff |
library.smart_extract | Publication of candidates |
Holding a generation permission without its adoption counterpart means you can produce a thousand suggestions and adopt none of them.
Entry status. AI-produced records always enter in a non-authoritative state — proposed, draft, candidate. There is no code path by which an AI pass writes an approved record.
Segregation of duties. The person who triggered the AI is still subject to maker-checker on the resulting record.
The language convention
The documentation and the interface use a consistent vocabulary, and the distinction is real rather than stylistic.
| AI language | Human and engine language |
|---|---|
| assists, suggests, proposes, extracts, drafts, summarises, recommends | determines, approves, decides, concludes, signs off, publishes |
If you find a place in the product or the documentation where AI is described as determining, deciding or approving something, it is an error worth reporting.
Provenance on everything
Every AI-produced artefact records the provider, the model, the prompt version, the confidence where available, and the output.
This is not decoration. Two years later, when someone asks how a mapping came to exist, the answer is a record. If a model version turns out to have produced poor output, every artefact it produced can be identified.
See Provenance.
Tenant boundaries
AI processing operates within your tenant's data boundary. Tenant data is not used to train models, and no cross-tenant data is visible to any AI operation.
See Tenant Data Boundaries and AI Provider Security.
Entitlement
Most AI capabilities require the ai_risk_intelligence entitlement and the ai.use permission. Some modules gate their AI on their own entitlement — inspection, incident and BCM assistance, for example.
With AI entitlements off, every governed workflow in OrviQ continues to work. AI accelerates work; it is never a dependency for governance.