ai · security · skills
MaturitySkillsDemo
Tools

Illustrative · for the non-technical adopter

Governance was present. Comprehension was missing.

Your policy library is complete — a clause exists for nearly every AI question an employee has. But nobody can find or parse it at the moment of need, so people guess. The control was written; it just never reached the person about to paste customer data into a chatbot.

Employee, mid-task“Am I allowed to do this?”CSA clause · dense, unfindable…so they guessthe risk you didn’t seeA policy nobody can read at the moment of need is a policy that isn’t working — comprehension is the missing control.

The governance exists. The gap is between the clause and the person who needed it.

The tension

You can’t train every employee to read a framework. And you can’t answer every question personally. So the policy sits unread, and the guessing continues.

“Can I get a trustworthy answer from OUR policy, the moment I need it, without calling anyone?”

The answer

Answer only from the governing clause, or abstain.

Ask in plain language, in your own language. The explainer retrieves the one clause that governs the question and composes the answer from it alone — cited by framework, version, and id. If the corpus is silent, it says so and routes you to the owner. It never guesses.

Your questionplain languageGoverning clausein the corpus?FOUNDAnswer + citationframework · version · clause idAbstain → route to the ownerSILENTNo blending across versions or frameworks —and never an invented answer.

Composed only from the governing clause. Silence is answered with an honest “I don’t hold that,” not a guess.

One everyday question · eight languages

Can I use real customer data to test our new AI feature?

A question every development team hits, answered with its clause. Pick a language, read it, listen to it.

Plain-language answer

Not by default. Before real customer data can be used in a test or development environment, the data owner must authorize it and the risk must be managed first — anonymize or pseudonymize the data, and copy only what the test actually needs.

Conditions and exceptions

  • Authorization from the data owner must come before the data is used or replicated — not after.
  • Anonymize or pseudonymize the data to reduce the risk of exposing personal information.
  • Replicate only the minimum data the test needs.
  • The replication must comply with data-protection law such as GDPR (General Data Protection Regulation).
AI Controls Matrix (AICM) 1.1.0 · DSP-15ModeledReal fixed-corpus result, not independently reviewed.

The real question, the answer composed from the governing clause, and every condition it carries. Switch the language: same clause, same conditions, cited every time.

What it proves

The policy finally reaches the person who needed it.

Comprehension becomes a control you can operate: the same governing text, answered in the employee’s own words and language, cited every time — with an honest abstention where the policy is silent. Guessing stops being the default.

Why you can trust it

  • Answers only from the retrieved clause — no blending, no invention.
  • Abstains and routes to the owner when the corpus is silent.
  • Answers in 8 languages, always citing the source.

Ask it something

Point it at your own policy corpus. The demonstration here runs on the CSA control set — ask it a real question.

Ask a standard →

Illustrative — a worked demonstration on the CSA control corpus, not a measured deployment. Retrieval composes only from the governing clause; abstention is a feature, not a failure.