Scope before access
We identify the workflow, necessary systems, data categories and owners before requesting access. Access should be limited to what the agreed workflow requires.
Trust and transparency
Security and responsible automation
Last updated 18 October 2026. This page explains the approach in plain language.
Data minimisation
Automation should process only the data required for the task. Retention, logging and transfer decisions are defined according to operational and applicable contractual requirements.
Human accountability
Sensitive, regulated, consequential or low-confidence decisions should have explicit human review, approval or escalation points. AI output is not treated as automatically correct.
Testing and failure handling
Testing covers expected scenarios, ambiguous input, invalid data, integration failure and agreed edge cases. Production workflows should include logging, alerts and a recovery or manual fallback path.
Credentials and integrations
Where supported, integrations should use platform-approved authentication, least-privilege permissions and documented credential ownership. Feasibility and vendor controls are reviewed during discovery.
Project-specific requirements
Security and compliance needs differ by workflow, industry, jurisdiction and platform. Final controls and responsibilities are documented in the project scope; this page is not a certification or compliance guarantee.