Appendix A: Code Examples: Delegation, Mandate, Specification and Ownership Records
This appendix holds the complete versions of the artefacts that Chapters 1 to 33 show in part or in full. Each artefact keeps the field names, identifiers, names, dates and decision records of the chapter that owns it, so that the appendix and the chapter can be read side by side. Where a chapter shows an artefact as an excerpt, the appendix gives the file as the chapter wrote it; where two chapters touch the same artefact, the chapter that owns it governs and the other is noted. Three listings are rendered by this appendix from the prose and tables of the owning chapters, because the chapters describe them without printing the file (DLG-HM-DEV-01, AVR-HM-2030-01 and the check in A.19); each is marked as rendered. The fictional organisations Nordvik Region and Hansa Mutual are described in the book's example profiles; every person, record and figure here is illustrative. Every YAML block parses and is meant to live in version control beside the AI Decision Record that approved it (AIDR-1100 to AIDR-1199). The Python block in A.19 is a small check and not part of the build. No artefact is attack tooling, and no artefact holds data about a named member of staff beyond what its purpose line allows.
Each section states which chapter introduces the artefact, what it is for and what it must never contain. Legal references in the artefacts are organisational and architectural implications, not legal advice.
How to use this appendix
- Start from the work class, not from the file. Take the ten classes of development work (specify, design, generate, refactor, test, review, deploy, operate, document, migrate) and write the delegation profile (A.1) first. Every other artefact either serves that profile or is checked against it.
- Name the steward before the ceiling. A record that has no named owner who passes Name, Understand and Revert is not finished, whatever level it states. The five Level 4 prohibitions of Chapter 4 appear in every artefact that sets a ceiling and are never overridden by a local rule.
- Keep the oracle outside the generator. A verification plan, change record or run record that does not name who wrote the oracle, and that it was not the tool that produced the change, proves nothing (A.5 to A.8, A.12).
- Date the evidence. Each claim carries a method, a date and an expiry. A usage claim older than 90 days and a value claim older than 180 days are treated as asserted until they are measured again (A.9).
- Lower at once, raise by decision. Lowering a level is immediate; raising it is a decision of the named owner, with evidence and an AIDR. A mandate, a team agreement or a practice may lower a ceiling and never raise it.
- Check mechanically what can be checked. A.19 shows a short script that rejects a profile or mandate that breaks the Level 4 rule. It does not replace the reading by the named person.
- Adapt, do not copy. The values (hours, limits, thresholds, dates) are those of the book's worked cases. An organisation sets its own on its own evidence.
Identifier families
| Family | Artefact | Owning chapter | Appendix section |
|---|---|---|---|
DLG-* |
Delegation profile (DLG-NR-DEV-01, DLG-HM-DEV-01), usage profile |
4 (also 1, 7) | A.1 |
MND-* |
Mandate manifest (MND-NR-DEV-*, MND-HM-DEV-*) |
8 | A.2 |
SPC-* |
Specification record | 5 | A.3 |
OWN-* |
Code-ownership record, register entry and promotion criteria | 12, 19 | A.4 |
VER-* |
Verification plan with the independent oracle; role boundary matrix | 9, 17 | A.5 |
RVW-* |
Review record | 9 | A.6 |
RUN-* |
Agent run record | 8 | A.7 |
PRV-* |
Provenance record; toolchain section of the mandate | 10 | A.8 |
AVR-* |
Adoption and value record, with evidence age | 20 | A.9 |
APR-* |
Apprenticeship plan | 13 | A.10 |
CMP-* |
Competence record and developer practice plan | 27, 28 | A.11 |
CHG-* |
Change record (from AI Operations) | 11 | A.12 |
ADR-*, RULES-* |
Architecture Decision Record and the conformance rules derived from it | 6 | A.13 |
| Platform records | Golden path, error-budget policy, PIR-* fields for AI-involved change |
16, 23 | A.14 |
ROLE-* and team agreements |
Role charter, practice inventory, work-and-load map, team working agreement, team practice agreement | 2, 3, 14, 15, 21 | A.15 |
KBV-*, MBA-* |
Works agreement outline (Hansa Mutual), negotiation record (Nordvik Region), telemetry description | 22 | A.16 |
DRR-*, LIC-*, EXIT-* |
Duty register, pipeline rule, values mapping, licence policy, dependency and exit record, criteria sheet | 18, 24, 25, 26 | A.17 |
HZN-* and plans |
Horizon register, anti-pattern check, year read-out, twelve-month plan, thesis scorecard | 29 to 33 | A.18 |
AIDR-1100 to AIDR-1199 |
AI Decision Record (Nordvik Region 1100 to 1149, Hansa Mutual 1150 to 1199) | all chapters | referenced throughout |
Records of the earlier volumes that these artefacts refer to (SVC-*, INC-*, RST-*, EXIT-*, AIDR-0027) are defined in those volumes and are not repeated here.
A.1 Delegation profiles and usage profiles
Introduced in Chapter 4, with a one-team view in Chapter 1. A delegation profile fixes, per class of development work, the ceiling of delegation, who approves, the stewardship tests, the independent oracle and the Level 4 prohibitions. The ceiling is not a licence: a usage profile, mandate or team agreement says what a given tool does under it and may only lower it. Nordvik Region's DLG-NR-DEV-01 (AIDR-1101) caps generate, refactor and test at Level 1 Assisted and document at Level 2 Supervised. Hansa Mutual's DLG-HM-DEV-01 (AIDR-1153) allows Level 2 Supervised for generate outside the security-critical and payment paths and has one Level 3 Bounded class.
The artefact must never contain a ceiling for the people class other than "not delegated", a Level 4 for any of the five prohibited kinds of work, an AI comment counted as a human review, or tool telemetry on a named developer.
DLG-NR-DEV-01. The owning profile (Chapter 4), adopted 2030-09-23.
delegation_profile: DLG-NR-DEV-01
version: 1.0
status: adopted # lowering is immediate; raising is the CIO's decision
date: 2030-09-23
decision_record: AIDR-1101
owner: "Henrik Dahl, CIO"
accountable_for_use: "Gunilla Roos, head of Applications and Integration"
review_due: 2031-03-23
covers: [NR-DEV-001, ambient_ide_completion, enterprise_assistant_mode1]
classes:
specify: {ceiling: "Level 0 Advisory"}
design: {ceiling: "Level 0 Advisory"}
generate: {ceiling: "Level 1 Assisted", rule: "suggestions accepted line by line; no generated file committed unread"}
refactor: {ceiling: "Level 1 Assisted"}
test: {ceiling: "Level 1 Assisted", rule: "test drafts only; never the oracle for the same change"}
review: {ceiling: "Level 0 Advisory", rule: "no AI comment counts as the human review"}
deploy: {ceiling: "Level 0", rule: "the pipeline deploys; no tool acts on it"}
operate: {ceiling: "Level 0 Advisory"}
document: {ceiling: "Level 2 Supervised", rule: "drafted by the tool, checked by the author before merge"}
migrate: {ceiling: "Level 0 Advisory", rule: "reading and summarising legacy code for a developer only"}
people: {ceiling: "not delegated", rule: "no tool telemetry in rating, pay or access to work"}
anything_unlisted: undelegated
level_4: {used: false, forbidden: [production_without_unalterable_gate, security_critical_without_named_reviewer, own_mandate_gates_oracles, irreversible_production_data, named_person_decisions]}
stewardship:
name: "OWN-* record names a team and a lead for every repository"
understand: "owner explains the change with the tool switched off; sampled in review"
revert: {path: "platform team rolls back through the GitOps pipeline; owner may order it", outside_pipeline: "to be tested; Chapter 11"}
independent_oracle: "oracle for a generated change is written by a person other than the author, from SPC-* or the running system"
evidence:
claim: "assistant use by 12 developers saves about four hours a week"
method: "IDE telemetry for 12 developers; survey answered by 9"
date: 2030-04
result: "acceptance 31 per cent; delivery time not measured"
status: "usage figures expired; value claim lapses 2030-10" # claim record AVR-NR-2030-01; usage claims expire after 90 days, value claims after 180
raise_level: "decision by the CIO on proposal of the head of Applications and Integration, with evidence and an AIDR"
lower_level: immediate
DLG-HM-DEV-01. Rendered by this appendix. Chapter 4 describes the profile in prose, Chapters 10 and 11 give its ceilings in tables and Chapter 13 gives the review date of 2031-03-30.
# DLG-HM-DEV-01 (illustrative): rendered in the structure of DLG-NR-DEV-01 from Chapter 4 (values), Chapters 10 and 11 (tables) and Chapter 13 (review date)
delegation_profile: DLG-HM-DEV-01
version: 1.0
status: adopted # lowering is immediate; raising is a decision of the owner
date: 2030-09-30
decision_record: AIDR-1153
owner: "Rainer Lehmann, group CIO"
reviewer: "Dr. Annette Krämer, chief risk officer"
accountable_for_use: "Dr. Philipp Reinhardt, head of Group Application Development" # as named in MND-HM-DEV-01 and MND-HM-DEV-02
review_due: 2031-03-30
covers: [HM-DEV-001, HM-DEV-002, HM-DEV-003, MND-HM-DEV-01, MND-HM-DEV-02]
classes:
specify: {ceiling: "Level 1 Assisted"}
design: {ceiling: "Level 0 Advisory"}
generate:
ceiling: "Level 2 Supervised"
inside_security_critical_and_payment: "Level 1 Assisted"
refactor: {ceiling: "Level 2 Supervised"}
test: {ceiling: "Level 1 Assisted", rule: "drafts by HM-DEV-002; the oracle for a change is written by someone other than its author"}
review: {ceiling: "Level 1 Assisted", rule: "an AI comment is never one of the two required human approvals"}
deploy: {ceiling: "Level 0", rule: "the pipeline and the change process act; no tool acts on them"}
operate: {ceiling: "Level 0 Advisory"}
document: {ceiling: "Level 2 Supervised"}
migrate: {ceiling: "Level 0 Advisory"}
people: {ceiling: "not delegated"}
anything_unlisted: undelegated
bounded_classes:
patch_level_dependency_updates:
ceiling: "Level 3 Bounded"
mandate: MND-HM-DEV-01
approval: "human approval of the class, not of each update"
outside: [security-critical paths, payment paths]
level_4: {used: false, forbidden: [production_without_unalterable_gate, security_critical_without_named_reviewer, own_mandate_gates_oracles, irreversible_production_data, named_person_decisions]}
independent_oracle: "oracle for a change is written by someone other than its author and not by the generator that produced the change"
raise_level: "decision by the owner, with evidence and an AIDR"
lower_level: immediate
DLG-NR-DEV-01, view for one team. Chapter 1 shows the profile as a worked example of a one-page view for the integration and data team; Chapter 4 registers the profile and governs where the two differ.
# DLG-NR-DEV-01, view for one team (illustrative; Chapter 4 registers the profile)
profile: DLG-NR-DEV-01
team: integration and data team, Applications and Integration
tech_lead: Anders Falk # ROLE-NR-TCL-01
accountable_for_use: Gunilla Roos # head of Applications and Integration
owner: Henrik Dahl # CIO
reviewed: 2030-09-23
next_review: 2031-03-23
ceiling_is_not_a_licence: true
work_classes:
- {class: specify, level: "Level 0 Advisory", approved_by: product owner}
- {class: design, level: "Level 0 Advisory", approved_by: tech lead}
- {class: generate, level: "Level 1 Assisted", approved_by: author, rule: "no generated file is committed unread"}
- {class: refactor, level: "Level 1 Assisted", approved_by: author}
- {class: test, level: "Level 1 Assisted", approved_by: author, rule: "drafts only; never the oracle for the same change"}
- {class: review, level: "Level 0 Advisory", approved_by: colleague, rule: "an AI comment is not the human review"}
- {class: deploy, level: "Level 0 Advisory", approved_by: pipeline, rule: "no tool acts on the pipeline"}
- {class: operate, level: "Level 0 Advisory", approved_by: tech lead}
- {class: document, level: "Level 2 Supervised", approved_by: author, rule: "checked before merge"}
- {class: migrate, level: "Level 0 Advisory", approved_by: tech lead, rule: "reading and summarising legacy code only"}
people_decisions: not delegated # employment, pay, performance rating, access to work
level_4_prohibited: true
unowned_findings:
- "No log shows which lines came from ambient completion (Mode 0)"
- "Ownership file names a team; 31 per cent of the Region's repositories name a departed owner"
Usage profile for NR-DEV-001. Chapter 7. The usage profile narrows DLG-NR-DEV-01 for the Mode 2 pilot and never widens it.
# Usage profile for NR-DEV-001. Narrows DLG-NR-DEV-01; never widens it.
system: NR-DEV-001
usage_mode: 2 # embedded in the IDE; completion and chat; no repository-wide edits
model_hosting: self-hosted, open-weight, Region reserved capacity
delegation_profile: DLG-NR-DEV-01
decision_record: AIDR-1102 # pilot continued to 2030-12-31 only
accountable_for_use: Gunilla Roos
valid_from: 2030-10-07
review_due: 2030-12-15
ceilings: # copied from DLG-NR-DEV-01
generate: {level: 1, rule: "accepted line by line; no generated file committed unread"}
refactor: {level: 1}
test: {level: 1, rule: "drafts only; never the oracle for the same change"}
document: {level: 2, rule: "author checks before merge"}
advisory_only: [specify, design, review, operate, migrate]
no_tool_action: [deploy]
never_give_to_the_tool: [credentials, connection strings, special-category data, benefits-triage rules]
acceptance_for_changes_with_generated_code:
name: "CODEOWNERS names a current team; the pull request states which parts were generated"
understand: "the author explains the change without the tool; the reviewer reads before any AI comment"
oracle: "tests written or reviewed by someone other than the author and not drafted by the assistant"
revert: "rollback path stated in the pull request and tried in the test environment"
measurement:
quoted_claim: {text: "a third faster", source: AVR-NR-2030-01, status: asserted} # no delivery time measured
not_a_productivity_measure: [acceptance rate, suggestion count, survey hours saved]
outcomes: [lead time per work item, review time, defects after release in touched files, share reverted]
baseline: two preceding quarters
unit: team # never a named developer; terms under negotiation in MBA-NR-2030-03
evidence_age_limit_days: {usage: 90, value: 180}
stop_rule: "after 2030-12-31 only under a new decision record, and only if outcomes are measured and no worse than baseline"
Across the degrees of delegation
The ceilings of the two profiles for the ten classes, as Chapters 4, 10, 11 and 14 give them. A ceiling is the highest degree permitted. No class is at Level 4 in either profile, and the people class is not delegated in either.
| Work class | Nordvik Region (DLG-NR-DEV-01) |
Hansa Mutual (DLG-HM-DEV-01) |
|---|---|---|
| Specify | Level 0 Advisory | Level 1 Assisted |
| Design | Level 0 Advisory | Level 0 Advisory |
| Generate | Level 1 Assisted | Level 2 Supervised; Level 1 Assisted inside security-critical and payment paths |
| Refactor | Level 1 Assisted | Level 2 Supervised |
| Test | Level 1 Assisted (drafts; never the oracle for the same change) | Level 1 Assisted (drafts; oracle by someone other than the author) |
| Review | Level 0 Advisory (no AI comment is the human review) | Level 1 Assisted (an AI comment is never one of the two human approvals) |
| Deploy | Level 0 | Level 0 |
| Operate | Level 0 Advisory | Level 0 Advisory |
| Document | Level 2 Supervised | Level 2 Supervised |
| Migrate | Level 0 Advisory | Level 0 Advisory |
| Patch-level dependency updates | Not listed, so undelegated | Level 3 Bounded (MND-HM-DEV-01) |
| People decisions | Not delegated | Not delegated |
A.2 Mandate manifests
Introduced in Chapter 8, with the toolchain section in A.8. A mandate manifest (MND-*) states what one agent may do, with what, on what, for how long and at what cost, and who can stop it. It is subordinate to the delegation profile: it may lower a level for one agent and may never raise it. The run record that evidences one run is in A.7.
The artefact must never contain a right to merge, approve, write to protected branches, pipeline definitions, the mandate itself or an oracle path, a credential, or telemetry on a named developer.
MND-HM-DEV-02. Agent pilot of the claims core delivery team at Hansa Mutual (Mode 3), AIDR-1158, version 2.
mandate:
id: MND-HM-DEV-02
version: 2
effective: 2030-10-07
decision: AIDR-1158
subject: agentic work tool, claims core delivery team, Mode 3, self-hosted models in Frankfurt
owner: Stefan Brückner # tech lead, ROLE-HM-TCL-01
accountable: Dr. Philipp Reinhardt
stop_holders: [Stefan Brückner, Lukas Frey, Hansa Forge on-call]
review_due: 2031-01-07
identity:
issued_by: Hansa Forge identity service # outside the agent and the pipeline
scope: one run, one repository, expires with the run
started_by: a named developer (the requester)
delegation: # DLG-HM-DEV-01 is the ceiling; this mandate only lowers it
generate: {level: 2, outside: [security-critical, payment]}
refactor: {level: 2}
test: {level: 1, note: drafts only, never the oracle for the same change}
document: {level: 2}
review: {level: 0}
migrate: {level: 0}
deploy: none
may:
- read the repository and its history
- run build, unit tests and linters in the sandbox
- read from the package proxy
- push to one branch named agent/<ticket> and open one pull request
never:
- write to protected branches, CODEOWNERS, pipeline definitions or this mandate
- write to verification/oracle/** or to any security-critical or payment path
- read or write secrets, production data or the claims database
- approve or merge a pull request
- reach any host not on the proxy allow-list
budgets: {wall_minutes: 45, tool_calls: 200, files_changed: 25, cost_eur: 6}
notify_owner_when: [any package name is refused by the proxy]
halt_when: [a write to a forbidden path is attempted, a budget is exceeded]
record: RUN-HM-*, written by the sandbox host and not by the agent
telemetry: by team, minimum group size 5, never by named developer
MND-HM-DEV-01. The one Level 3 Bounded class, patch-level dependency updates, AIDR-1153.
mandate:
id: MND-HM-DEV-01
version: 1
effective: 2030-10-14
decision: AIDR-1153 # the class is approved within DLG-HM-DEV-01
class: patch-level dependency updates
level: 3
level_name: Bounded
owner: Lukas Frey
accountable: Dr. Philipp Reinhardt
conditions:
update_type: patch version only
list: approved-dependencies.yaml, changed only by two-person review
repositories: outside security-critical and payment paths, each with a living owner
required_checks: [build, unit suite, verification/oracle suite, licence and provenance diff, package proxy admission]
merge: pipeline merge rule owned by Hansa Forge; the agent identity holds no merge right
deploy: unchanged, the change process applies
window: not inside a freeze for a critical or important function
route_to_human_when: [new transitive dependency, change of publisher, licence change, any check fails]
suspend_class_when: [two merged updates reverted within 14 days, evidence older than 90 days]
stop_holders: [Hansa Forge on-call, any repository owner for their own repository]
Across the degrees of delegation
| Mandate | Mode | Levels it holds | What it never does |
|---|---|---|---|
MND-HM-DEV-02 |
Mode 3 | generate 2 (none in security-critical and payment paths), refactor 2, test 1, document 2, review 0, migrate 0, deploy none | Merge, approve, write secrets, production data or oracle paths |
MND-HM-DEV-01 |
Pipeline merge of one class | Level 3 Bounded for patch-level updates | Act outside the approved list, a freeze or a repository without a living owner |
MND-NR-DEV-01 |
Mode 3 | Drafting of infrastructure code and runbooks; Level 1 Assisted at the start (AIDR-1108), Level 2 Supervised from 2030-11-18 (AIDR-1116; see the reading note in A.14) | Apply change |
A.3 Specification records
Introduced in Chapter 5. A specification record (SPC-*) ties a need to numbered requirements, acceptance criteria and the evidence for both, and says what an assistant took part in. Its open questions, assumptions and dissent are part of the record, and the tests it lists are pending until a person has run them.
The artefact must never contain an acceptance criterion written by the tool that generates the change, a requirement without a source, or the full transcript of an assistant session where a works agreement forbids retaining it.
SPC-NR-2030-0001. Home-care application form, request for help; Nordvik Region.
id: SPC-NR-2030-0001
title: Home-care application form, request for help completing the form
status: approved
date: 2030-10-14
service: SVC-NR-002
owner: Hanna Wikström # product owner, e-services team
oracle_owner: Saga Edvardsson # quality engineer; owns the criteria
delegation_profile: DLG-NR-DEV-01
specify_level: Level 0 Advisory
need:
statement: >
Case handlers return a share of home-care applications to the
applicant because they are incomplete, and applicants who need
help to complete the form have no way to say so.
evidence:
- source: sample of 60 returned applications, July to September 2030
read_by: Hanna Wikström
- source: reasons recorded by the telephone service, same period
read_by: Gunilla Roos
baseline: not measured # take the return rate from the case system before build
requirements:
- id: R1
text: An applicant can state that they want help completing the form.
source: need.evidence
- id: R2
text: The telephone number is optional and is collected only when help is requested.
source: GDPR Article 25(2), data protection by default
- id: R3
text: The form meets EN 301 549 as used for Directive (EU) 2016/2102.
source: Directive (EU) 2016/2102 Articles 4 and 6
- id: R4
text: A request for help reaches the case handler with the application.
source: assumption # confirm with the case-platform team
acceptance_criteria:
- id: AC1
covers: R1
given: an applicant who opens the form
when: they select the help option
then: the application is marked as help requested and submitted
- id: AC2
covers: R2
given: an applicant who has not selected the help option
when: they submit the form
then: no telephone number is stored
- id: AC3
covers: R3
given: an applicant who uses only a keyboard and a screen reader
when: they complete and submit the form
then: all fields are reachable in order and the confirmation is announced
out_of_scope:
- changes to the decision rules for home care
- a call-back service
assumptions:
- R4 depends on the case-platform interface accepting a new flag
open_questions:
- question: Who may see the help flag in the case system?
owner: Gunilla Roos
ai_involvement:
- tool: approved conversational assistant (Mode 1)
use: proposed 11 questions on the first draft; none answered by the tool
reviewed_by: Hanna Wikström
dissent:
- source: case handler interview
note: The help flag may not reach the handler who works the case.
tests:
AC1: pending
AC2: pending
AC3: pending
review_due: 2031-04-14
A.4 Code-ownership records and the register of built tools
Introduced in Chapter 12, with the register entry and promotion criteria in Chapter 19. An ownership record (OWN-*) answers Name, Understand and Revert for one repository or system: the owner and deputy, the independent oracle, the revert path and when it was last tried, and when the record must be read again. The inventories OWN-NR-2030-00 and OWN-HM-2030-00 count repositories and services without a living owner; they are described in Chapters 4 and 12 and carry no file of their own in this book.
The artefact must never contain a team as the only owner, an owner who has not demonstrated that they can explain the code without the tool, or a revert path that has not been tried.
OWN-NR-2030-04. Portal register adapter, Nordvik Region (AIDR-1112). The vacant deputy is a finding, not an omission.
id: OWN-NR-2030-04
status: active
subject:
service: SVC-NR-002
repository: portal-register-adapter
scope: Adapter between the citizen portal and the gateway to the national population register
size: approx. 18,000 lines of TypeScript and Java
owner:
name: Anders Falk
role: ROLE-NR-TCL-01
team: integration and data team
since: 2030-10-14
deputy:
status: vacant
must_be_named_by: 2030-12-15
provenance:
generated_share: not measured
assistant_use: NR-DEV-001 pilot, completion and chat only
provenance_record: none yet
verification:
regression_pack: portal pack, maintained by Saga Edvardsson
oracle_independent_of_generator: true
last_full_run: 2030-10-09
decisions: [ADR-NR-0017]
revert:
method: redeploy previous tagged release through the GitOps pipeline
last_tested: 2030-10-09
result: passed
understand_test:
last_demonstrated: 2030-10-16
demonstrated_without_assistant: true
support:
expected_use_until: 2034-12-31
retirement_condition: replaced by the national register service
review:
next_due: 2031-10-14
triggers: [owner leaves, model change in NR-DEV-001, change of register interface]
decision_record: AIDR-1112
OWN-HM-2030-07. COBOL settlement module behind SVC-HM-004, Hansa Mutual (AIDR-1162).
id: OWN-HM-2030-07
status: active
subject:
service: SVC-HM-004
platform: SVC-HM-003
scope: COBOL settlement module with quarter-end batch peaks
language: COBOL and JCL
owner:
name: Ralf Hauser
role: ROLE-HM-DEV-01
since: 2030-10-21
deputy:
name: Ewelina Maj
role: ROLE-HM-QA-01
deputy_for: oracle and regression suite, not code changes
second_approver_rule: a second developer outside the author's pair for any settlement change
verification:
oracle: recorded production inputs and outputs and parallel run, maintained by Ewelina Maj
oracle_independent_of_generator: true
coverage_claim: settlement run of quarter-end 2030-09, scope full, result matches, date 2030-10-05
revert:
method: restore previous load module and rerun the batch from the checkpoint
last_tested: 2030-09-30
result: passed
knowledge:
recorded_conversations: 0
target: first three by 2030-12-31
legacy_explainer: HM-DEV-003, Level 0 Advisory, pilot
review:
next_due: 2031-04-21
triggers: [owner or deputy leaves, change to settlement rules, quarter-end]
decision_record: AIDR-1162
OWN-NR-2030-0101. Chapter 19. A register entry for a tool built in FormFlow by a case handler; registered, not promoted.
id: OWN-NR-2030-0101
title: Missing-documents tracker, benefits unit
registered: 2030-10-21
updated: 2030-10-24
status: tier-c-conditional # registered; not promoted
platform: FormFlow
environment: sandbox-benefits # no production environment granted
maker_role: case handler, benefits unit
accountable: unit head, benefits unit
owner: case handler, benefits unit # the maker; must pass Understand
deputy: second case handler, benefits unit
support:
platform: IT service desk
logic: integration and data team, business hours, on request
data:
classes: [personal data of applicants: case reference, document type]
special_category: false
decides_about_persons: false
ai_in_the_tool: none
assistants_used_to_build: [mode-1 enterprise assistant, classification internal]
tier: C
tier_reason: personal data of applicants
criteria:
name:
state: met
evidence: 2030-10-21 deputy drill passed
understand:
state: not-met
evidence: independent cases written 0 of 20 minimum
revert:
state: not-tested
data_and_access:
state: met
evidence: 2030-10-24 DPO screening, no impact assessment needed, anonymous access off
promotion_criteria: promotion_criteria.yaml@1.0
review_due: 2031-04-21
sunset: 2031-10-31
Promotion criteria. Chapter 19. The criteria for promoting a built tool from the sandbox, kept as data.
promotion_criteria:
version: "1.0"
applies_to: tier-c
name:
owner_and_deputy_named: true
deputy_drill_passed: true
understand:
one_page_data_flow_and_permissions: true
independent_test_cases:
minimum: 20
written_by: not-the-maker
evidence_age_max_days: 90
revert:
switch_off_tested: true
manual_fallback_tested: true
restore_test_age_max_days: 90
data_and_access:
data_classes_recorded: true
dpo_screening: required
dpia: required-if-screening-finds-high-risk # GDPR Article 35(1)
least_privilege_roles: true
anonymous_access: forbidden
support_and_sunset:
support_path_named: true
review_months: 6
sunset_date: required
promoted_by: platform-pipeline-identity # never the maker
criteria_changed_by: pull-request-to-platform-team
A.5 Verification plans and the role boundary matrix
Introduced in Chapters 9 and 17. A verification plan (VER-*) names the oracle, its owner and its sources, and records that the generator cannot edit it. The role boundary matrix of Chapter 17 assigns each activity of the loop to the person accountable and the degree an assistant may take. This is the corollary of the stewardship principle in files: independence between the side that generates and the side that proves.
The artefact must never contain an oracle owned by the author of the change or a mutation threshold that the author of the change may lower.
VER-HM-2030-0007. Deductible and cap calculation in the claims core, drafted with an agent under MND-HM-DEV-02.
verification_plan:
id: VER-HM-2030-0007
change: CHG-HM-2030-0412
service: SVC-HM-001
summary: Deductible and cap calculation for property claims, rule version 14
generator:
kind: agent
mandate: MND-HM-DEV-02
run_record: RUN-HM-2030-0188
delegation: DLG-HM-DEV-01 # generate: Level 2 Supervised outside payment path
security_or_payment_path: true # payout amounts: Level 1 Assisted, named reviewer required
spec: SPC-HM-2030-0031 # derived from the policy wording, version 2030-09
oracle:
owner: Ewelina Maj # test engineer, not the author of the change
sources:
- policy_wording_examples # 36 cases written by claims experts
- properties_from_wording # payout >= 0; payout <= sum_insured; monotonic in loss
- replay_last_quarter # differential check on 12,400 recorded claims
drafted_by_assistant: HM-DEV-002 # drafts only; oracle approved by the owner above
generator_can_edit: false
mutation:
scope: changed_lines
minimum_score: 0.80 # starting value set by the quality function; not a benchmark
may_lower: quality_function_only
static_analysis: platform_ruleset_v9
review:
approvals_required: 2 # human approvals; an AI comment never counts
reviewer_reads_first: [SPC-HM-2030-0031, VER-HM-2030-0007]
seeded_defect_sample: true
steward:
name: Stefan Brückner
revert: pipeline_rollback_and_feature_flag
revert_authority_outside_pipeline: Hansa Forge on-call lead
valid_until: 2031-01-31 # evidence expires with the rule version
VER-HM-2030-0004. Chapter 17. Payment instruction export in the claims core; the oracle is written from the archived settlement runs and from INC-HM-2029-0207.
verification_plan:
id: VER-HM-2030-0004
change: CHG-HM-2030-0418
service: SVC-HM-001 # claims core, payment instruction export
specification: SPC-HM-2030-0011
date: 2030-11-18
author_of_change: developer, claims core delivery team
generated_with: HM-DEV-001 # Mode 2, Level 1 Assisted
oracle:
owner: Ewelina Maj # ROLE-HM-QA-01
written_from:
- SPC-HM-2030-0011 acceptance criteria AC-1 to AC-6
- archived settlement runs of the last four quarter-ends
- INC-HM-2029-0207 (312 claims paid twice)
written_by_generator: false
same_person_as_author: false
properties:
- a claim identifier appears in at most one payment instruction per run
- instruction totals reconcile with the archived run totals
drafted_tests:
assistant: HM-DEV-002 # Level 1 Assisted, drafts only
read_by: Ewelina Maj
discarded_as_restating_code: 7
seeded_faults: {injected: 10, caught: 9, run_on: 2030-11-18}
exploratory_session: {minutes: 90, by: Ewelina Maj}
review: two human approvals; an AI review comment does not count as one
evidence_expires: 2031-02-16 # 90 days, or on change of model, module or SPC
release_hold: quality engineer may hold at the manual gate
Role boundary matrix, e-services team. Chapter 17. An annex to the role charters and the delegation profile; it has no identifier of its own.
role_boundary_matrix:
team: e-services team, Applications and Integration, Nordvik Region
service: SVC-NR-002 # citizen portal
delegation_profile: DLG-NR-DEV-01
role_charters: [ROLE-NR-DEV-01, ROLE-NR-DEV-02, ROLE-NR-QA-01]
version: "1.0"
adopted: 2030-10-21
accountable_for_matrix: Gunilla Roos
review_due: 2031-04-21
activities:
- {name: state the need and acceptance criteria, function: D1 Frame,
accountable: product owner Hanna Wikström,
prepares: [designer, quality engineer],
ai: "specify, Level 0 Advisory"}
- {name: build a prototype to learn, function: D1 Frame,
accountable: the author of the prototype (owner or designer),
ai: "generate, Level 1 Assisted; Mode 1 assistant",
conditions: [synthetic data only, label PROTOTYPE, never merged, learning written to SPC]}
- {name: build the production change, function: D3 Build,
accountable: developer named in OWN record,
ai: "generate, Level 1 Assisted; no generated file committed unread"}
- {name: write the oracle, function: D4 Prove,
accountable: quality engineer Saga Edvardsson,
ai: "test, Level 1 Assisted for drafts; never the oracle for the same change"}
- {name: review the code, function: D4 Prove,
accountable: a developer colleague,
ai: "review, Level 0 Advisory"}
- {name: check usability and accessibility on the running service, function: D4 Prove,
accountable: designer or accessibility specialist,
ai: "none beyond Level 0 Advisory"}
- {name: accept against criteria and dated evidence, function: D1 Frame,
accountable: product owner Hanna Wikström}
- {name: hold a release at the manual gate, function: D5 Steward,
accountable: quality engineer; release proceeds only by recorded decision of the head of Applications and Integration}
- {name: revert, function: D5 Steward,
accountable: developer named in OWN record, outside the pipeline}
fixed_points: [oracle independent of generator, prototype never promoted as code,
named steward, hold authority outside the pipeline]
level_4_used: none
Across the degrees of delegation
| Activity | Nordvik Region | Hansa Mutual | What keeps it independent |
|---|---|---|---|
| Test drafts | Level 1 Assisted | Level 1 Assisted (HM-DEV-002) |
Drafts are read and discarded when they restate the code; the oracle is another person's |
| Oracle | Not delegated to the generator | Not delegated to the generator | Owner named in VER-*; the generator cannot edit the oracle path |
| Review | Level 0 Advisory | Level 1 Assisted | Two human approvals at Hansa Mutual; an AI comment is a lead, not an approval |
A.6 Review records
Introduced in Chapter 9. A review record (RVW-*) is written at merge and states what actually happened: who read the change and for how long, whether they read before any AI comment, how many AI comments were useful, wrong or noise, what the checks found, and what the plan did not cover. An AI comment is never counted as an approval.
The artefact must never contain an AI comment counted as a human approval, a reviewer's performance score, or a claim of coverage without what was tested.
RVW-HM-2030-0412. The review record written at merge of the deductible and cap change verified by VER-HM-2030-0007.
review_record:
id: RVW-HM-2030-0412
verification_plan: VER-HM-2030-0007
merged: 2030-10-21
reviewers:
- { name: Dr. Marit Sommer, role: ROLE-HM-DEV-01, read_before_ai_comments: true, minutes: 55 }
- { name: Tomasz Kowal, role: ROLE-HM-DEV-01, read_before_ai_comments: true, minutes: 20 }
ai_review_comments: { posted: 9, judged_useful: 4, judged_wrong: 2, noise: 3 }
checks:
static_analysis: passed
properties: { run: 3, passed: 3, failing_case_found_and_fixed: 1 }
replay_last_quarter: { claims: 12400, differences: 17, explained: 17 }
mutation_score: { reached: 0.83, live_mutants_reviewed: 22, tests_added: 5 }
not_covered: [partial-loss claims with two deductibles, tracked as FND-HM-2030-0021]
human_explanation_without_tool: passed # steward restated the rule from the wording
outcome: merged
A.7 Agent run records
Introduced in Chapter 8. A run record (RUN-NR-*, RUN-HM-*) is the evidence of one agent run. It is written by the sandbox host and not by the agent, so that a reviewer can see what was done, an owner can reconstruct and revert it, and an incident reviewer can tell what took part.
The artefact must never contain the prompts where a works agreement forbids retaining them, a credential, or a requester who is also the approver.
RUN-NR-2030-0019. A run of the platform team's agentic tool under MND-NR-DEV-01 at Nordvik Region, whose manifest Chapter 8 describes in prose (AIDR-1108, raised to Level 2 by AIDR-1116).
run:
id: RUN-NR-2030-0019
mandate: MND-NR-DEV-01
mode: 3
level: 2 # mandate started at Level 1; AIDR-1116 (Chapter 16) raised drafting to Level 2 from 2030-11-18
started: 2030-11-18T09:12:00+01:00
ended: 2030-11-18T09:31:00+01:00
requester: Maja Lindqvist
task: PLT-2217, add a retention setting to the log-storage module of the Spring golden path, update the runbook text
base_commit: a41f9c2
model: open-weight coding model, self-hosted on the Region's reserved capacity (version as recorded by the host)
sandbox: ephemeral container, egress only to the package proxy, no secrets
actions:
files_read: 14
files_changed: [modules/log-storage/main.tf, modules/log-storage/variables.tf, runbooks/log-retention.md]
commands_run: 9
blocked: [fetch from an external module registry, denied by egress policy]
outside_task: [README.md edited, reverted by the reviewer]
checks:
oracle: golden-path policy tests, written by the platform team on 2030-09-02, path write-denied to the agent
result: pass
plan_shows_changes_outside_module: 0
review:
reviewer: Joakim Wester
minutes: 22
understand: explained in the pull request without the tool, one paragraph
owner: platform team, golden-path repository
revert: git revert of the merge commit; the pipeline applies only after approval
outcome: merged 2030-11-19, applied by the pipeline 2030-11-21
prompts_retained: false # pending MBA-NR-2030-03
A.8 Provenance records and toolchain controls
Introduced in Chapter 10. A provenance record (PRV-*) says where a change came from, what it depends on, which checks ran and who can revert it; a claim of origin rests on the gateway log, not on a commit tag. The toolchain section of the mandate manifest (A.2) fixes the identity, inputs, packages, secrets and stop path that make such a record possible.
The artefact must never contain a claim of human authorship that the record cannot support, a signing identity reachable from the agent or the developer, or an unpinned dependency.
Reading note. The provenance record belongs to the portal change CHG-HM-2030-0388 in the customer portal SVC-HM-005; the change record CHG-HM-2030-0412 is the deductible and cap change in the claims core SVC-HM-001 (A.5).
PRV-HM-2030-0014. A change opened by a coding agent under MND-HM-DEV-02 with one new dependency and one patch update.
provenance_record: PRV-HM-2030-0014
status: illustrative
subject:
service: SVC-HM-005
change_record: CHG-HM-2030-0388
pull_request: claims-portal#2187
origin:
contribution: agent_opened_pull_request
mandate: MND-HM-DEV-02
run_record: RUN-HM-2030-0231
model: {name: hansa-code-m, version: "2030-09", host: frankfurt, route: hansa-forge-gateway}
claim_basis: gateway_log # a commit tag alone would be "declared"
human_authored_share: not_asserted
dependencies:
- {name: statement-pdf-lib, version: "3.2.0", change: added, registry: hansa-forge-mirror,
proxy_decision: allowed_after_human_approval, licence: Apache-2.0, sha256: "<from-lockfile>"}
- {name: json-schema-check, version: "5.1.4", change: patch_update, registry: hansa-forge-mirror,
proxy_decision: allowed_class_approval, licence: MIT, age_days_at_merge: 9}
checks:
secret_scan: {result: pass, date: 2030-11-04}
static_analysis: {ruleset: group-baseline-2030-q4, result: pass, date: 2030-11-04}
dependency_and_licence_scan: {result: pass, date: 2030-11-04}
independent_oracle: {record: VER-HM-2030-0044, written_by: test_engineer_not_author_of_change}
review: {record: RVW-HM-2030-0388, human_approvals: 2, ai_comments_counted: 0}
build:
service: hansa-forge-build
commit: "<sha>"
slsa_build_level_target: "L2 (specification v1.0)"
provenance_signed_by: build_identity # not reachable from the agent or the developer
bill_of_materials: "sbom/SVC-HM-005-3.14.0.cdx.json"
people:
owner: OWN-HM-2030-0031
approvers: [claims_portal_tech_lead, test_engineer]
revert:
previous_artefact: "SVC-HM-005-3.13.2"
who_can_revert: [claims_portal_team, hansa_forge_release_owner]
Toolchain controls of MND-HM-DEV-02. A section added to the mandate manifest for identity, inputs, packages, secrets and the stop path.
mandate: MND-HM-DEV-02
section: toolchain_controls
identity:
agent_identity: separate_from_developer
credentials: {scope: task_and_repository, lifetime_minutes: 60, issued_by: hansa-forge, in_runtime: false}
forbidden_rights: [publish, sign, edit_workflow, edit_policy, edit_mandate, edit_test_oracle]
inputs:
labels: {team_written: trusted_as_data, supplier_written: untrusted, public_issue_or_web: untrusted}
untrusted_input_may_trigger: [read, propose] # never run, install or send
packages:
resolve_only_via: hansa-forge-mirror
direct_egress: deny
new_name: {human_approval: required, approver_role: tech_lead}
new_version_min_age_days: 7 # illustrative; tuned against patch velocity
on_unknown_name: {action: deny, notify: [mandate_owner, hansa_forge_platform]}
secrets:
gateway_filter: enabled
pre_commit_and_pipeline_scan: required
actions_needing_named_approval: [install_new_dependency, change_workflow, call_new_host, touch_credential]
stop_path:
holders: [mandate_owner, hansa_forge_release_owner, security_on_call]
mechanism: outside_pipeline
last_drill: 2030-10-14
next_drill_due: 2031-01-12
exercise: {rules_of_engagement: RoE-HM-2030-DEV-01, retest_due: 2031-01-31}
A.9 Adoption and value records
Introduced in Chapter 20. An adoption and value record (AVR-*) states what was claimed, on what basis, who owns the claim and who, independent of the sponsor, owns the evidence, and what its state is: usage claims expire after 90 days, value claims after 180 days, and either expires on a change of model, tool version or counting rule. A seat is an input and not an outcome.
The artefact must never contain a per-person figure, an acceptance rate presented as productivity, or a quoted value without its method and date.
AVR-NR-2030-01. The pilot of NR-DEV-001: "a third faster", 31 per cent acceptance, a survey of 9 of 12 and no measured delivery time.
record: AVR-NR-2030-01
revision: 2
as_of: 2030-09-16
use_case: ide-assistant-pilot NR-DEV-001
usage_mode: "Mode 2 Embedded workplace assistants"
work_classes: {generate: "Level 1 Assisted", test: "Level 1 Assisted"}
sponsor: Gunilla Roos # head of Applications and Integration
claim_owner: Anders Falk # tech lead, wrote the April 2030 note
evidence_owner: regional-controlling # independent of the sponsor
claim:
quoted_value: "a third faster"
quoted_date: 2030-04
basis:
acceptance_rate_pct: 31 # IDE telemetry, 12 developers
survey: "9 of 12 answered: about four hours saved a week"
delivery_time_measured: false
state:
usage: expired # older than the 90-day clock
value: asserted # never checked against primary data
plan:
design: task-level, AI allowed or not allowed by recorded coin flip
period: six two-week sprints, 2030-10 to 2030-12
outcomes: [change-lead-time, review-time, rework, defects-at-30-days]
pending: [defects-at-90-days] # read after the decision date
oracle: tests and review by someone other than the tool; reviewer not told the condition
resolves: "large effects only; interval to be stated"
per_person_reporting: false # agreed under MBA-NR-2030-03 before data collection
expiry: {usage_days: 90, value_days: 180, conditions: [model-change, tool-version-change, counting-rule-change]}
decision:
supports: AIDR-1102 # pilot continued to 2030-12-31 only
stop_rule: "no extension past 2030-12-31 without a filed, signed result and the negotiation under MBA-NR-2030-03"
AVR-HM-2030-01. Rendered by this appendix from Chapters 4 and 20: the 42 per cent from telemetry against 27 per cent in a sample of 40 merged pull requests.
# AVR-HM-2030-01 (illustrative): rendered in the structure of AVR-NR-2030-01 from Chapters 4 and 20
record: AVR-HM-2030-01
use_case: ide-assistant HM-DEV-001, claims product line
usage_mode: "Mode 2 Embedded workplace assistants"
licences: 340
claim_owner: Stefan Brückner # tech lead, claims core delivery team, Hamburg
reported_by: Rainer Lehmann # group CIO, to the executive board
evidence_owner: group controlling # independent of the CIO who owns DLG-HM-DEV-01 (Chapter 20)
claim:
quoted_value: "42 per cent of committed lines AI-assisted"
quoted_date: 2030-02
basis: "IDE assistant telemetry: accepted suggestions as a share of lines"
sample:
date: 2030-08
merged_pull_requests: 40
lines_traceable_to_accepted_suggestion_pct: 27
persistence_of_lines: not_measured
state:
quoted_42_per_cent: expired
sample_27_per_cent: verified_for_that_sample
persistence_and_value: not_measured
expiry: {usage_days: 90, value_days: 180} # conventions of Chapter 4, reused from AI Leader
per_person_reporting: false # team grain, minimum group size 5, under the annex KBV-IT-2024-DEV-01
Across the degrees of delegation
| Record | Work classes concerned | Highest level in use | State at the start of the year |
|---|---|---|---|
AVR-NR-2030-01 |
generate, test | Level 1 Assisted | Usage expired; value asserted |
AVR-HM-2030-01 |
generate | Level 2 Supervised outside security-critical and payment paths | Quoted figure expired; sample verified for that sample |
A.10 Apprenticeship plans
Introduced in Chapter 13. An apprenticeship plan (APR-*) builds the junior route on purpose: tool access starts below the team ceiling and rises with milestones, the milestones are things a person can show with the tool switched off, and the only evidence is what can be observed. Junior review is practice; the review that gates a merge is given by another developer.
The artefact must never contain tool telemetry on a named person, an acceptance rate, a ranking, or any use in appraisal, pay or ranking; it states its purpose and what it excludes.
APR-HM-2030-01. Aylin Demir, claims portal team, Hansa Mutual. The review of the plan falls on the same day as the review of DLG-HM-DEV-01.
# apprenticeship/plans/APR-HM-2030-01.yaml (illustrative)
id: APR-HM-2030-01
version: "1.0"
trainee: {name: Aylin Demir, role: ROLE-HM-DEV-02, team: claims portal team}
period: {from: 2030-09-02, to: 2030-11-29}
owner: Dr. Philipp Reinhardt # head of Group Application Development
mentor: {name: Jörg Albers, hours_per_week: 2} # senior developer, claims portal team
second_assessor: Ewelina Maj # test engineer, Polish service centre
delegation_profile: DLG-HM-DEV-01
tool_access: # lower than the team ceiling in the first quarter
- {weeks: "1-4", assistant: HM-DEV-001, completion: off, chat: "explanations only, after an attempt is logged"}
- {weeks: "5-8", assistant: HM-DEV-001, completion: on, chat: "after an attempt is logged"}
- {weeks: "9-13", assistant: HM-DEV-001, completion: on, agent_pull_requests: "read and review only"}
ai_off: {share: "1 day in 5", reason: "design choice, no study fixes the right share", review: 2030-11-29}
milestones:
- {id: M1, week: 4, does: "Explains the settlement-lookup module in writing and traces a known defect, assistants off", evidence: "written explanation, mentor notes"}
- {id: M2, week: 8, does: "Reviews five pull requests, two with defects seeded by the mentor, and states the reason for each comment", evidence: "review comments compared with mentor's"}
- {id: M3, week: 11, does: "Owns one small change with a verification plan whose oracle is reviewed by the second assessor", evidence: "OWN record, VER record"}
- {id: M4, week: 13, does: "Reverts her own change in the test environment, assistants off, within the agreed time", evidence: "revert log"}
review_rule: "Junior review is practice; a developer other than the junior gives the review that gates a merge."
evidence_excluded: [tool telemetry on a named person, acceptance rates]
use: "Development of the trainee only; not an input to appraisal, pay or ranking."
reviews: {plan: 2030-11-29, junior_intake: 2031-03-30}
competence_record: CMP-HM-2030-DEV-02
A.11 Competence records and practice plans
Introduced in Chapters 27 and 28. A competence record (CMP-*) carries a level per group of competence, the date of the evidence and its expiry, and takes the lower of the assisted and unaided figures. A developer practice plan protects time to work without the tool, names what is offloaded and what is kept by hand, and says who reads which evidence.
The artefact must never contain tool telemetry on a named person, a ranking, or any use in pay setting or a disciplinary process; each states its purposes and its readers.
CMP-NR-2030-DEV-01. A mid-level developer in the integration and data team, Nordvik Region (AIDR-1127). The role ROLE-NR-DEV-03 is introduced by this chapter.
# competence/records/CMP-NR-2030-DEV-01.yaml (illustrative)
competence_record:
id: CMP-NR-2030-DEV-01
person_ref: NR-EMP-31877
role: ROLE-NR-DEV-03 # mid-level developer, integration and data team
decision: AIDR-1127 # purposes and readers, 2030-12-09
delegation_profile: DLG-NR-DEV-01
assessed_on: 2031-01-28
assessors: [saga_edvardsson_quality_engineer, enterprise_architect]
purposes: [development_plan, input_to_ladder_step]
not_used_for: [ranking, pay_setting, disciplinary_process, tool_telemetry]
readers: [record_subject, mentor, tech_lead, head_of_applications_and_integration]
framework_baseline: {digcomp: "3.0 baseline for all staff", sfia_responsibility_level: 3}
groups: # the lower of assisted and unaided evidence governs
- {id: frame, level: practitioner, evidence_date: 2030-12-12, expires: 2031-12-12,
evidence: "ambiguous register-lookup ticket: 9 criteria and 4 questions written before any draft; 3 of 4 questions changed the scope"}
- {id: design, level: practitioner, evidence_date: 2030-12-16, expires: 2031-12-16,
evidence: "3 decision records sampled: options and reasons present in 3, dissent in 1"}
- {id: verify, level: foundation, evidence_date: 2031-01-14, expires: 2031-04-14,
evidence: "seeded change, 5 defects: 4 found unaided, 3 found with the assistant comment visible (it covered 2 of the 5)"}
- {id: delegate, level: practitioner, evidence_date: 2031-01-21, expires: 2032-01-21,
evidence: "explained without the profile why test is Level 1 and who holds the stop; could not say what evidence would move generate"}
- {id: steward, level: practitioner, evidence_date: 2031-01-21, expires: 2031-07-20,
evidence: "reverted her own change in the test environment in 22 minutes against 30 agreed; unaided explanation of the gateway module: 1 gap"}
- {id: ai_literacy, level: practitioner, evidence_date: 2031-01-28, expires: 2031-07-27,
evidence: "stated what NR-DEV-001 was measured on (31 per cent acceptance, survey of 9 of 12, no delivery time) and 2 failure classes"}
findings:
- "Strong framing; the questions she asks change scope."
- "Verification is the weakest group on the lower of the two figures: the assistant's comment anchored her on 2 of 5 defects."
subject_comment: "Agrees. Asks for time on real reviews, not another course."
development_plan:
- {group: verify, target: practitioner, by: 2031-04-14,
means: "monthly seeded change; first judgement written before the assistant comment on 1 review in 5; mentor reviews 2 per month"}
- {group: steward, target: advanced, by: 2031-09-30,
means: "named deputy owner of the register gateway repository (OWN record); one quarter on the case platform support rotation, shadowed"}
protected_time: {hours_per_week: 3, from: 2031-02-03, owner: gunilla_roos}
CMP-NR-2030-DEV-P01. Practice plan for a senior developer, Nordvik Region (AIDR-1137, interim).
# competence/practice-plans/CMP-NR-2030-DEV-P01.yaml (Nordvik Region, illustrative)
id: CMP-NR-2030-DEV-P01
kind: developer-practice-plan
version: "1.0"
holder: {name: Linnea Sjöberg, role: ROLE-NR-DEV-01, team: case platform team}
scheme: {decision: AIDR-1137, adopted: 2030-10-28, status: interim, pending: MBA-NR-2030-03}
period: {from: 2030-11-04, to: 2031-01-31}
offloaded_now: [boilerplate, first drafts of unit tests, lookups of framework syntax]
kept_by_hand: [debugging an unfamiliar failure, explaining why a module is as it is, writing the oracle, reverting]
ai_off:
block: {hours_per_week: 3, assistants_off: [NR-DEV-001 completion, NR-DEV-001 chat, enterprise assistant]}
work: "trace one defect a fortnight in the customised case system and write the explanation"
reason: "design choice; no study fixes the share; reviewed at the end of the period"
stop_rule: "production incident or the holder's own call; no explanation required"
code_reading:
hours_per_week: 2
material: "one merged change a week, written with the assistant, read before any assistant comment"
first_judgement_written: true
kata: {interval_days: 14, minutes: 60, mode: pair, with: Emil Nordgren, kind: "write the test from the specification first"}
partner:
name: Maja Lindqvist # platform team lead, outside the team
meets_every_days: 28
reads: [ai_off_log, reading_notes, unaided_work_sample]
does_not_read: [acceptance_rates, prompt_logs, appraisal_data, tool_telemetry]
verification:
unaided_work_sample: {due: 2031-01-24, content: "explain the decision module and revert a change in the test environment, assistants off"}
informed: [Tomas Ekblad] # IT representative of the union
use: "development of the holder only; not an input to appraisal, pay or ranking"
evidence_expires: 2031-05-01 # 90 days after the end of the period
review_by: 2031-01-31
CMP-HM-2030-DEV-P01. Practice plan for a senior developer, Hansa Mutual (AIDR-1187, interim).
# competence/practice-plans/CMP-HM-2030-DEV-P01.yaml (Hansa Mutual, illustrative)
id: CMP-HM-2030-DEV-P01
kind: developer-practice-plan
version: "1.0"
holder: {name: Jörg Albers, role: ROLE-HM-DEV-01, team: claims portal team}
scheme: {decision: AIDR-1187, adopted: 2030-11-11, status: interim, pending: KBV-IT-2024-DEV-01}
period: {from: 2030-11-11, to: 2031-02-07}
kept_by_hand: [debugging an unfamiliar failure, writing the oracle, reverting, reading agent pull requests]
ai_off: {block: {hours_per_week: 4, assistants_off: [HM-DEV-001, Hansa Forge agents]}, work: "own the build of one small component end to end", stop_rule: "incident or own call"}
agent_pull_requests: {read_per_week: 3, first_judgement_written_before_agent_summary: true, seeded_error_review: "one a month, seeded by a colleague outside the team"}
kata: {interval_days: 7, minutes: 45, mode: group, with: "claims portal and Polish service centre developers"}
partner: {name: Ewelina Maj, role: test engineer, reads: [ai_off_log, reading_notes, unaided_work_sample], does_not_read: [acceptance_rates, prompt_logs, tool_telemetry]}
verification: {unaided_work_sample: {due: 2031-01-31, content: "revert one of his own changes in the test environment, assistants off"}}
informed: [Betriebsrat Hamburg]
use: "development of the holder only; not an input to appraisal, pay or ranking"
evidence_expires: 2031-05-08
Reading note. The practice-plan scheme of Chapter 28 is recorded in AIDR-1137 (Nordvik Region) and AIDR-1187 (Hansa Mutual); the interview practice of Chapter 27 has its own records.
A.12 Change records
Introduced in Chapter 11. A change record (CHG-*, from AI Operations) is the hand-over from developer to operator. This book adds the origin of the change, a gate defined where the change cannot edit it, an oracle owned outside the change, the approvals (an AI review never counts), the rollout rings and a revert with a rehearsal and its evidence age.
The artefact must never contain a gate that the change can edit, a revert path that has not been rehearsed within its evidence age, or a change at Level 4 on a security-critical path, a gate, a mandate or an oracle.
CHG-NR-2030-0212. Timeout and circuit breaker in the register gateway client; Nordvik Region, AIDR-1111.
id: CHG-NR-2030-0212
title: Timeout and circuit breaker in the register gateway client used by the citizen portal
service: SVC-NR-002 # affected service; component register-gateway-client
class: normal # normal | standard | emergency
window: 2030-11-07T10:00+01:00 # weekly portal release
owner:
team: integration and data team
named: Anders Falk # ROLE-NR-TCL-01; passes Name, Understand, Revert
ownership_record: OWN-NR-2030-04 # repository entry, active owner
origin:
submitter_role: developer, integration and data team
assistant: NR-DEV-001 # Mode 2 pilot, completion and chat only
delegation: DLG-NR-DEV-01 # generate Level 1 Assisted, deploy Level 0
lines_from_assistant: 38 # of 61 changed, accepted line by line
gate:
definition: region-policy # separate repository
owners: [platform lead, CISO office]
editable_by_change: false
paths_routed_to_platform_review: [pipeline/, policy/]
required_checks:
- policy-evaluation
- diff-within-declared-scope
- benefits-workflow-regression
- portal-journey-synthetic
oracle:
plan: VER-NR-2030-0011
owner: quality function (Saga Edvardsson)
written_by_assistant: false
seeded_fault: {date: 2030-11-04, caught: true}
approvals:
human_review: [integration and data team colleague, not the submitter]
ai_review_counts_as_review: false
rollout:
rings: [{name: canary, share: 0.05, bake_minutes: 30}, {name: half, share: 0.5, bake_minutes: 30}, {name: all, share: 1.0}]
promote_if: {error_rate_max: 0.01, p95_latency_ms_max: 800, synthetic_journeys: pass}
revert:
method: re-pin previous release through the pipeline
stop_path: duty engineer re-pins through the break-glass role, outside the pipeline
data_change: none
rehearsal: {date: 2030-11-04, environment: staging, minutes_to_restore: 9, target_minutes: 15}
evidence_age_days: 3
level_4_check:
security_critical_path: false
changes_gate_mandate_or_oracle: false
irreversible_production_data_action: false
records: {aidr: AIDR-1111, run_record: RUN-NR-2030-0031}
CHG-HM-2030-0415. A patch-level update merged by the pipeline under the class approval; Hansa Mutual, AIDR-1161.
id: CHG-HM-2030-0415
title: Patch-level update of a logging library in the customer portal and broker interface
service: SVC-HM-005
class: standard # class approval, not per-update approval
mandate: MND-HM-DEV-01 # Level 3 Bounded, patch-level dependency updates
class_approval: {approved_by: Rainer Lehmann, record: AIDR-1153, valid_until: 2031-03-30}
security_critical_path: false
update:
package: logging-core # illustrative name, on the approved list
from: 4.12.3
to: 4.12.4
semver_level: patch
gate:
definition: hansa-forge-policy # owned by Hansa Forge, not by the repository
editable_by_agent: false
checks: [approved-list, provenance-and-signature, unit-and-integration, consumer-contract-tests, canary-slo]
oracle_independent_of_agent: true
package_proxy_refusals: 0
revert:
automatic_on: canary SLO breach in ring 1
stop_path: platform engineer on call, outside the pipeline
rehearsal_age_days: 41
records: {aidr: AIDR-1161, owner_of_record: claims portal team, ownership_record: OWN-HM-2030-0031}
Across the degrees of delegation
| Change | Origin | Level of the work | Who holds the stop |
|---|---|---|---|
CHG-NR-2030-0212 |
Developer with NR-DEV-001 (38 of 61 changed lines from the assistant) |
generate Level 1 Assisted; deploy Level 0 | Duty engineer, through the break-glass role, outside the pipeline |
CHG-HM-2030-0415 |
Agent identity under MND-HM-DEV-01; the pipeline merges |
Level 3 Bounded, patch-level class | Platform engineer on call, outside the pipeline |
A.13 Design records and conformance rules
Introduced in Chapter 6. An Architecture Decision Record names the options, who contributed each (a person or the tool), the dissent and what is one-way. Each ADR that sets a boundary derives rules that a machine can check, owned by someone who is not the generator.
The artefact must never contain an option attributed to the tool that the decider did not read, or a rule owned by the generator of the change.
ADR-NR-0031. Case status for applicants served by a status interface behind the gateway (AIDR-1106).
adr: ADR-NR-0031
title: Case status for applicants is served by a status interface behind the gateway
status: accepted
date: 2030-10-21
decider: {name: Anders Falk, role: ROLE-NR-TCL-01}
context: >
The portal SVC-NR-002 will show applicants the status of a benefits case held in
SVC-NR-003. Quality attributes: no coupling of the portal to the case schema,
a stable public vocabulary, no new access to special-category data.
options:
- {id: A, text: Portal reads the case status table directly, source: decider, rejected: couples to schema}
- {id: B, text: Status interface behind the gateway with a mapping, source: decider-and-assistant, chosen: true}
- {id: C, text: Call the vendor interface, source: decider-and-assistant, rejected: ties to vendor support ending 2033}
- {id: D, text: Publish from the audit table to a status store, source: Linnea Sjöberg, deferred: source unproven}
ai_involvement:
tool: NR-DEV-001
usage_mode: Mode 2
hosting: self-hosted, Region reserved capacity
contributed: objection to A (schema coupling) and the wording of option C
not_contributed: option D, the vendor-lifetime argument, the vocabulary
input_excluded: credentials, case data, benefits-triage rules
transcript: summary only, full transcript not retained, retention question open (AIDR-1106)
dissent:
- {by: Linnea Sjöberg, point: transitions are undocumented stored procedures, answer: mapping validated on closed cases before release}
reversibility: {interface: two-way, public_vocabulary: one-way, revert_by: integration-and-data-team}
consulted: [enterprise-architect]
rules: RULES-NR-PORTAL-01
review_date: 2031-04-15
decision_record: AIDR-1106
RULES-NR-PORTAL-01. Conformance rules derived from ADR-NR-0031.
# Conformance rules derived from ADR-NR-0031 (illustrative). Owned by the
# platform team; a change to this file needs review by that team.
rule_set: RULES-NR-PORTAL-01
derived_from: ADR-NR-0031
owner_team: platform-team
changed_only_by_review_of: platform-team
rules:
- id: R1
statement: Portal services do not import the case system schema or read its tables.
check: dependency-scan
on_violation: fail-build
- id: R2
statement: Public status values are produced only by the status mapping and are validated against the status vocabulary.
check: contract-test
on_violation: fail-build
- id: R3
statement: The status API returns no field that the vocabulary does not define.
check: schema-diff
on_violation: fail-build
exemptions:
mechanism: expiring record, approved by owner_team, maximum 90 days
review_date: 2031-04-15
A.14 Platform, release and incident records
Introduced in Chapters 16 and 23. The golden path and the error-budget rule are the platform's side of the stewardship principle: the gate definitions sit where no agent can write, and the budget lowers the level of AI-originated change when a service is spent. The fields of Chapter 23 extend the post-incident review (PIR-*) for a change in which AI may have taken part.
The artefact must never contain a gate editable by an agent, a per-developer gateway record, or an individual named as the cause of an incident.
Reading note. The platform team's drafting of infrastructure code started at Level 1 Assisted in MND-NR-DEV-01 (AIDR-1108) and was raised to Level 2 Supervised by AIDR-1116 on 2030-11-18 (Chapter 16); RUN-NR-2030-0019 records the run at Level 2. Chapter 32 makes the entry of the raise in the mandate a step of the first quarter.
Golden path nr-spring-service. The platform's golden path with the gate definitions, the AI tooling register and the error-budget rule (AIDR-1116).
golden_path:
name: nr-spring-service
version: "2.0"
adopted: 2030-11-18
decision: AIDR-1116
owner: platform-team # lead: Maja Lindqvist
accountable_for_use: Gunilla Roos
delegation_profile: DLG-NR-DEV-01
review_due: 2031-05-18
pipeline:
gate_definitions:
location: platform-owned configuration repository
code_owner: platform-lead
agent_write_access: false # no coding agent or assistant may change a gate
oracle:
owner: product-team # the platform provides the runner, not the oracle
generated_by_same_tool_as_change: not-allowed
ai_tooling:
register:
- id: NR-DEV-001
mode: "Mode 2"
model: self-hosted open-weight coding model on reserved capacity
route: ai-gateway
functions: [completion, chat]
repository_wide_edits: false
code_not_to_be_shared:
- special-category data
- credentials
- benefits-triage rules
unlisted_tools: not-used # shadow AI is reported to the platform lead, not to line management
gateway_record:
fields: [timestamp, team, repository, tool_id, model, token_count]
per_named_developer: false
prompt_content: not-recorded-until MBA-NR-2030-03 is concluded
supply_chain:
package_proxy: approved-registries-only
unknown_package_name: refuse-and-report-to-owning-team
exceptions:
approver: [platform-lead, head-of-applications-and-integration]
maximum_days: 90
at_expiry: ends-or-becomes-default
error_budget:
rule: "when the service budget is spent, AI-originated change in that service drops one level"
restored_by: service-owner
Error-budget policy, SVC-HM-005. When the budget is spent, AI-originated change in the service drops one level (AIDR-1166).
error_budget_policy:
service: SVC-HM-005
decision: AIDR-1166
recorded: 2031-01-20
owner: Rainer Lehmann # owner of DLG-HM-DEV-01
reliability_lead: Tobias Richter
platform_lead: Lukas Frey
objective: "availability, 28-day window; value set in the service level objective record"
when_budget_remaining: positive
when_budget_spent:
level_drop:
generate: "Level 2 Supervised to Level 1 Assisted"
refactor: "Level 2 Supervised to Level 1 Assisted"
suspended_classes:
- "patch-level dependency updates under MND-HM-DEV-01 (Level 3 Bounded to Level 2 Supervised)"
unchanged:
- "two human approvals for production change in critical or important functions"
restored_by: reliability_lead
restore_condition: "budget positive and two consecutive releases without revert"
record_to: Hansa Forge catalogue
review_due: 2031-04-20
PIR-NR-2030-0006. The review fields for AI-involved change; the review does not depend on bounding the AI involvement.
pir:
id: PIR-NR-2030-0006
incident: INC-NR-2030-0094
held: 2030-12-15
facilitator_role: quality-engineer-not-on-incident # Saga Edvardsson
independent_accounts_written_before_session: 5
change: CHG-NR-2030-0091
service: SVC-NR-002
ai_involvement:
value: unknown_partly # none | suggested | drafted | executed | unknown | unknown_partly
tools: [{id: NR-DEV-001, mode: 2}, {id: ambient-ide-completion, mode: 0}]
delegation_profile: DLG-NR-DEV-01 # generate Level 1 Assisted
mandate: none # no agent took part
evidence:
run_record: not_applicable
gateway_metadata: team, repository, tool, model, token count # AIDR-1116
prompts: not_recorded # MBA-NR-2030-03 not concluded
lines_from_suggestions: unknown
consequence: "involvement cannot be bounded; review does not depend on it"
oracle:
independent_of_generator: partly
gap: "R4 had no acceptance criterion; the case-platform flag was an assumption"
stewardship:
name: {passed: true, note: "OWN record names tech lead and deputy"}
understand: {passed: false, note: "owner could explain the form change, not the interface mapping"}
revert: {passed: true, decision_to_revert_minutes: 22, authority_outside_pipeline: platform-on-call}
mechanism_class: specification_gap
contributing_conditions:
- {id: C1, text: "R4 recorded as assumption in SPC-NR-2030-0001 and never confirmed", evidence: [SPC-NR-2030-0001]}
- {id: C2, text: "Regression pack covers the portal, not the case-platform interface", evidence: [regression-pack-v12]}
- {id: C3, text: "Interface ignores unknown flags without error", evidence: [interface-contract-3]}
people: "No individual named as cause; review content not used in appraisal"
classification: {by_role: head-applications-integration, major_or_significant: false}
decision_record: AIDR-1123
A.15 Role charters, work maps and team agreements
Introduced in Chapters 2, 3, 14, 15 and 21. A role charter (ROLE-*) is a versioned file with a mandate, accountabilities, decision rights and evidence. A work-and-load map shows where in a sprint a tool could take part, which is not the same as where it did or helped. A team agreement is the written form of the rules a team adopts; it may be stricter than the profile and never looser.
The artefact must never contain an AI-use target, an acceptance rate in appraisal, per-person telemetry or a hold that needs prior approval.
Reading note. Chapter 2 shows ROLE-NR-DEV-01 as a version 0.1 baseline, a pre-AI description of 2027 rewritten as a charter; Chapter 14 owns version 1.0.0 (AIDR-1114, effective 2031-02-01) and governs.
ROLE-NR-DEV-01, version 1.0.0. Senior developer, case platform; negotiated in MBA-NR-2030-03.
# roles/development/senior-developer-case-platform.yaml (Nordvik Region, illustrative)
id: ROLE-NR-DEV-01
title: Senior developer, case platform
version: 1.0.0
effective: 2031-02-01
adopted_by: AIDR-1114
owner: head-of-applications-and-integration
consulted: [union-it-representative, central-work-environment-committee, regional-legal-counsel]
negotiated_in: MBA-NR-2030-03
delegation_profile: DLG-NR-DEV-01
decision_rights:
decides_alone: [design-of-changes-within-team-boundaries, review-outcome-for-tier-1-and-2-changes]
needs_second_senior: [change-to-benefits-rules, database-migration, change-to-pipeline-gate]
goes_to_manager: [conflict-between-holds, change-to-review-budget]
review:
budget_share_of_working_time: 0.25 # recorded decision; changed only by AIDR
mentoring_share_of_working_time: 0.10
first_judgement_before_ai_comment: sampled_one_in_five
ai_review_comment_counts_as_approval: false
named_developer_review_required: [security-critical-path, benefits-rules, pipeline-gates, agent-mandate-change]
seeded_error_drill: quarterly
metrics: reported_by_team_only # never by named developer
professional_judgement:
hold: {prior_approval: not_required, record: reason_in_review_record, answered_within_working_days: 3}
explanation_without_tool: may_require
ownership: may_decline_if_cannot_understand_or_revert # recorded, read by manager
dissent: {record_to: ADR_or_review_record, answered_in_writing: true}
appraisal: {ai_use_targets: none, acceptance_rate_in_appraisal: prohibited}
unassisted_share_of_reviews: 0.10
limits: {holds_reviewed_by: peer-senior, security_policy_overridable: false}
delegation_ceilings: # from DLG-NR-DEV-01; a ceiling is not a licence
review: Level 0 Advisory
design: Level 0 Advisory
migrate: Level 0 Advisory
document: Level 2 Supervised
level_4: never_for_own_mandate_or_security_critical_path_without_named_review_or_named_person_decisions
review_cycle: {cadence_months: 6, triggers: [agent-introduced, pilot-extended, incident]}
ROLE-NR-DEV-01, baseline. Chapter 2. The baseline charter, version 0.1.
role_charter:
id: ROLE-NR-DEV-01
title: Senior developer, case platform team
version: "0.1"
organisation: Nordvik Region, Applications and Integration
accountable_to: Head of Applications and Integration
status: draft, illustrative
baseline: pre-AI description of 2027, rewritten as a charter
purpose: >
Keep the case platform correct, changeable and understood,
and answer for what is released from it.
accountabilities:
- Owns named parts of the case platform (see the ownership record)
- Reviews changes to those parts and names who may approve them
- Holds the authority to stop a release of those parts
decision_rights:
may_decide:
- Acceptance of a code change in owned parts
- Rollback of a release of owned parts
may_not_decide:
- Delegation of a development work class to a tool
(set by the delegation profile)
evidence:
- Ownership record entry for each owned repository
- Review records for changes to owned parts
review_due: "2031-03-23"
Practice inventory. Chapter 2. What the team does, which scarcity each practice answered and whether it is evidenced.
practice_inventory:
team: Case platform team, Nordvik Region
taken: "2030-10-14"
review_due: "2031-04-14"
practices:
- name: Two-week sprints with demo
lineage: agile
scarcity_answered: feedback
status: in force, evidenced by demo notes
function: D1 Frame
- name: One colleague reviews each pull request
lineage: agile, structured programming
scarcity_answered: ability to read and reason about code
status: in force, not evidenced beyond the platform's merge log
function: D4 Prove
note: no rule on who reviews generated code
- name: Pager for the case platform
lineage: DevOps
scarcity_answered: production feedback
status: in force, owner of the rota is the platform team, not the case team
function: D5 Steward
- name: CODEOWNERS file per repository
lineage: agile, DevOps
scarcity_answered: ownership
status: lapsed for 31 per cent of repositories
function: D5 Steward
Work-and-load map. Chapter 3. One senior developer across one sprint; an estimate by the holder, kept for the holder's own work.
work_and_load_map:
holder: Linnea Sjöberg
role: ROLE-NR-DEV-01
team: case platform team
sprint: 2030-10-06 to 2030-10-17
basis: estimate by the holder from calendar and repository history
evidence_age_days: 0
delegation_profile: DLG-NR-DEV-01
hours_total: 80
activities:
- name: read and understand existing code
hours: 16
interrupted_hours: 5
work_class: migrate
delegation_level: Level 0 Advisory
tool_touchpoint: true
- name: write code and tests
hours: 14
interrupted_hours: 3
work_class: generate
delegation_level: Level 1 Assisted
tool_touchpoint: true
- name: review colleagues changes
hours: 8
interrupted_hours: 1
work_class: review
delegation_level: Level 0 Advisory
tool_touchpoint: false
- name: specify and clarify with product owner
hours: 6
interrupted_hours: 1
work_class: specify
delegation_level: Level 0 Advisory
tool_touchpoint: false
- name: release and deployment work
hours: 5
interrupted_hours: 1
work_class: deploy
delegation_level: Level 0 Advisory
tool_touchpoint: false
- name: documentation
hours: 3
interrupted_hours: 0
work_class: document
delegation_level: Level 2 Supervised
tool_touchpoint: true
- name: modernisation assessment preparation
hours: 6
interrupted_hours: 1
work_class: design
delegation_level: Level 0 Advisory
tool_touchpoint: false
- name: meetings and coordination
hours: 10
interrupted_hours: 0
work_class: none
tool_touchpoint: false
- name: support, incidents and consultant questions
hours: 8
interrupted_hours: 8
work_class: operate
delegation_level: Level 0 Advisory
tool_touchpoint: false
- name: learning and unplanned work
hours: 4
interrupted_hours: 2
work_class: none
tool_touchpoint: false
summary:
hours_with_touchpoint: 33
hours_without_touchpoint: 47
interrupted_hours: 22
note: touchpoint means an activity in which the profile lets a tool take part and the holder expected to use one; Level 0 Advisory elsewhere is available on request and is not counted; it does not mean that the tool was used or helped
Team working agreement, claims core delivery team. Chapter 15. Hansa Mutual, Hamburg; the team may narrow a ceiling and never raise it.
# teams/claims-core-hamburg/working-agreement.yaml (illustrative)
version: "1.0"
adopted: 2030-10-14
review_due: 2031-01-13
review_triggers: [provider_model_change, incident_with_ai_involved_change, new_tool, change_of_dlg]
tech_lead: ROLE-HM-TCL-01
engineering_manager: Jens Albers
ceilings_from: DLG-HM-DEV-01 # the team may narrow a ceiling, never raise it
scope:
repositories: [claims-core, claims-settlement-interface]
people: {employees: 7, external: 2}
owners: OWN-HM-* # each owner has a named deputy
work_classes:
generate: {ceiling: "Level 2 Supervised", lower_on: [payment, authentication], lower_ceiling: "Level 1 Assisted"}
refactor: {ceiling: "Level 2 Supervised"}
test: {ceiling: "Level 1 Assisted", oracle: "written or approved by someone other than the change author"}
review: {ceiling: "Level 1 Assisted"}
migrate: {ceiling: "Level 0 Advisory"}
review:
human_approvals_for_production: 2
ai_comment_counts_as_approval: false
reviewer_reads_diff_before_ai_summary: true
max_lines_per_review: 400 # team choice, revisited at review
protected_review_windows: ["Tue 10:00-12:00", "Thu 10:00-12:00"]
named_reviewer_required_on: [payment, authentication]
pull_request_states_ai_involvement: true
agents:
mandate: MND-HM-DEV-02
may_merge: false
protected_files: [working-agreement.yaml, CODEOWNERS, pipeline definition, agent instruction file, test oracles]
ceiling_on_protected_files: "Level 0 Advisory"
data:
claims_code_models: self-hosted-frankfurt-only
prompts_must_not_contain: [credentials, personal data]
metrics:
level: team # minimum group size 5; per-person views off
kept: [change_lead_time, change_fail_rate, rework_rate, review_wait, ownership_coverage]
usage_claims: {acceptance_rate: "usage only, expiry 90 days"}
never_used_in_appraisal: [acceptance_rate, ai_assisted_line_share, per_person_telemetry]
governed_by: KBV-IT-2024-DEV-01 # draft; this clause gives way when the annex is adopted
stop:
tech_lead_may_lower_ceiling: true # recorded in the log; raising goes to the owner of DLG-HM-DEV-01
Team practice agreement, e-services team. Chapter 21. Nordvik Region, AIDR-1121.
team_practice_agreement:
status: illustrative
version: 1.0.0
team: e-services team, Applications and Integration, Nordvik Region (7 people)
adopted: 2030-11-26
decision_record: AIDR-1121
governed_by: DLG-NR-DEV-01
functions: [D3 Build, D4 Prove]
rule: stricter-than-profile-only
working_with_assistants:
word_pairing_reserved_for: two people
intent_stated_before_generation: true
security_critical_changes: second human reviews the oracle as well as the code
review:
author_reads_full_diff_first: true
disclosure: assistant or agent named in the pull request; run record linked
ai_comment_counts_as_approval: false
reviewer_starts_from_own_judgement: true
may_return_as_too_large_to_review: true
protected_review_time_per_developer_per_sprint: 4 hours
seeded_errors: quarterly, announced in advance, catch rate reported for the team only
trust_ledger:
kept_by: team
grouped_by: [class of work, origin of change]
entry_expires_days: 180
feeds: AVR-NR-2030-01
speaking_up:
open_log: near misses, defects, doubts; one line, no names
read_at: every retrospective
stop_right: anyone may hold a merge or pause an agent run; no penalty
per_person_counts_to_any_leader: never
prompts_and_run_records: belong to the change; metadata only at the gateway until MBA-NR-2030-03 concludes
safe_to_ask:
question_to_a_person_always_acceptable: true
junior_questions: open channel, answers kept
learning_assessed_from: work samples and conversation, never tool logs
shadow_ai:
never_pasted: [credentials, special-category data, citizens' personal data, benefits-triage rules]
report_route: platform team, thanked and not disciplined
team_conversation_held: 2030-12-05
reviewed_with: Tomas Ekblad (union IT representative) on the clauses touching telemetry
review_due: 2031-06-02
Team practice agreement, claims core delivery team. Chapter 21. Hansa Mutual, AIDR-1171.
team_practice_agreement:
status: illustrative
version: 1.0.0
team: claims core delivery team, Hamburg (Group Application Development)
adopted: 2030-12-09
decision_record: AIDR-1171
governed_by: DLG-HM-DEV-01
numbers:
ai_assisted_share_is_a_target: false
shown_with_developer_name: never
figure_reported_upward_carries: [method, sample, date, evidence age]
review:
human_approvals_for_critical_functions: 2
ai_comment_counts_as_approval: false
oracle_for_a_change_written_by: someone other than the author of the change
speaking_up:
open_log_seeded_with: FND-HM-2030-0012 (three refused package names)
telemetry_reported_by_team_minimum_group_size: 5
acceptance_rate_in_appraisal_or_pay: never
works_agreements: [interim agreement of the local Betriebsrat, Hamburg; draft KBV-IT-2024-DEV-01]
review_due: 2031-06-09
A.16 Works agreements, negotiation records and telemetry
Introduced in Chapter 22. Both organisations treat developer tooling as a matter for the employee representatives before it is a matter of configuration. Hansa Mutual follows the German pattern, with an annex to the group works agreement (KBV-IT-2024-DEV-01) negotiated with the Konzernbetriebsrat; Nordvik Region follows the Swedish pattern, with a negotiation record (MBA-NR-2030-03) under the Co-determination Act. The telemetry description is the mechanical part: which fields, for which purpose, at which grain, for how long, and what is not collected.
The artefact must never contain a rating, ranking or inference about a named developer, covert monitoring, or a way round the representatives' rights; the outline is not the signed text.
NR-DEV-001 telemetry. Collected at the AI gateway, by team, minimum group size 5.
# governance/telemetry/NR-DEV-001.yaml (illustrative)
tool: NR-DEV-001
owner: Gunilla Roos # accountable for use
collected_by: ai-gateway # not by the IDE plug-in
fields:
- {name: timestamp, purpose: operation, grain: event, retention_days: 180}
- {name: team, purpose: operation, grain: team, retention_days: 180}
- {name: repository, purpose: stewardship, grain: event, retention_days: 180}
- {name: tool_id_model, purpose: operation, grain: event, retention_days: 180}
- {name: token_count, purpose: operation, grain: team, retention_days: 180}
- {name: suggestion_accepted, purpose: adoption_claim, grain: team, retention_days: 90}
not_collected: [prompt_content, completion_content, keystrokes, user_id_in_reports]
reports:
to: [head of development, platform team, union IT representative]
grain: team
minimum_group_size: 5
named_developer: never
prompts: not retained until MBA-NR-2030-03 is concluded
readers: [platform team on-call, data protection officer]
stop: "platform team switches the gateway route off; effect Level 0 at once"
KBV-IT-2024-DEV-01. Outline of the developer-tooling annex (AIDR-1172), status negotiating.
# agreements/KBV-IT-2024-DEV-01.yaml (illustrative outline, not the signed text)
agreement: KBV-IT-2024-DEV-01
title: Developer-tooling annex to the group works agreement on IT systems
parent: KBV-IT-2024
parties: [Hansa Mutual group management, Konzernbetriebsrat]
status: negotiating # opened 2030-10-14
decision_record: AIDR-1172
legal_basis_de: [BetrVG 87(1) no. 6, BetrVG 90(1) no. 3, BetrVG 90(2), BetrVG 58(1)]
informed: [local_betriebsrat_hamburg, polish_representatives, ondernemingsraad_nl, ewc]
scope:
tools: [HM-DEV-001, HM-DEV-002, HM-DEV-003]
mandates: [MND-HM-DEV-01, MND-HM-DEV-02]
profile: DLG-HM-DEV-01
new_versions_in_scope: true # follows the mandate, not the release
external_developers: framework HM-PROC-DEV-2026-02 amended to match
excluded_uses:
- rating, pay, promotion, discipline or selection of a named person
- ranking of developers or teams by acceptance rate or agent usage
- inference of working hours, attention or mood
telemetry:
grain: team
minimum_group_size: 5
named_developer: never
prompts_retained: false # exception only by class 3 consent
person_level_access: [incident review route, data protection officer on complaint]
access_log_reported_to: Konzernbetriebsrat, aggregate, quarterly
change_classes:
class_1_consent: [higher level of delegation, new telemetry field, person-level report, use in a people decision]
class_2_joint_committee: {notice_working_days: 10, includes: [model version passing agreed tests, new task class within a mandate]}
class_3_information: [defect fix, security patch, field removed]
reclassification: representatives may raise a class; employer may not lower one
use_of_tool: optional by default; reasons to work without it recorded in the SPC-* record, not in appraisal
training: {paid_working_time: true, practice_without_tool: true}
ownership: employer holds the rights in programs created in duty (national law applies); personal AI accounts excluded
expert: {basis: BetrVG 80(3)}
stop: {who: [owner, reviewer, Konzernbetriebsrat chair], path: Hansa Forge gateway, effect: Level 0 at once}
review: {due: 2031-09-30, triggers: [failed stop test, provider change, Annex III obligations 2027-12-02]}
disputes: standing conciliation committee under BetrVG 76(1)
MBA-NR-2030-03. Negotiation record with the union branch for IT staff (AIDR-1122), with an interim protocol.
# negotiation/MBA-NR-2030-03.yaml (illustrative)
record: MBA-NR-2030-03
subject: Developer tooling and telemetry
opened: 2030-09-15
parties: [Nordvik Region, union branch for IT staff]
representatives: [Tomas Ekblad, Birgitta Almqvist]
basis: MBL 11 and 12
interim_protocol: {date: 2030-12-12, covers: NR-DEV-001, valid_until: 2031-06-30}
decision_record: AIDR-1122
agreed_so_far:
telemetry: [metadata only via the AI gateway, by team, minimum group size 5]
prompts_retained: false
excluded_uses: [rating, pay, discipline, ranking of named developers]
open: [retention of prompts for incident analysis, consultants under NR-2025-102, use-of-tool statement]
next_meeting: 2031-01-22
A.17 Duty registers, values, procurement and dependency records
Introduced in Chapters 18, 24, 25 and 26. These artefacts turn external obligations and internal values into things a pipeline or a reviewer can check. The duty register (DRR-*) holds dated readings of instruments with a holder, a deputy, the artefact that evidences the duty and the AI ceiling that follows; it states what the book reads and what counsel confirms, as architectural implications and not legal advice. The values mappings tie a value to a rule, a check, a check owner and an evidence expiry. The dependency and exit records state who can change what the tool depends on, and the date of the last exit test.
The artefact must never contain a legal conclusion presented as settled where counsel has not confirmed it, a value without a check, or an exit route that has not been tested.
DRR-HM-001-LEG, developer duties. Chapter 24. An excerpt of four rows (AIDR-1174).
register: DRR-HM-001-LEG
section: developer_duties
version: 2
decision_record: AIDR-1174
approved_on: 2031-02-03
texts_read: 2031-01-28 # the dated reading; entries expire
reverify_by: 2031-07-28 # six months, and on every announced amendment
jurisdictions_mapped: [DE, EU]
jurisdictions_not_mapped: [NL, SE, PL, NO, UK, CH]
duties:
- ref: CRA Art. 13(5)-(8), 14; Annex I Part II(1), (3)
scope: mobile claims app and broker plug-in # book's reading: in scope; counsel confirms
addressee: manufacturer
holder: Dr. Philipp Reinhardt
deputy: Lukas Frey
artefact: PRV with bill of materials; VER; vulnerability policy; CRA clock in the case record
evidence_max_age_days: 90
applies_from: 2027-12-11 # Art. 14 since 2026-09-11
ai_ceiling: generate Level 2 Supervised; patch class (MND-HM-DEV-01) Level 3 only for approved names
- ref: DORA Art. 9(4)(e); Reg. 2024/1774 Art. 16(3), (5), (8), 17(1)(b), (e)
addressee: financial_entity
holder: Dr. Philipp Reinhardt
deputy: Lukas Frey
artefact: RVW and VER per change; pseudonymised test data; revert path in CHG
evidence_max_age_days: 90
ai_ceiling: review Level 1 Assisted (AI comment is not a human approval); deploy Level 0; Level 4 prohibited
- ref: AI Act Art. 3(12), 25(1)(c); Annex III 5(c)
addressee: deployer_or_third_party
holder: Ulf Zimmermann
deputy: Anja Weiß
artefact: provider-test answer on every change to prompt, retrieval or tool configuration
evidence_max_age_days: 365
ai_ceiling: specify Level 1 Assisted; a change to an AI system's own mandate Level 4 prohibited
- ref: CRA Art. 13(13); PLD Arts. 9, 10(2)(a), 17(1)
addressee: manufacturer
holder: Ulf Zimmermann
deputy: Dr. Philipp Reinhardt
artefact: retention of SPC, VER, RVW, PRV and update history
retain_years: 10 # or the support period, whichever is longer
ai_ceiling: document Level 2 Supervised
Pipeline rule intended-purpose-change. Chapter 24. Nordvik Region, AIDR-1124; the provider test before a merge.
pipeline_rule: intended-purpose-change
decision_record: AIDR-1124
accountable: Gunilla Roos
rule_owner: Maja Lindqvist # platform team; not the author's team
triggers: # a changed path in any repository that holds an AI system
- system_prompt
- retrieval_configuration
- tool_permissions
- model_route
- allowed_use_statement
requires:
provider_test:
answered_by: Maria Åkesson # regional legal counsel, deputy named in the register
question: does the change make the system fall within Annex III, or alter a high-risk one (Art. 25(1))?
outcome: [no_change_of_role, route_to_ai_governance, stop]
reviewer_outside_author_team: true
merge: blocked_until_provider_test_answered
rule_file_write_access: platform_team_only # no agent identity may change the rule or its owners
evidence_max_age_days: 365
AIDR-1125. Chapter 25. Public-service values mapped to rules at Nordvik Region.
record: AIDR-1125
organisation: Nordvik Region
date: 2031-02-10
profile: DLG-NR-DEV-01
owner: Henrik Dahl
accountable_for_use: Gunilla Roos
reviewed_by: [Maria Åkesson]
consulted: [Tomas Ekblad]
review_due: 2031-08-10
values:
- value: equal treatment and impartiality
source: Instrument of Government, Chapter 1, Article 9
rule: >
No code that sorts, ranks or routes cases uses a protected
attribute or a field that stands in for one, unless an exception
is recorded in the specification record and approved at design review.
work_classes: [generate, refactor, test, migrate]
ceiling_effect: generate stays at Level 1; test never writes the oracle for its own change
check: counterfactual tests in the verification plan, written by the quality function
check_owner: Saga Edvardsson
evidence: VER-NR entry, run on every change to eligibility and triage modules
evidence_expiry_days: 90
uncovered_case_goes_to: Gunilla Roos, then the AI governance forum
- value: access for every citizen
source: Directive (EU) 2016/2102, Articles 4 to 7
rule: >
A citizen-facing change is released only after the golden-path
accessibility gate has passed and a person has tested the changed flow
with a keyboard and a screen reader.
work_classes: [generate, refactor, document, deploy]
ceiling_effect: prototypes built by non-developers never reach citizens unreviewed
check: platform gate plus manual test by an accessibility specialist
check_owner: Maja Lindqvist
evidence: RVW-NR entry with the tester named
evidence_expiry_days: 180
- value: honesty about how the work was made
source: IEEE Code of Ethics, item 1
rule: >
A pull request states in one line whether and how a tool took part;
a claim about speed or value carries scope, method, date and result.
work_classes: [generate, review, document]
ceiling_effect: none
check: pipeline refuses a production merge without the line
check_owner: Anders Falk
evidence: AVR-NR entry with evidence age shown
evidence_expiry_days: 90
use_limit: not used in appraisal, pay or ranking of named developers
AIDR-1175. Chapter 25. Customer-fairness values mapped to rules at Hansa Mutual.
record: AIDR-1175
organisation: Hansa Mutual
date: 2031-02-24
profile: DLG-HM-DEV-01
owner: Rainer Lehmann
accountable_for_use: Philipp Reinhardt
reviewer: Annette Krämer
consulted: [Thomas Brandt]
review_due: 2031-08-24
values:
- value: fair treatment of policyholders and claimants
source: Judgment C-236/09 Test-Achats; GDPR Article 5(1)(a)
rule: >
Sex is not an input to premium or benefit calculation. A field that
correlates with a protected attribute may be used only if the
specification record states why and the chief risk officer's
delegate has approved it.
work_classes: [specify, generate, refactor, test]
ceiling_effect: generate inside rating and settlement code stays at Level 1
check: counterfactual tests on rating and settlement services
check_owner: Ewelina Maj
evidence: VER-HM entry
evidence_expiry_days: 90
- value: accessibility of customer channels
source: Directive (EU) 2019/882 where counsel confirms scope
rule: >
Customer-facing changes pass the Hansa Forge accessibility gate;
scope under the Directive is decided by legal counsel and recorded.
work_classes: [generate, deploy, document]
check: gate in Hansa Forge plus manual test
check_owner: Lukas Frey
evidence_expiry_days: 180
- value: honesty about how the work was made
source: ACM Code of Ethics 1.3; IEEE Code of Ethics item 1
rule: >
Reports to senior bodies on AI-assisted share state the counting rule
and the sample; an AI review comment never counts as a human approval.
work_classes: [review, document]
check: second approver reads the counting rule
check_owner: Stefan Brückner
evidence: AVR-HM entry with evidence age
evidence_expiry_days: 90
Criteria sheet NR-2030-041. Chapter 18. The tender for development assistants (AIDR-1118); the agentic module only by separate decision.
tender: NR-2030-041
procedure: open
decision_record: AIDR-1118
decided_on: 2030-10-14
decided_by: Henrik Dahl # CIO; value below the EUR 2 million committee line
accountable_for_use: Gunilla Roos
subject: development assistants for Applications and Integration
specification:
functions: [completion, chat, multi-file edit]
optional_module: agentic_mode # enabled only by a separate decision
named_brand_allowed: false # Directive 2014/24/EU Article 42(4)
delegation_ceiling_ref: DLG-NR-DEV-01
ceiling_enforced_by: configuration the Region controls
mandatory:
- processing in the EEA, or self-hosted on the Region's reserved capacity
- no training on the Region's code, prompts or logs
- export of logs, configuration and prompt history in an open format
- administrative switch that disables the agentic mode without supplier action
- no use of an unapproved public service by the tool or its sub-processors
award:
method: best price-quality ratio # Directive 2014/24/EU Article 67(2)
weights:
life_cycle_cost: 35
fit_on_region_stacks: 20 # scored trial on a repository copy
security_and_secure_development: 15
data_handling_and_logging: 10
accessibility_of_the_tool: 5
exit_and_portability: 10
evidence_for_claims: 5 # population, task, period, method
performance_conditions: # Article 70
review_clause: notice of model, price and feature changes at least 30 days
change_test: delegation profile re-reviewed before a model change is accepted
exit: export within 30 days of notice; deletion confirmed in writing
records:
log_retention_class: to be fixed with the archivist
log_reader: team lead and platform lead, not for appraisal
review: before award, with the IT union representative
LIC-HM-DEV-01. Chapter 26. Licence classes for internal and distributed software.
licence_policy: LIC-HM-DEV-01
owner: {name: Lukas Frey, role: ROLE-HM-PLT-01}
review_due: 2031-07-31
classes:
internal-service:
allow: [MIT, Apache-2.0, BSD-3-Clause, ISC]
approval_by_named_developer: [MPL-2.0, LGPL-2.1-only]
deny: [AGPL-3.0-only, SSPL-1.0]
distributed-to-customers: # mobile claims app, broker plug-in
allow: [MIT, Apache-2.0, BSD-3-Clause, ISC]
approval_by_named_developer: []
deny: [GPL-2.0-only, GPL-3.0-only, AGPL-3.0-only, LGPL-3.0-only, SSPL-1.0]
on_unknown_licence: block_and_ask_owner
check: {where: hansa-forge pipeline, input: bill of materials, standard: SPDX identifiers}
generated_code: {similarity_scan: true, on_match_over_threshold: human_review_and_record_in_PRV}
AIDR-1126. Chapter 26. Dependencies of the coding assistant NR-DEV-001 and the package proxy; the exit test failed its quality gate.
aidr: AIDR-1126
title: Dependencies of the coding assistant NR-DEV-001 and the package proxy
date: 2031-02-10
decider: Henrik Dahl # CIO
accountable_for_use: Gunilla Roos
delegation_profile: DLG-NR-DEV-01
dependencies:
- id: model
what: open-weight coding model, self-hosted on the Region's reserved capacity
licence: Apache-2.0 # from the publisher's model card; weights only
copyright_policy_and_training_summary: requested 2031-01-20, received
code_leaves_region: false
people_who_can_change: the platform team (seven engineers)
exit: {route: second open-weight model behind the same serving stack, invoked_by: Maja Lindqvist}
exit_test: {id: RST-NR-2031-0001, tested: 2031-02-03, switch_time: PT3H, quality_gate: "pass rate 0.86 against 0.90 on 120 tasks", result: failed_quality_gate}
retest_due: 2031-03-15
- id: serving-capacity
what: reserved capacity run by the platform team
exit: {route: second site or the national shared-service provider, status: study only}
note: shares a failure domain with identity federation at SamDrift
- id: ide-ambient-completion
what: Mode 0 completion in the licensed IDEs
exit: {route: switch off by policy in the IDE configuration, tested: 2031-01-27}
decision_history: AIDR-1102
- id: package-proxy
what: approved registries only, one mirror
maintainers_of_critical_libraries_checked: 14
support_for_open_source: {action: report and fix upstream, owner: Joakim Wester}
licence_position: {policy: LIC-NR-DEV-01, bill_of_materials: SPDX, similarity_scan_on_generated_code: true}
review: {earlier_of: [2031-08-10, model_retirement_notice, change_of_licence_terms, evidence_expiry]}
answerable: {name: Gunilla Roos, understand: "reasons reconstructed from the record and the oracle results, not the assistant's summary", revert: "gateway route and IDE policy"}
AIDR-1176. Chapter 26. Exit plan EXIT-005 for the hosted assistant HM-DEV-001; the exit test passed.
aidr: AIDR-1176
title: Exit plan and dependency record for the IDE assistant HM-DEV-001
date: 2031-01-27
decider: Rainer Lehmann # group CIO
proposers: [Dr. Philipp Reinhardt, Lukas Frey]
reviewer: Dr. Annette Krämer # chief risk officer
delegation_profile: DLG-HM-DEV-01
dependency:
provider: CodeMeridian
contract: HM-PROC-AIDEV-2029-01
register_of_information: service supporting an important function
contract_terms: {no_training_on_group_code: true, eu_processing: true, model_change_notice_days: 30}
reach: {licences: 340, scope: code outside claims, health and underwriting products}
concentration_check: "no other group service on the same provider; DORA Article 29(1)(b) considered"
exit_plan: EXIT-005
# new instance of the EXIT family of earlier volumes
exit:
route: gateway route to the self-hosted model hansa-code-m in Frankfurt
invoked_by: Lukas Frey
stop_held_outside_provider: gateway switch in Hansa Forge
test: {id: RST-HM-2031-0002, tested: 2031-01-19, switch_time: PT2H, quality_gate: "pass rate 0.91 against 0.90 on 150 tasks", result: passed, evidence_age_limit_days: 180}
licence_position: {policy: LIC-HM-DEV-01, generated_code_scan: true}
model_change_rule: "on notice: re-run the oracle and the acceptance claim before the cut-over; AVR-HM-2030-01 restated"
review: {earlier_of: [2031-07-19, model_retirement_notice, change_of_terms]}
A.18 Horizon registers, checks, plans and the scorecard
Introduced in Chapters 29 to 33. A horizon register (HZN-*) is a list of trends and not a forecast: each entry carries its label (observable, expected or speculation), the developer functions it concerns, evidence and its age, a trigger and a posture. The anti-pattern check, the year read-out, the twelve-month plan and the thesis scorecard close the book's records: an entry without a closing record is an open item and not a result.
The artefact must never contain a projection without a label, a claim without an evidence age, or a step at Level 4; each plan states level_4_check.
HZN-NR-2031-01. Chapter 29, Nordvik Region (AIDR-1129).
register: HZN-NR-2031-01
title: Horizon register for developer roles, Nordvik Region
owner: Gunilla Roos # head of Applications and Integration
approved_by: AIDR-1129
reviewed: 2031-05-12
next_review: 2031-11-30
labels: [observable, expected, speculation]
trends:
- id: T1
trend: Hiring of early-career staff falls in occupations where AI substitutes for tasks
label: observable
functions: [D3 Build, D5 Steward]
evidence: "Brynjolfsson, Chandar and Chen, ADP payroll data, US, to June 2026; ages 22-25, descriptive"
evidence_age_months: 59
scope_limit: "United States; Danish register data to 2024 show no earnings or hours effect (Humlum and Vestergaard)"
trigger: "Applications and Integration receives fewer than two junior placements in the 2031 intake"
posture: commit
owner: ROLE-NR-DEV-01
- id: T2
trend: Consultant capacity (22 developers under NR-2025-102) is bought differently as AI tools spread
label: speculation
functions: [D3 Build, D4 Prove]
evidence: "none measured for Europe; the Region's own contract has no clause on AI tools"
evidence_age_months: 0
trigger: "Two of three framework suppliers offer fixed-price delivery priced on AI-assisted effort"
posture: keep_reversible
owner: Gunilla Roos
- id: T3
trend: Software the Region places on the market is treated as a product in law
label: expected
functions: [D5 Steward]
evidence: "Directive (EU) 2024/2853 Art. 4(1), applies after 2026-12-09; Regulation (EU) 2024/2847 Art. 71, applies 2027-12-11"
trigger: "Regional legal counsel concludes the published e-service components are within scope"
posture: prepare
owner: Maria Åkesson
- id: T4
trend: One steward answers for many agent-authored changes
label: speculation
functions: [D4 Prove, D5 Steward]
evidence: "Mode 3 limited to the platform team; no coding agent in Applications and Integration"
trigger: "A mandate MND-NR-DEV-* is proposed that lets an agent open changes without a human reading each"
posture: keep_reversible
owner: Maja Lindqvist
thresholds_that_would_change_the_projection: [1, 2, 3, 4, 5]
HZN-HM-2031-01. Chapter 29, Hansa Mutual (AIDR-1179).
register: HZN-HM-2031-01
title: Horizon register for developer roles, Hansa Mutual
owner: Dr. Philipp Reinhardt # head of Group Application Development
approved_by: AIDR-1179
reviewed: 2031-04-22
next_review: 2031-10-31
labels: [observable, expected, speculation]
trends:
- id: T1
trend: Five of twelve COBOL and PL/I maintainers reach retirement age within eight years
label: observable
functions: [D5 Steward]
evidence: "Group Application Development staffing review, 2030-09; estate listed by named owner and deputy (AIDR-1162)"
evidence_age_months: 7
trigger: "A second maintainer gives notice before a deputy is recorded for the settlement module"
posture: commit
owner: ROLE-HM-DEV-01
- id: T2
trend: Agent-authored changes grow faster than review hours
label: speculation
functions: [D4 Prove, D5 Steward]
evidence: "Mode 3 agents used by about 120 engineers; no coding agent merges alone"
trigger: "Median review time per pull request in a team falls below 20 minutes for two quarters"
posture: keep_reversible
owner: ROLE-HM-TCL-01
- id: T3
trend: The mobile claims app and broker plug-in are products with digital elements
label: expected
functions: [D5 Steward]
evidence: "Regulation (EU) 2024/2847 Art. 71, applies 2027-12-11; scope for Hansa assessed in Chapter 24"
trigger: "General counsel concludes that the group is a manufacturer in the sense of the Regulation"
posture: prepare
owner: Ulf Zimmermann
thresholds_that_would_change_the_projection: [1, 3, 5]
Anti-pattern check 2031-02. Chapter 30, Nordvik Region (AIDR-1130).
# governance/anti-pattern-check-2031-02.yaml (illustrative)
scope: integration-and-data-team
period: 2030-09-01/2031-01-31
date: 2031-02-10
tech_lead: {name: Anders Falk, role: ROLE-NR-TCL-01}
independent_reviewer: {name: Maja Lindqvist, office: platform team lead}
findings:
acceptance_rate_dashboard:
result: partial
test: Understand
basis: "AVR-NR-2030-01 restated: 31 per cent acceptance reported beside delivery time from the tracker; 'a third faster' withdrawn"
action: "measure lead time per change for two quarters; owner Gunilla Roos"
due: 2031-06-30
unowned_agent:
result: open
test: Name
basis: "OWN-NR-2030-00: 31 per cent of 96 repositories name a departed owner; 7 in this team's area" # illustrative count
action: "assign owners before any Mode 3 extension; owner Anders Falk"
due: 2031-04-30
generated_test_proves_nothing:
result: partial
test: Understand
basis: "portal changes use an oracle approved by the quality engineer; inherited national-register interfaces have none"
action: "keep inherited interfaces at Level 0 Advisory for generate; second reviewer who knows the system"
secret_in_prompt:
result: partial
test: Revert
basis: "AIDR-1116 routes NR-DEV-001 through the AI gateway; consultants under NR-2025-102 not yet covered by a clause"
action: "AI-tools clause in the next call-off; owner CIO office"
due: 2031-05-31
review_rubber_stamp: {result: open, test: Understand, basis: "one same-team reviewer, no rule for generated code"}
junior_hole: {result: pass, basis: "APR-NR-2030-01: mentor with 2 protected hours a week; second assessor"}
vibe_coded_system: {result: not-assessed, note: "FormFlow sweep belongs to the e-services team"}
trusted_name: {result: not-assessed, note: "no coding agent in this team; proxy denials not yet counted"}
open_pipeline: {result: partial, test: Revert, basis: "release job token not yet scoped per job", owner: platform team}
level_4_check: "no step at Level 4; people class not delegated (DLG-NR-DEV-01)"
decision: AIDR-1130
expires: 2031-08-10
Year read-out, Nordvik Region. Chapter 31. The ledger as it stood on 2031-08-31.
# year/read-out-nordvik-2031-08.yaml (illustrative)
kind: year-read-out
holder: {role: head of Applications and Integration, name: Gunilla Roos}
partner: Ingrid Halvorsen # holds the ledger; does not read coding-tool logs
period: 2030-09-01/2031-08-31
commission: AIDR-1100
entries:
- {month: 2030-09, claim: "ceilings of DLG-NR-DEV-01 hold",
record: AIDR-1101, basis: recorded, status: closed, closing_record: AIDR-1135}
- {month: 2030-10, claim: "a third faster (AVR-NR-2030-01)",
record: AVR-NR-2030-01, basis: recorded, status: closed, closing_record: "note of 2030-12-20, withdrawn"}
- {month: 2030-10, claim: "every repository has an owner and a deputy, or is proposed for archive",
record: AIDR-1112, basis: recorded, status: closed_with_conditions,
condition: "retirements wait for the archivist"}
- {month: 2030-11, claim: "revert rehearsed within 90 days",
record: AIDR-1111, basis: derived, status: closed, closing_record: "rehearsal 2031-01-08"}
- {month: 2030-12, claim: "interim protocol covers the pilot",
record: MBA-NR-2030-03, basis: recorded, status: open,
open_items: [prompt_retention, consultants_under_NR-2025-102]}
- {month: 2031-03, claim: "exit route for the coding model",
record: RST-NR-2031-0002, basis: recorded, status: open, closing_record: none}
- {month: 2031-03, claim: "steward position confirmed by counsel by 2031-03-31",
record: "Chapter 24", basis: recorded, status: open, closing_record: none}
- {month: 2031-05, claim: "assessment of three registry systems",
record: AIDR-1136, basis: recorded, status: running}
- {month: 2031-06, claim: "revert without the pipeline in 30 minutes",
record: RST-NR-2031-0003, basis: recorded, status: open, closes_when: "test passes by 2031-09-30"}
- {month: 2031-06, claim: "first report to the executive committee",
record: AIDR-1100, basis: recorded, status: closed, closing_record: "filed 2031-06-27"}
reading:
open_items: 4
closed_items: 4
closed_with_conditions: 1
running: 1
rule: "an entry without a closing record is an open item, not a result"
level_4_check: "no class at Level 4; the people class is not delegated"
review: {next: 2031-11-10, reviewers: [executive committee, union branch for IT staff]}
Twelve-month plan, Nordvik Region. Chapter 32 (AIDR-1132).
file: governance/twelve-month-plan-2031.yaml
organisation: Nordvik Region
decided_in: AIDR-1132
owner: {role: head of Applications and Integration, name: Gunilla Roos}
accountable: {role: CIO, name: Henrik Dahl}
partner: Ingrid Halvorsen # holds the log; reads no telemetry by name
period: 2031-09-01/2032-08-31
rule: close what has expired before opening anything new
level_4_check: no step at Level 4; people class not touched; no ceiling raised in this plan
quarters:
- id: Q1-close # 2031-09 to 2031-11
steps:
- {do: decide on the pilot claim as restated in revision 3 of AVR-NR-2030-01 (12 August 2031) and renew its usage claim before 2031-11-10, owner: Anders Falk, evidence_owner: regional controlling, due: 2031-09-30}
- {do: record in MND-NR-DEV-01 the raise to Level 2 Supervised made by AIDR-1116 on 2030-11-18, with the review evidence for it, owner: Maja Lindqvist, due: 2031-09-30}
- {do: confirm the register re-read due 2031-07-21 and counsel's position on steward status, owner: Maria Åkesson, due: 2031-09-30}
- {do: close the archive proposals that wait for the archivist and name the missing deputies, owner: Gunilla Roos, due: 2031-10-31}
- {do: re-run the exit test against the 0.90 gate, test the local break-glass accounts of the June finding by 2031-09-30 and file both results, owner: Maja Lindqvist, due: 2031-10-31}
- {do: conclude MBA-NR-2030-03 or extend the interim protocol (now to 2031-12-31) with a new date, owner: Ingrid Halvorsen, due: 2031-11-30}
- id: Q2-open # 2031-12 to 2032-02
steps:
- {do: bring the tender outcome under DLG-NR-DEV-01; agentic module only by separate decision, owner: Henrik Dahl, due: 2031-12-15}
- {do: AI-tool clauses in the next call-off under NR-2025-102, owner: Henrik Dahl, due: 2032-01-31}
- {do: second reviewer from outside the author team and an oracle approved by the quality engineer for citizen-facing changes, owner: Saga Edvardsson, due: 2032-01-31}
- {do: regression pack for the case platform and a first pack for Socialia before any change to SVC-NR-003 or Socialia is generated, owner: Linnea Sjöberg, due: 2032-02-29}
- id: Q3-decide # 2032-03 to 2032-05
steps:
- {do: review DLG-NR-DEV-01 against the measures; raise nothing without evidence, owner: Gunilla Roos, due: 2032-03-23}
- {do: decide whether to extend the assessment of AIDR-1136 beyond three registry systems, only where regression packs exist, owner: Henrik Dahl, due: 2032-04-30}
- {do: budget request for consultants and junior intake, with team-level measures, owner: Gunilla Roos, due: 2032-04-30}
- id: Q4-read # 2032-06 to 2032-08
steps:
- {do: read measures K1 to K10 and the horizon register HZN-NR-2031-01, owner: Ingrid Halvorsen, due: 2032-08-31}
stop_rule: the union IT representative, the owner or the platform lead may stop any step; the stop sits in the GitOps pipeline, outside the tool
Twelve-month plan, Hansa Mutual. Chapter 32 (AIDR-1182).
file: governance/twelve-month-plan-2031.yaml
organisation: Hansa Mutual
decided_in: AIDR-1182
owner: {role: head of Group Application Development, name: Dr. Philipp Reinhardt}
accountable: {role: group CIO, name: Rainer Lehmann}
partner: Dr. Annette Krämer # chief risk officer; reads the log, not the telemetry
period: 2031-09-01/2032-08-31
rule: close what has expired before opening anything new
level_4_check: no step at Level 4; people class not touched; Level 3 only for the one approved class
quarters:
- id: Q1-close # 2031-09 to 2031-11
steps:
- {do: sign KBV-IT-2024-DEV-01 or extend the interim terms of AIDR-1172 with a date, owner: Marlene Voss, with: Thomas Brandt, due: 2031-09-30}
- {do: carry the restatement of the 42 per cent (sample of 40, method, date; second sample 2031-08-26) into the executive board record, owner: Rainer Lehmann, evidence_owner: group controlling, due: 2031-10-15}
- {do: re-test EXIT-005 on 150 held-out tasks and file the result, owner: Lukas Frey, due: 2031-09-30}
- {do: renew MND-HM-DEV-01 on measured reverts or lower the class to Level 2 Supervised, owner: Rainer Lehmann, reviewer: Dr. Annette Krämer, due: 2031-09-30}
- {do: complete the COBOL and PL/I list by named owner and deputy, owner: Dr. Philipp Reinhardt, due: 2031-10-31}
- {do: counsel's conclusion on the mobile app and broker plug-in under the CRA, owner: Ulf Zimmermann, due: 2031-10-31}
- id: Q2-open # 2031-12 to 2032-02
steps:
- {do: stepped roll-out measured by team, minimum group size 5, outcomes at service level, owner: Stefan Brückner, evidence_owner: group controlling, due: 2032-02-29}
- {do: provenance right-to-know clause in the managed-service contract, owner: Lukas Frey, due: 2032-01-31}
- {do: map the Netherlands and Poland in DRR-HM-001-LEG before other entities, owner: Ulf Zimmermann, due: 2032-02-29}
- {do: decide the 2032 apprentice intake for the broker interface team, owner: head of the broker interface team, due: 2031-12-15}
- id: Q3-decide # 2032-03 to 2032-05
steps:
- {do: review DLG-HM-DEV-01 against the measures; raise nothing without evidence, owner: Rainer Lehmann, due: 2032-03-30}
- {do: scope of the assessment of SVC-HM-003 and succession for the five maintainers, owner: Dr. Philipp Reinhardt, due: 2032-05-31}
- id: Q4-read # 2032-06 to 2032-08
steps:
- {do: read measures K1 to K10 and the horizon register HZN-HM-2031-01, owner: Dr. Annette Krämer, due: 2032-08-31}
stop_rule: the Konzernbetriebsrat, the mandate owners and Hansa Forge on-call may stop any agent step; the stop sits in the Hansa Forge gateway, outside the agent
AIDR-1183, thesis scorecard. Chapter 33, Hansa Mutual.
id: AIDR-1183
kind: thesis-scorecard
status: illustrative
decided_by: {role: group CIO, name: Rainer Lehmann}
reviewers: [Dr. Annette Krämer, Konzernbetriebsrat]
as_of: 2031-08-29
next_review: 2032-02-26
parts:
- part: 1-transformed-not-abolished
label: expected
evidence: {record: HZN-HM-2031-01, basis: derived}
thinnest_point: "no study of practising developers across years"
- part: 2-graded-delegation
label: observable
evidence: {record: DLG-HM-DEV-01, adopted: 2030-09-30, basis: recorded}
level_4_check: "no work class at Level 4; people class not delegated"
- part: 3-verification-and-junior-route
label: expected
evidence: {record: APR-HM-2030-01, basis: recorded}
open: "broker team intake reversed 2031-03-28 (illustrative); no outcome data on the apprenticeship plans"
- part: 4-stewardship
label: observable
evidence: {record: OWN-HM-2030-00, basis: recorded, services_without_owner: 14, services: 410}
corollary: {oracle_independent_of_generator: true, shown_by: seeded_defects}
- part: 5-claims-with-evidence
label: observable
evidence: {record: AVR-HM-2030-01, quoted: 42, sampled: 27, sample_size: 40}
status: expired # sample of 2030-08; re-sampled 2031-08-26, value not measured
monday_actions:
D1: {owner: Dr. Philipp Reinhardt, due: 2031-09-01, record: none_yet}
D2: {owner: Dr. Philipp Reinhardt, due: 2031-09-01, record: none_yet}
D3: {owner: Rainer Lehmann, due: 2031-09-01, record: DLG-HM-DEV-01}
D4: {owner: Ewelina Maj, due: 2031-09-01, record: VER-HM-2030-0007}
D5: {owner: Stefan Brückner, due: 2031-09-01, record: OWN-HM-2030-00}
reading:
rule: "an entry without a closing record is an open item, not a result"
refutation_tests_seen: 0
gaps_listed: 10
A.19 A check of profiles and mandates
Rendered by this appendix. The check reads fenced YAML in a Markdown file, finds the delegation profiles (A.1) and mandates (A.2) and reports any class at Level 4, any delegation of the people class, any mandate level above the ceiling of its profile and any mandate at Level 4. It is a defensive hygiene check on records and not a gate: the named owner reads the profile, and a pipeline that enforces the rule belongs to the platform team, outside the reach of any agent.
"""Check the delegation profiles and mandates of Appendix A against the Level 4 rule.
Illustrative. Reads this appendix (or any Markdown file with YAML blocks) and
reports problems; it changes nothing. It does not replace the reading of the
profile by the named owner.
"""
import re
import sys
import yaml
FENCE = "`" * 3
YAML_BLOCK = re.compile(FENCE + r"yaml\n(.*?)" + FENCE, re.S)
LEVEL = re.compile(r"Level\s+(\d)")
PROFILE_OF = {"MND-HM": "DLG-HM-DEV-01", "MND-NR": "DLG-NR-DEV-01"}
def level_of(value):
"""Return the integer level of a ceiling, or None if it names none."""
if isinstance(value, dict):
value = value.get("ceiling", value.get("level"))
if isinstance(value, int):
return value
match = LEVEL.search(str(value or ""))
return int(match.group(1)) if match else None
def load(text):
"""Collect delegation profiles and mandate bodies from fenced YAML blocks."""
profiles, mandates = {}, []
for raw in YAML_BLOCK.findall(text):
doc = yaml.safe_load(raw)
if not isinstance(doc, dict):
continue
if "delegation_profile" in doc and "classes" in doc:
profiles[doc["delegation_profile"]] = doc
mandate = doc.get("mandate")
if isinstance(mandate, dict) and "id" in mandate:
mandates.append(mandate)
return profiles, mandates
def check(text):
profiles, mandates = load(text)
problems = []
for name, profile in profiles.items():
for work_class, spec in profile["classes"].items():
if level_of(spec) == 4:
problems.append(f"{name}: class {work_class} is at Level 4")
if profile["classes"].get("people", {}).get("ceiling") != "not delegated":
problems.append(f"{name}: the people class is delegated")
if profile.get("level_4", {}).get("used") is not False:
problems.append(f"{name}: level_4.used is not false")
for work_class, spec in profile.get("bounded_classes", {}).items():
if level_of(spec) == 4:
problems.append(f"{name}: bounded class {work_class} is at Level 4")
for mandate in mandates:
profile = profiles.get(PROFILE_OF.get(mandate["id"][:6], ""))
if profile is None:
continue
for work_class, spec in mandate.get("delegation", {}).items():
level = level_of(spec)
if work_class == "people":
problems.append(f"{mandate['id']}: the people class is delegated")
if level == 4:
problems.append(f"{mandate['id']}: {work_class} is delegated at Level 4")
if work_class not in profile["classes"] and work_class not in profile.get("bounded_classes", {}):
problems.append(f"{mandate['id']}: class {work_class} is not in the profile")
continue
ceiling = level_of(profile["classes"].get(work_class, {}))
if level is not None and ceiling is not None and level > ceiling:
problems.append(
f"{mandate['id']}: {work_class} Level {level} exceeds ceiling {ceiling}"
)
if level_of(mandate) == 4:
problems.append(f"{mandate['id']}: mandate is at Level 4")
return problems
if __name__ == "__main__":
found = check(open(sys.argv[1], encoding="utf-8").read())
print("\n".join(found) if found else "no problems found")
sys.exit(1 if found else 0)
Run as python3 check_profiles.py docs/35_appendix_a_code_examples.md; the expected result for this appendix is "no problems found".
Sources
No source is cited in this appendix. The artefacts are the book's own illustrations; the sources for the instruments and studies they refer to are cited in the chapters that introduce them.