Notes on AI policy and records.
Posts

What is shadow AI?
AI already in use at your agency that no one approved and no one can see.

What is an AI audit trail, and what makes one trustworthy
Who used which AI tool, what was sent and returned, when, and whether policy held.

What evidence does an auditor expect for AI use in a state agency?
A current AI inventory, proof your AI policy was followed, and a running record of AI use.

An AI acceptable use policy is not enforcement
Most agencies have an AI acceptable use policy. Few can show it held.

How do you prove what an AI model was given?
A record made when the request was sent, naming who and what.

What are the audit trail requirements for AI use in a police department?
CJIS sets a general audit floor for any system touching CJI.

Is an AI-generated police report discoverable?
Discovery rules and Brady decide whether an AI police report draft is disclosed.

What would New York City's AI kill switch bill require?
Outside validation, a shut-down capability for AI models, and 24-hour incident reports from city contractors.

What has to be preserved when an officer uses AI to draft a report?
Keep what the tool was given, the AI's first draft, and who used it.

What CJIS requires before staff use AI
What auditors will ask, and what a defensible record looks like.

How do you stop an AI coding agent from running destructive commands?
Limit what it can reach, require approval for irreversible actions, and keep a record of what it tried.

Agentic AI governance: control the action, not the prompt
Why agentic AI governance must move to the action boundary.
See Verillian on a real device.

