Review AI requests with the controls written down first.

Sound familiar?

• AI requests arrive with no description of the data or the actions involved.
• You are asked to approve tools without a list of controls to check.
• Agents that act in other systems need limits nobody has defined.
• There is no record of what was recommended and why.

What you get

• Launch-blocking controls

  Security and governance requirements derived from the workload, marked recommended-not-enforced until you verify them.

• An editable risk register

  Likelihood, impact, owner and mitigation for each risk, saved with the assessment and versioned.

• A governance export

  Requirements, suggested policies, the agent inventory and the evaluation plan as JSON for ARC Control (workspace plan).

How it works

1. 1Ask the requesting team to run the intake, or run it with them.
2. 2Read the security and governance sections against your own standards.
3. 3Assign owners in the risk register and save the assessment to your workspace.
4. 4Export the governance package, or talk to ARC about runtime enforcement.

Questions

Is this a compliance attestation?

No. The output is recommendations. Nothing in it is an enforced control or a certification.

Can other organisations see our assessments?

No. Workspaces are isolated; a person outside your workspace gets "not found".

Do AI agents make the decision?

No. The decision comes from fixed rules. Optional AI helpers only suggest intake answers or explain the result, and are off by default.