-
Notifications
You must be signed in to change notification settings - Fork 4
What CHAP proves for AI governance
CHAP can provide strong evidence about who participated, what was proposed and how a decision changed. It does not make an AI system compliant, fair, safe or correct by itself.
AI governance needs evidence that policies and oversight processes actually operated. CHAP can standardise part of that evidence for human-agent work: participants, tasks, artefacts, review requests, approvals, rejections, overrides, abstentions, escalations and the signed sequence in which they occurred.
This is useful for internal assurance, customer review and regulated processes. It is not a compliance certificate. Legal obligations and risk controls depend on the system, sector, jurisdiction and context of use.
The strength of each claim depends on the enabled profiles, identity binding, key management, Coordinator controls and surrounding deployment.
| Governance question | Evidence CHAP can provide |
|---|---|
| What work was under review? | Task and exact artefact reference |
| Who participated? | Typed participants, membership and message attribution |
| What did the agent propose? | Proposed artefact linked to the task |
| What did the human decide? | Approve, reject, override, abstain or escalate method |
| What changed? | Structured override diff and resulting artefact |
| Why was it changed? | Declared rationale, tags and policy references |
| In what operational regime? | Shadow, trial or production mode |
| What external evidence was used? | Citations to tool calls, records or agent exchanges |
| Was the recorded sequence altered? | Signature and hash-chain verification, subject to implementation and key controls |
| Can another system interpret it? | Public schemas, protocol methods and conformance material |
CHAP makes these claims portable. A verifier does not need to reverse-engineer a private approval_events table before understanding the decision vocabulary.
A well-formed, validly signed artefact can still contain false, unsafe or low-quality content. Accuracy requires domain evaluation, testing and monitoring.
Identity and role evidence can show who acted under a declared authority. It cannot show that the person read every field, understood the consequences or had the right expertise unless other controls establish those facts.
CHAP can record a policy reference and whether a Coordinator enforced a machine-readable rule. It does not prove that the policy is lawful, fair, complete or suited to the risk.
An approval can be technically valid even if the interface hid relevant context, rushed the reviewer or used manipulative defaults. Human-factors testing remains essential.
Approval and execution are different events. A tool may fail, receive different arguments or be called twice. Cite and reconcile execution evidence rather than treating approval as proof of outcome.
Compliance depends on scope, classification and a wider control environment. CHAP may supply evidence for some controls, but it cannot make the legal determination.
Governance programmes often confuse the existence of a log with the effectiveness of oversight. A field called human_approved can be true even when the reviewer had no real choice or the proposal changed after approval.
The opposite mistake is to dismiss protocol evidence because it cannot prove correctness. Assurance rarely rests on one artefact. It combines policy, technical controls, test results, operational monitoring, human roles and exception management. CHAP can make the human-agent collaboration portion more rigorous and interoperable.
A practical control chain has five parts:
- Policy: Define which actions require review and who may decide.
- Mechanism: Enforce the review boundary in the application and CHAP Coordinator.
- Evidence: Record the proposal, participant, decision and resulting artefact.
- Test: Verify both allowed and forbidden paths, including retry and partial failure.
- Exception process: Record abstention, escalation, emergency authority and reconciliation.
For example, a policy might require a qualified specialist to approve a production recommendation above a risk threshold. CHAP can record the task, mode, reviewer, decision and override. Separate identity systems, training records and policy tests establish whether the reviewer was qualified and the routing rule worked.
The NIST AI Risk Management Framework treats governance as a cross-cutting function and highlights documentation, defined human roles and human-AI interaction. CHAP can provide structured operational evidence for those practices, while the organisation still performs the broader Govern, Map, Measure and Manage work.
The EU AI Act includes provisions on record-keeping capabilities and human oversight for certain high-risk AI systems. A CHAP deployment may help evidence parts of an oversight process, but whether those provisions apply and whether the complete system satisfies them require legal and technical assessment. This page is not legal advice.
A self-asserted participant identifier is weaker than an identity bound to an authenticated principal. A local hash chain is useful for tamper detection but has different trust properties from evidence anchored outside the operator's infrastructure. A correct protocol implementation can still be undermined by stolen keys or compromised endpoints.
Document:
- Identity proofing and authentication.
- Authorisation and workspace policy.
- Signing keys, rotation and revocation.
- Clock and timestamp assumptions.
- Evidence storage, export and external anchoring.
- Retention, redaction and access control.
- Reconciliation between decision and execution systems.
- Conformance and independent interoperability results.
Governance evidence can become sensitive. It may reveal personal data, confidential reasoning, organisational policy or protected domain information.
Store only what is proportionate. Use opaque artefact references and hashes where the full content belongs in a controlled external store. Define retention and redaction before production use. Do not treat an append-only design as permission to retain every payload indefinitely.
Prefer:
The deployment produced a verifiable record that the declared reviewer received artefact X, submitted override Y with rationale Z, and the Coordinator accepted it under policy P.
Avoid:
CHAP proves the AI decision was compliant and correct.
The first statement is specific and testable. The second combines several claims the protocol cannot establish.
- CHAP specification
- CHAP security policy
- CHAP technical report
- NIST AI Risk Management Framework
- NIST AI RMF Core
- Regulation (EU) 2024/1689, consolidated text
If you are mapping CHAP to a real assurance control, star the project and share the control objective and evidence gap in Discussions.
Last reviewed: 25 August 2026.