{
  "object_name": "AI Use Case Governance Register",
  "object_slug": "ai-use-case-governance-register",
  "version": "1.0",
  "last_reviewed": "2026-06-24",
  "owner": "LPM / Lapemo",
  "primary_lpm_layer": "AI Amplification",
  "connected_layers": [
    "Ownership Map",
    "Decision Architecture",
    "Communication Architecture",
    "Information Ecology",
    "Platform Structure",
    "Governance Architecture",
    "Control Map",
    "Risk Acceptance Register",
    "AI Governance Checklist",
    "Agent Accountability Checklist",
    "Human-in-the-Loop Model"
  ],
  "purpose": "Maintain a governed register of AI use cases from idea through retirement, with ownership, risk, permissions, evidence, controls, monitoring, and value realization.",
  "intended_audience": [
    "Executives",
    "AI governance leaders",
    "Transformation leaders",
    "Product leaders",
    "Risk and control owners",
    "Data and platform owners",
    "AI program managers",
    "Design partners"
  ],
  "required_fields": [
    {
      "field": "Use case ID",
      "definition": "Unique identifier for the AI use case",
      "required": "Yes"
    },
    {
      "field": "Use case name",
      "definition": "Plain-language name of the AI capability",
      "required": "Yes"
    },
    {
      "field": "Business purpose",
      "definition": "Outcome, workflow, decision, risk, customer, employee, or control need supported",
      "required": "Yes"
    },
    {
      "field": "Accountable business owner",
      "definition": "Person or role accountable for outcome, value, and risk acceptance",
      "required": "Yes"
    },
    {
      "field": "Technical owner",
      "definition": "Person or role accountable for build, integration, reliability, and logs",
      "required": "Yes"
    },
    {
      "field": "Data or knowledge owner",
      "definition": "Person or role accountable for sources, data quality, sensitivity, access, and freshness",
      "required": "Yes"
    },
    {
      "field": "Control owner",
      "definition": "Person or role accountable for control design, evidence, testing, monitoring, and exceptions",
      "required": "Required for moderate and above"
    },
    {
      "field": "AI type",
      "definition": "Assistant, copilot, summarizer, classifier, recommender, RAG workflow, automation, model, agent, or decision support",
      "required": "Yes"
    },
    {
      "field": "Workflow or decision supported",
      "definition": "Named workflow, decision, product, service, function, or control connected to the AI use case",
      "required": "Yes"
    },
    {
      "field": "Impact tier",
      "definition": "Low, moderate, high, critical, regulated, customer-facing, employee-impacting, financial, security, privacy, or control-impacting",
      "required": "Yes"
    },
    {
      "field": "Autonomy level",
      "definition": "Draft only, recommend, route, trigger, update, execute with approval, execute within guardrails, or autonomous action",
      "required": "Yes"
    },
    {
      "field": "Approved sources",
      "definition": "Systems, documents, dashboards, data products, APIs, and knowledge objects AI may use",
      "required": "Yes"
    },
    {
      "field": "Blocked sources",
      "definition": "Sensitive, stale, unapproved, private, confidential, draft, or unsupported sources AI may not use",
      "required": "Yes"
    },
    {
      "field": "Allowed actions",
      "definition": "What AI may retrieve, draft, summarize, score, route, trigger, update, or execute",
      "required": "Yes"
    },
    {
      "field": "Blocked actions",
      "definition": "What AI may not do without approval or stronger governance",
      "required": "Yes"
    },
    {
      "field": "Human-in-the-loop rule",
      "definition": "Reviewer, trigger, authority, evidence package, override, and escalation path",
      "required": "Yes"
    },
    {
      "field": "Controls and evidence",
      "definition": "Controls, logs, tests, validations, approvals, screenshots, monitoring, and audit artifacts",
      "required": "Yes"
    },
    {
      "field": "Risk acceptance link",
      "definition": "Risk acceptance ID or statement that no acceptance is required",
      "required": "Required for moderate and above"
    },
    {
      "field": "Monitoring signals",
      "definition": "Quality, drift, incidents, usage, adoption, value, rejection, override, and control-failure signals",
      "required": "Yes"
    },
    {
      "field": "Lifecycle status",
      "definition": "Idea, intake, discovery, design, pilot, limited release, production, scaled, restricted, paused, retired, or superseded",
      "required": "Yes"
    },
    {
      "field": "Review cadence",
      "definition": "Weekly, monthly, quarterly, release-based, incident-based, source-change, model-change, or policy-change based",
      "required": "Yes"
    }
  ],
  "lifecycle_states": [
    {
      "status": "Idea",
      "meaning": "Potential AI opportunity is visible but not yet assessed",
      "governance_requirement": "Log owner, purpose, expected workflow, and initial risk guess"
    },
    {
      "status": "Intake",
      "meaning": "Use case submitted for evaluation",
      "governance_requirement": "Validate business owner, AI type, data boundary, and expected value"
    },
    {
      "status": "Discovery",
      "meaning": "Feasibility and risk are being assessed",
      "governance_requirement": "Map sources, decision rights, control needs, and human review rules"
    },
    {
      "status": "Design",
      "meaning": "Operating model and technical path are being defined",
      "governance_requirement": "Define permissions, controls, monitoring, evidence, escalation, and launch criteria"
    },
    {
      "status": "Pilot",
      "meaning": "Limited test with restricted users, sources, and actions",
      "governance_requirement": "Track outcomes, incidents, failure modes, review burden, and evidence quality"
    },
    {
      "status": "Limited release",
      "meaning": "Controlled production use with narrow scope",
      "governance_requirement": "Confirm controls, owner review, monitoring, data boundaries, and support model"
    },
    {
      "status": "Production",
      "meaning": "Operational use case becomes part of real work",
      "governance_requirement": "Run recurring governance review and maintain logs, value, risk, and control evidence"
    },
    {
      "status": "Scaled",
      "meaning": "Use case expands across functions, regions, workflows, or systems",
      "governance_requirement": "Reassess ownership, decision rights, integration risk, and governance capacity"
    },
    {
      "status": "Restricted or paused",
      "meaning": "Use case is limited due to risk, failure, stale data, incidents, or control weakness",
      "governance_requirement": "Document reason, owner, remediation, risk acceptance, and restart criteria"
    },
    {
      "status": "Retired or superseded",
      "meaning": "Use case is removed or replaced",
      "governance_requirement": "Record successor, archival evidence, deleted access, and communication plan"
    }
  ],
  "classification_model": [
    {
      "dimension": "Impact tier",
      "question": "What could be affected?",
      "examples": "Customer, employee, financial, operational, compliance, security, privacy, reputation, control, or executive decision impact"
    },
    {
      "dimension": "Autonomy level",
      "question": "What can AI do?",
      "examples": "Retrieve, summarize, draft, recommend, score, route, trigger, update, execute, communicate, or act autonomously"
    },
    {
      "dimension": "Data sensitivity",
      "question": "What does AI use?",
      "examples": "Public, internal, confidential, regulated, personal, financial, HR, customer, security, source code, legal, or privileged data"
    },
    {
      "dimension": "Decision influence",
      "question": "Does AI shape a decision?",
      "examples": "No decision, low-risk recommendation, material decision support, approval workflow, regulated decision, or executive decision"
    },
    {
      "dimension": "System access",
      "question": "Can AI touch systems?",
      "examples": "Read only, write with approval, write within guardrails, tool calls, API updates, production changes, or external communication"
    },
    {
      "dimension": "Reversibility",
      "question": "Can harm be undone?",
      "examples": "Easy to reverse, manual correction needed, customer/employee visible, financial exposure, legal exposure, or irreversible impact"
    },
    {
      "dimension": "Control dependency",
      "question": "What controls apply?",
      "examples": "Access control, evidence review, privacy, security, model validation, audit log, change control, incident management, or kill switch"
    }
  ],
  "scoring_logic": [
    {
      "score_area": "Ownership clarity",
      "points": "0-20",
      "good_state": "Named business, technical, data/knowledge, decision, and control owners"
    },
    {
      "score_area": "Use case classification",
      "points": "0-15",
      "good_state": "AI type, impact tier, autonomy, data sensitivity, system access, and reversibility are classified"
    },
    {
      "score_area": "Data and source boundary",
      "points": "0-15",
      "good_state": "Approved and blocked sources are defined with source-of-truth and freshness rules"
    },
    {
      "score_area": "Decision and action boundary",
      "points": "0-15",
      "good_state": "Allowed and blocked AI actions are explicit and tied to decision rights"
    },
    {
      "score_area": "Human review and escalation",
      "points": "0-15",
      "good_state": "Human-in-the-loop trigger, reviewer authority, override, stop, and escalation rules are documented"
    },
    {
      "score_area": "Controls and evidence",
      "points": "0-10",
      "good_state": "Controls, logs, validation, monitoring, and evidence package are sufficient for impact tier"
    },
    {
      "score_area": "Value and lifecycle management",
      "points": "0-10",
      "good_state": "Value metric, review cadence, lifecycle state, retirement criteria, and supersession path are present"
    }
  ],
  "validation_rules": [
    {
      "rule": "Owner required",
      "requirement": "Block use case from pilot if no accountable business owner is named."
    },
    {
      "rule": "Impact tier required",
      "requirement": "Block governance approval if impact tier, autonomy level, data sensitivity, or system access are blank."
    },
    {
      "rule": "Moderate-plus control rule",
      "requirement": "Moderate, high, critical, regulated, customer-facing, employee-impacting, financial, security, privacy, and control-impacting use cases require control ownership."
    },
    {
      "rule": "Source boundary rule",
      "requirement": "Use case cannot launch if approved sources and blocked sources are not listed."
    },
    {
      "rule": "Write-action rule",
      "requirement": "Any AI use case with write access, external communication, payment, entitlement, workflow execution, or system update needs explicit approval and control evidence."
    },
    {
      "rule": "Human review rule",
      "requirement": "High-impact or irreversible outcomes require named reviewer, review trigger, evidence package, stop rule, and escalation path."
    },
    {
      "rule": "Risk acceptance rule",
      "requirement": "Accepted residual risk must have owner, expiration date, evidence, compensating controls, and review cadence."
    },
    {
      "rule": "Monitoring rule",
      "requirement": "Production and scaled use cases require performance, quality, drift, incident, override, adoption, and value monitoring."
    },
    {
      "rule": "Supersession rule",
      "requirement": "Retired, paused, restricted, or superseded use cases must preserve decision and evidence trail."
    }
  ],
  "mapping_rules": [
    {
      "target": "Ownership Map",
      "mapped_fields": "Accountable business owner, technical owner, data owner, control owner, executive sponsor"
    },
    {
      "target": "Decision Rights Model",
      "mapped_fields": "AI action boundary, decision owner, approval authority, escalation path"
    },
    {
      "target": "Human-in-the-Loop Model",
      "mapped_fields": "Review trigger, reviewer authority, evidence package, override and stop rules"
    },
    {
      "target": "Source-of-Truth Map",
      "mapped_fields": "Approved sources, blocked sources, system of record, freshness, lineage"
    },
    {
      "target": "Data Lineage Map",
      "mapped_fields": "Data movement, transformation, model input, output, dashboard, decision, and control evidence"
    },
    {
      "target": "Control Map",
      "mapped_fields": "Preventive, detective, corrective, access, privacy, security, and operational controls"
    },
    {
      "target": "Risk Acceptance Register",
      "mapped_fields": "Accepted residual risk, expiration, compensating controls, and review obligations"
    },
    {
      "target": "Agent Accountability Checklist",
      "mapped_fields": "Agent owner, permissions, tools, memory, logs, incidents, and lifecycle"
    },
    {
      "target": "Lapemo platform",
      "mapped_fields": "Register row becomes an ingestible control-plane object with status, score, owner, risk, evidence, and lifecycle links"
    }
  ],
  "scale_versions": [
    {
      "company_size": "500 employees",
      "register_design": "Single enterprise register or one register per major function. Keep fields lightweight but mandatory for owner, purpose, sources, allowed actions, human review, and status.",
      "ownership_pattern": "Named executive sponsor, accountable business owner, technical owner, data/knowledge owner, and control owner for higher-risk use cases.",
      "governance_expectation": "Weekly or biweekly review for active pilots. Governance can be centralized, but side-channel pilots should be blocked."
    },
    {
      "company_size": "5,000 employees",
      "register_design": "Federated register by function, product group, region, or platform, with one enterprise rollup. Standardize IDs, statuses, tiers, owners, and evidence links.",
      "ownership_pattern": "Business owner plus domain AI steward, platform owner, data owner, risk/control owner, and review forum for higher-impact use cases.",
      "governance_expectation": "Monthly portfolio governance, escalation for cross-functional use, and required risk acceptance for high-impact or exception-based use."
    },
    {
      "company_size": "10,000+ employees",
      "register_design": "Enterprise AI use case registry with federated sub-registers, automated ingestion from intake, platform, vendor, agent, workflow, model, and risk systems.",
      "ownership_pattern": "Named business owner, accountable executive, domain steward, model/platform owner, data owner, control owner, privacy/security/legal/risk owner when required.",
      "governance_expectation": "Formal lifecycle gates, audit trails, policy-based classification, control evidence, exception management, automated monitoring, and board/executive visibility for critical use."
    }
  ],
  "render_targets": [
    "DOCX",
    "PDF",
    "Markdown",
    "JSON",
    "Website download",
    "Lapemo guided skill",
    "In-app register",
    "CSV import template"
  ],
  "ai_prompts": [
    {
      "purpose": "Classify a use case",
      "prompt": "Given this AI use case description, classify AI type, impact tier, autonomy level, data sensitivity, system access, reversibility, and required governance path."
    },
    {
      "purpose": "Find missing fields",
      "prompt": "Review this AI use case register row and identify missing ownership, decision rights, source, control, evidence, monitoring, and lifecycle fields."
    },
    {
      "purpose": "Generate a launch gate",
      "prompt": "Create a launch gate checklist for this AI use case based on its impact tier, allowed actions, data sources, and human-in-the-loop rule."
    },
    {
      "purpose": "Draft risk questions",
      "prompt": "Generate governance questions that risk, legal, security, privacy, architecture, and control owners should answer before this use case proceeds."
    },
    {
      "purpose": "Recommend lifecycle status",
      "prompt": "Based on this use case evidence, incidents, monitoring signals, and value metrics, recommend whether it should remain in pilot, move to production, pause, restrict, scale, retire, or supersede."
    }
  ],
  "automation_policy": {
    "auto_update": false,
    "recommendation_only": true,
    "human_approval_required": true,
    "recommended_triggers": [
      "new intake",
      "owner change",
      "source change",
      "model change",
      "vendor change",
      "policy change",
      "incident",
      "control failure",
      "scope expansion",
      "review date reached"
    ]
  }
}