01
Purpose and minimization
Collect and retain information because it supports a defined operational purpose, not simply because the technology can.
02
Access and accountability
Design permissions, role boundaries, auditability and human oversight around how the organization actually works.
03
Security and ownership
Consider hosting, integration security, data movement, continuity and organizational control as design decisions.
04
Responsible AI
Ground AI in approved information, appropriate permissions, clear review and accountable use.
Controls explorer
Make responsibility visible in the design.
Inspect the controls that surround a fictional information workflow.
01 — Purpose
Collect only what supports a defined operational purpose.
Explore related work