The Chain of Custody: A Decision-Level Model for AI Governance

Abstract

Organisations governing AI accumulate controls by accretion, producing a set whose shape nobody can describe: it is unclear where a new control belongs, how strong an existing one is, or what is missing. This paper offers a decomposition along an axis that existing frameworks do not use. Rather than decomposing the system into layers, it decomposes a governed decision into the successive re-statements it passes through — declaration, request, proposal, display, comprehension evidence, authorising response, disposition — and asks which hand-off each control attaches to. Two claims follow. First, we argue that placement bounds what a control can establish: a control on one hand-off establishes nothing about the others, which makes several common assurance over-claims into locatable category errors rather than matters of degree. Second, display integrity and recorded comprehension evidence are consecutive and non-substitutable control positions; a system may prove that the correct thing was shown while establishing nothing about whether it was taken in. The model is conceptual and prescribes no implementation. Conceptual model / position paper; not empirically validated.