Learning objectives
By the end of this module, you will be able to:
- Identify governance evidence VCP can help produce
- Separate integrity and audit features from a claim of legal compliance
- Design authorship, attestation, deployment, monitoring, and revocation responsibilities
- Specify a real human-review path for escalated decisions
Compliance boundary: VCP is technical infrastructure. It does not certify a system, determine whether a system falls within the EU AI Act high-risk category, replace legal analysis, or prove compliance with the EU AI Act or sector-specific law.
9.1 — Evidence mapping, not compliance automation
The EU AI Act contains separate obligations for risk management, technical documentation, record keeping, transparency and information to deployers, and human oversight. Start from the legal text that applies and from your organization's role under it, such as provider or deployer. A VCP control may contribute evidence to that wider program:
| Governance concern | Possible VCP contribution | What remains outside VCP |
|---|---|---|
| Risk management | Versioned constitutions, enforcement decisions from a fixed set (allow, block, modify, escalate), and reviewable failure codes | Hazard identification, testing metrics, lifecycle review, residual-risk decisions, and accountable ownership |
| Record keeping | Verification and privacy-filter event logs that store salted hashes, not raw session, bundle, or issuer identifiers | Required event coverage, retention period, access control, data protection, and evidential integrity of the complete system |
| Transparency | Bundle identity, provenance, scope, verification outcome, and visible active-context summaries | Complete instructions for use, performance limits, foreseeable misuse, and role-specific disclosures |
| Human oversight | An ESCALATE policy outcome and contextual evidence | Staffing, authority, interface design, response time, training, reviewer independence, and the final decision process |
| Technical documentation | Schemas, conformance vectors, compatibility declarations, and signed bundle metadata | The full system description, data governance, evaluation evidence, change control, and conformity documentation |
Use the official Regulation (EU) 2024/1689 text and qualified counsel for the applicable interpretation.
9.2 — Constitutional governance workflow
- Scope: identify the system, purpose, users, jurisdictions, foreseeable misuse, and actions the constitution will govern
- Draft: affected stakeholders author values, constraints, refusal boundaries, and exceptions in plain language
- Review: legal, safety, technical, accessibility, privacy, operational, and affected-community reviewers record their decisions
- Test: evaluate positive, negative, ambiguous, adversarial, stale, revoked, and degraded-operation cases
- Attest: authorized issuers and auditors sign only the claims they actually reviewed
- Deploy: publish an exact bundle and trust configuration through a controlled release process
- Monitor: review verification failures, enforcement outcomes, user appeals, incidents, drift, and context-sharing evidence
- Revise or revoke: retire unsafe or obsolete bundles and preserve the decision record
9.3 — Attestation policy
The maintained SDK recognizes four attestation types: INJECTION_SAFE, CONTENT_SAFE, FULL_AUDIT, and COMPETENCE_CALIBRATION. Define what evidence is required
before an authorized auditor may assert each type. Only INJECTION_SAFE and FULL_AUDIT let a bundle pass
SDK 4.2.0 verification for use in a prompt.
| Policy area | Required decision |
|---|---|
| Authority | Who may issue, audit, approve, publish, suspend, and revoke a bundle? |
| Independence | When must issuer and auditor be distinct people or organizations? |
| Claim scope | Which tests and documents support each attestation type, version, environment, and audience? |
| Freshness | How long may an attestation remain valid and which changes invalidate it? |
| Revocation | Which incidents, key compromises, evidence changes, or legal changes trigger suspension or revocation? |
| Appeal | How can affected people challenge an enforcement outcome or underlying constitutional rule? |
9.4 — Human oversight is an operational system
The Python enforcer supports an ESCALATE decision type, but
the current SDK has no escalation handler, so the enforcer turns every
escalation into a block. A plugin's ESCALATE decision stays
in the result, and the application must route it to human review itself. A
production human-review path needs:
- A named queue owner and service-level objective appropriate to the risk
- Evidence minimization and role-based access to sensitive context
- Reviewer authority to uphold, modify, or reject the proposed action
- A safe timeout behavior that cannot silently become fail-open
- Reason capture, appeal, audit, and feedback into constitutional revision
- Tests showing the end-to-end route works during normal operation and outages
9.5 — Bilateral governance
Bilateral governance applies bilateral alignment to oversight, so AI agents as well as people have standing to raise concerns. VCP's relational extension (a draft) can carry that feedback in auditable form. Testimony tokens, which let an AI instance sign its own report, come from the superseded v2.0 draft and are not part of v3.1; SDK 4.2.0 defines only their type names. The VCP-X-Welfare extension could too, but it is experimental and SDK 4.2.0 does not implement it. Treat feedback as evidence for accountable deliberation, preserve uncertainty, and avoid granting an automated report authority it does not have.
Cryptographic signatures establish integrity and provenance relative to configured trust anchors. They do not establish that a rule is wise, lawful, humane, complete, or correctly enforced by every downstream system.
Exercise
Choose one high-impact action in your system. Write the exact VCP evidence, non-VCP controls, accountable owners, human-review path, retention rule, and test evidence required before deployment.
See it in action
The Noor demo shows a school district turning written rules into hooks for an AI homework tool, including escalation to a teacher and a redacted log for teacher review. It is a pre-scripted replay, not a certification or legal compliance assessment.