| Owner | Jonny Allum |
| Version | 1.0 · Effective 13/07/2026 · Review annually (July), and on any change to what data reaches a model |
| Applies to | JonnyAI (the embedded assistant), JAIOS, model backends, AI use in agency work |
AI is the product's differentiator — an "AI-native" business earns that label by governing the AI better than anyone, not just by shipping it.
1. Architecture of trust (the seam)
- One platform Anthropic key; tenants never bring their own. Plans meter AI actions; top-up packs extend them. The backend is selected by environment (
anthropic | ollama | jaios | local) behind a single contract. - Deterministic engines are the source of truth. The model rewrites and narrates; it never recomputes. Every AI answer is grounded in the module's own engine output, and every backend degrades gracefully to the local deterministic fallback — a confused or unreachable model never beats the engine and never throws into the ask path.
2. Human in the loop
- Every executable AI action carries a user confirm step. No exceptions, including future actions. Actions bind to the active tenant and are capability-checked.
- The Monday-morning digest and module signals are read-only summaries. Anything that writes goes through the action registry and its confirm step.
3. Data minimisation to models
Signal providers send compact structured signals — counts, renewal bands (expired/30/60/90/ok), byStatus maps, one named worst item — never row dumps. Care-vertical narratives (V07 wellness summaries) pass structured signals with the deterministic composition as contract and fallback. Before widening what any provider sends, a short DPIA is written (POL-02 §6).
4. Tenant transparency
- Tenants are told, in plain language (docs + DPA), that Anthropic is a subprocessor for AI features, what shape of data is sent (signals, not rows), and that their data is not used to train models.
- AI-composed content that staff act on (wellness summaries, tax explanations) records its provenance — "JonnyAI · model" vs "Composed (rules engine)" — so a reader always knows which they are looking at.
5. Prohibited AI uses
- Autonomous execution of destructive or financial actions without confirm.
- Sending tenant personal data to any model or AI tool outside the governed platform seam (includes pasting into external chatbots).
- Presenting AI output as professional advice — tax, clinical and safeguarding narratives are decision *support*, clearly labelled.
6. The HMRC red line
Tax modules (H01–H10) are draft/simulated only. Nothing in the platform calls a real HMRC endpoint; submission workflows are human-approval-gated (H04) and stamp synthetic references. Removing this restriction is a board-level decision (i.e. a deliberate, documented, researched change with professional advice — never a side effect of a feature PR).
7. Agency use of AI
AI-assisted delivery (code, copy, design, video) is permitted and is the business model — with operator review before anything ships, no client confidential material in tools that train on inputs, and honesty with clients about the AI-native way of working (it is the pitch, not a secret).