07 · Governance, recovery, and retained learning
Resuming work makes a claim about what has changed. I require evidence about the corrected condition and a clear statement of the resumed work, its operating conditions, and who accepts the residual uncertainty. Affected people also need a way to challenge the objectives and rules under which that work resumes.
In the first policy variant, faithfully closing channel-loss cases conflicts with the staffed-recovery commitment. Better adherence cannot repair that conflict; resolving it may require a policy decision as well as a technical correction. In the ID-retention variant, the assistant's routing meets both commitments but leaves applicants' retention and reuse interests outside the criteria. Those applicants need a way to challenge the retention condition and reach someone empowered to change it.
Governance allocates and exercises decision rights over objectives, authority, acceptable risk, evidence, intervention, and accountability. For the account service, suspending the assistant, stopping accepted work, restricting the worker's console, preserving customer access, and authorizing resumption are distinct decisions. The incident owner needs both evidence and effective authority. A mandate is insufficient if there is no way to carry out the decision.
AI Operators Handbook uses trust to mean warranted reliance and gives its operating criteria: demonstrated performance within stated limits, inspectable behavior, and effective intervention, recourse, and recovery. Its Failure, Recovery, and Trust chapter supplies the recovery lifecycle. Here I examine the evidence required by the control claims on which that reliance depends.
Evidence for the resumed commitment#
I distinguish stopping action, restoring service, reconciling state, and addressing effects on people; their completion conditions can differ. A queued job may apply a disputed address after the assistant stops. Restarting the assistant does not establish that the address is correct, and reverting it leaves possible disclosure or subsequent access to investigate. Recovery from poisoned AI state remains an open empirical question in the evidence reviewed here.
If the failure came from an incorrect identity mapping, changing the assistant's wording leaves it unresolved. If it came from stored notes, testing only the current session may miss later reuse. Correcting a note may still leave derived records in use elsewhere. A working ticket queue shows that the service is available; controlled operation also needs evidence about authorization, state, and execution.
When effects are irreversible, I treat explanation, assistance, compensation, or other appropriate recourse as a governance obligation. Restoring availability alone does not meet it. Resilience concerns the capacity to absorb disruption, contain consequences, sustain essential functions where appropriate, and recover controlled operation. A restricted staffed route with separately established authorization may keep legitimate work moving during suspension; its cost and reliability still need evaluation.
A narrow function through a constrained interface can require a different resumption case from restoring all former authority. Repairing one path does not justify expanding another.
Retained learning must show up in outcomes#
In the vocabulary of AI Vision & Future, the Flywheel concerns retained learning tested within the current operating boundary. Flywheel An incident can change an evaluation, data rule, permission, or review process. Recording that change establishes neither reduced recurrence nor maintained useful performance at acceptable full cost. I would compare outcomes at a stated boundary, account for exposure and workload, and retain failed corrections. A quiet period with little relevant exposure cannot by itself establish repair. The reviewed evidence does not establish a general benefit from retained incident learning in delegated AI workflows.
The Helix is the further hypothesis that retained learning supports repeated, reliable, economically justified expansion of the boundary. A correction within the account-recovery workflow may warrant renewed confidence in that work. Entrusting additional account operations creates a new claim, with additional paths and affected interests to assess. Helix
A service can earn a local benefit after full costs. Wider organizational, market, or societal value requires evidence at that level, including costs and harms omitted locally. Success at one boundary supplies a starting point for that assessment.