Agentification

Maturity ladder

1. 1

   Governed substrate

   implemented

   Sourced, sensitivity-classified, auditable knowledge with access control.

   Memory + governance core + audit

2. 2

   Governed retrieval & Q&A

   implemented

   Ask questions; cited, confidence-flagged answers; every withholding logged.

   Ask lens + MCP search

3. 3

   Assisted drafting

   current

   The system drafts briefings/notes; a human always approves before use.

   draft_briefing (human-in-loop)

4. 4

   Bounded governed agents

   next

   Agents act through the same governed tools, read + draft only, within explicit policy.

   MCP tool layer (roadmap agents)

5. 5

   Supervised autonomy

   future

   Agents take reversible actions within policy, fully audited, with human override always available.

   roadmap

EU AI Act control map

Each obligation mapped to a mechanism, and to the code that implements it.

• Record-keeping & logging (AI Act Art. 12)

  implemented

  Automatic logging of events for traceability.

  Append-only audit log records every governed access (role, action, returned/withheld ids) with a deterministic sequence.

  src/talaia/governance/audit.py; tests/test_governance.py

• Transparency & information (Art. 13)

  implemented

  Outputs are interpretable and traceable to their basis.

  Every claim carries a source_url + confidence flag; nothing reaches an output unsourced.

  src/talaia/schema.py (Claim); tests/test_contracts.py

• Human oversight (Art. 14)

  implemented

  Humans can oversee and intervene; no unchecked autonomy.

  Read + synthesize + one drafted action that returns a DRAFT for human approval; no autonomous execution.

  src/talaia/intelligence/ask.py (draft_briefing)

• Data & data governance (Art. 10)

  implemented

  Access to data is controlled and appropriate.

  Four-level sensitivity classification + role clearance enforced structurally at retrieval; withholding above clearance.

  src/talaia/governance/policy.py; tests/test_governance.py

• Data minimisation & sovereignty (GDPR)

  implemented

  Minimise data exposure; keep data within the perimeter.

  Local-first, zero network egress at runtime; runs entirely on committed snapshots; docker compose in your perimeter.

  docker-compose.yml; README.md

• Technical documentation (Art. 11)

  implemented

  Design, methodology and limitations are documented.

  DESIGN.md (architecture + methodology + limitations), README, and a test suite as executable spec.

  DESIGN.md; README.md

• Accuracy & robustness (Art. 15)

  partial

  Resilience to errors and adversarial manipulation.

  Deterministic core (no wall clock / randomness) + adversarial tests proving prompt-injection cannot bypass governance.

  tests/test_governance.py; tests/test_mcp_tools.py

• Risk management system (Art. 9)

  partial

  A continuous, documented risk-management process.

  Classification + access policy + audit form the control base; a formal risk register is planned.

  src/talaia/governance/

• Conformity assessment (Art. 43)

  roadmap

  Formal conformity assessment before high-risk deployment.

  Out of scope for a prototype; the controls above are designed to make a future assessment tractable.

  ,