Governance · published rules
The rules, before you ask for them
Plan §14.4 requires the access, retention and prohibited-use rules to be published, and §15.4 requires correction and dispute procedures published before a pilot begins. They are here rather than behind a sales conversation, because a rule you cannot read before you agree to it is not a protection.
What the system will never do
Taken from the prohibited-use policy, which is written to be posted and read on its own:
- No covert recording. Every capture requires prior notice, a visible recording or AI-processing indicator, start-of-capture notice, late-joiner notice, and a recorded consent state. A no-record or facilitator-note mode is always available as an alternative.
- No sentiment, emotion, personality, accent, or productivity scoring. The agent does not analyze tone, mood, personality, accent, speech patterns, talk time, or individual output for evaluation of any person.
- No employment or discipline recommendations. No agent output may recommend, suggest, or support hiring, termination, discipline, demotion, or grievance outcomes. Any such output is a "prohibited employee inference" incident (§6).
- Correction and dispute rights. Every participant may correct an attributed statement, mark "not my statement," challenge a classification, mark a record Disputed (a formal truth state — see §7), and request human review.
- Nonparticipation is not noncooperation. Declining to be recorded, using the no-record closeout, or asking for facilitator-note mode is a protected choice. It is never treated as refusal to cooperate, never recorded as a negative fact about the person, and never reported to supervision as a problem.
- Published rules. Access, retention, and prohibited-use rules (this document plus the retention matrix and access rules) are published to all pilot participants before the first assisted meeting.
How long anything is kept
These periods come from the same catalog the deletion machinery reads, so this table cannot disagree with what the product actually does. Where a period is marked as an open decision, it is a proposal your plant settles — not a default we impose.
| What | Kept for | Counted from |
|---|---|---|
| Audio held only long enough to transcribe | 1 day | meeting end (purged on ingest confirmation, 24 h at most) |
| The original recording of the meeting | 30 days proposed — open decision #7 | facilitator approval of the final record |
| The transcript before anyone has approved it | 30 days | supersession by the approved transcript |
| The transcript a facilitator approved | 3 years proposed — open decision #8 | facilitator approval |
| Decisions, actions, questions and risks | 3 years proposed — open decision #8 | facilitator approval |
| Anything attached to a record | 1 year | deletion or expiry of the last referencing record |
| Files attached to prove an action was done | 3 years | linked action reaching Closed or withdrawn (§9.5) |
| Diagnostic traces of the extraction step | 90 days | trace creation (rolling) |
| Who changed what, and when | 7 years | event creation |
| Who consented to what, and when | Kept with the record it belongs to | retained with and as long as the parent meeting record (§14.3) |
| Plant vocabulary the system learns | Kept with the record it belongs to | superseded, never deleted; retired entries keep their supersession history |
Correcting or disputing the record
Every participant may correct a statement attributed to them, mark one “not my statement”, challenge how it was classified, mark a record Disputed — a formal truth state that travels with the record into the minutes rather than being resolved away — and ask for human review. Dissent is preserved verbatim next to the decision it concerns.
Declining to be recorded is a protected choice. It is never treated as refusal to cooperate, never recorded as a negative fact about the person, and never reported to supervision.
Who can see what
Access is deny-by-default and role-based: a role that holds no grant for an operation cannot perform it, and the check is code rather than model judgement. A read-only viewer never sees a draft record. Only the meeting's designated approver can approve it, and an approval that is revoked takes with it everything it produced.
The full matrix is in the design-partner governance pack, along with the data-classification, threat-model and official-record boundary documents. It is sent on request — ask for it and you get all ten documents, not a summary.
What this is not
Not a safety system, not a compliance-certification system, not an emergency-alert system, and not an official record. It never controls equipment and never writes to another system — that is architecture, not policy. The official-record boundary matrix states, record type by record type, where it stops and your records begin.