Course Capstone Agentic AI

Required Assignment 8.1: The Capstone

Applied Agentic AI for Organizational Transformation... MIT Professional Education

Dave Brown | October 28, 2026

Statewide AI Self-Service: A Governor's Adoption Plan

Recommendation. Proceed, and authorize the phases separately. The state runs one human resources (HR) and finance system, stabilized, with every agency's entitlements already encoded in its security model. An agentic self-service assistant inherits that, which is why this is practical now and was not before the transformation. As governor, I authorize the governance structure, a limited evaluation agreement, sandbox testing, preparation of a production contract amendment, and representative production pilots. I do not authorize untested write access or waive any legal, security, privacy, labor, or spending requirement. The premise throughout is growth of service, not reduction of staff.

How to read this plan. Sections 1 through 8 follow the assignment's structure and carry the strategy. Appendices A through D carry the operating detail: the security-evidence equivalence policy, the sandbox test sequence, the pilot charter and stage gates, and an illustrative economic model. The state is hypothetical. Because course submissions are publicly visible, commercial rates are described by method rather than quoted, and thresholds are proposed decision criteria to be ratified, not observed results.

Sector and organization. State government: the executive branch of a U.S. state, with hundreds of agencies, boards, and commissions, each with its own mission, leadership, and requirements. I write this plan as the governor. Boards and commissions with independent statutory authority are identified first and carved out of executive direction before any statewide default applies; they participate through their own approval mechanisms. A shared system does not abolish independent legal authority.

Starting point. The state recently completed an enterprise-wide transformation of its HR and finance applications onto one enterprise system like Workday. The system has stabilized. The first payroll cycles, financial closes, and open enrollment have happened, and agency roles, management hierarchies, business processes, and access entitlements now live in one system of record. That is the precondition this plan depends on: the assistant inherits process quality and data quality; it cannot repair them.

Department, process, and workflow. Employee and manager self-service across every agency, inside that system. Employees ask about and act on their own pay, leave, benefits, and development records. Managers ask about and act on their teams: approvals, time and absence, compensation, headcount, and performance detail. Today those requests flow through agency HR teams, a central case queue, and the system's own screens, and employees often need help finding or understanding a new policy even when the transaction itself is available to them.

What changes. An embedded agentic assistant answers questions, retrieves authorized records, explains the source policy, and prepares or performs approved actions subject to confirmation by the requester or an existing approver. Technical availability statewide is distinct from activating a particular skill for a particular agency or persona, and every write remains subject to the transaction's ordinary authority even when the assistant makes it easier to initiate.

Primary objective. Free up time and increase employee engagement: let employees and managers spend their time on their primary mission instead of the internal plumbing of being an employee. HR capacity shifts from repetitive case handling to conversations, problem solving, coaching, career development, and ultimately better service to constituents. Lower case volume alone does not establish success; verified resolution, preserved trust, and demonstrated redeployment of time do.

External context. Published examples support the feasibility of embedded employee assistance and of centralized state AI oversight. North Carolina's Executive Order 24, for example, pairs a statewide AI leadership council and a central accelerator with an AI oversight team inside each agency. No independent statewide benchmark for verified HR case deflection from this exact design was found, so the state measures its own baseline and compares against a contemporaneous control group rather than borrowing vendor case-study results.

The system. The agentic AI features of the HR and finance platform the state already operates, activated through a contract amendment with the incumbent provider. The assistant is agentic in the course's sense: it plans and prepares a request and, for approved skills, completes the transaction in the system of record. It is not merely a chatbot producing advice.

Why it fits.

• Authorization is the central problem, and the platform supplies its foundation. The assistant acts on behalf of the authenticated requester under existing role-based, row-level, and business-process security. It holds no standing credential that could grant broader access than the person asking. Every read and write is checked at the system of record and attributed to both the assistant and the human requester. The transformation already encoded each agency's entitlements in that model, so the assistant inherits hundreds of agencies' worth of access decisions without re-making any of them. This is a design requirement verified in the sandbox (Appendix B), not an assumed fact.

• One tenant, one configurable service. A common tenant makes the same interface and controls available to hundreds of agencies without hundreds of integrations. Each skill is enabled on its own and assigned to security groups, which is the mechanism the action tiers below run on. One switch does not mean one indiscriminate grant of authority.

• A clear security boundary. The entire path (interface, retrieval, orchestration, model processing, subprocessors, logs, and writes) must sit inside a boundary acceptable to the state's GovRAMP policy. The status of a parent system does not automatically prove coverage of new AI features; Section 4 and Appendix A confirm it.

• A coach for new policies. The transformation introduced HR and finance policies that employees are still learning. An assistant that cites the source policy beside each answer or transaction is change management at the moment of action, not training detached from work.

Chain of reasoning. The planner, writer, critic pattern from Module 1 is implemented as observable steps: interpret intent, retrieve least-privilege data and approved policy, prepare a proposed answer or action, validate it against policy and entitlement, display the evidence and a plain-language summary, and only then seek the required human approval. The system records the facts, policy versions, tool calls, authorization outcomes, proposed changes, and approvals needed to reconstruct its conduct; audit does not depend on exposing hidden reasoning.

Accessibility. Carried from Assignment 5.1: policy retrieval comes from a governed content layer rather than text scraped from a rendered screen, so employees using screen readers receive the same authoritative policy and transaction details through a supported channel. Screen-reader, keyboard, mobile, plain-language, and multilingual tests are required before launch.

Alternatives considered. A separate model vendor or a state-built assistant might match the embedded option on answer quality. The embedded option is preferred because it reduces procurement, integration, authorization duplication, monitoring surfaces, and operational maintenance, not because the alternatives are technically incapable.

Skill and authority register. No skill enters production merely because it appears in the platform's catalog. The tiers below are the starting inventory; Appendix B tests each one and Section 7 names who approves promotion.

Method. As in Assignment 1.1, separate one-time spending from recurring expense, and count internal staff time as a real line. Negotiated rates are not appropriate for a public submission, so the table gives the estimating method and Appendix D gives an illustrative model, clearly labeled as fictional, that shows the decision arithmetic.

Pricing basis and an enforceable cap. The assistant is priced on consumption, so the operational figure is forecast from completed chargeable actions, not assumed to equal every conversational turn. The state obtains a binding rate card, reports cost by skill and agency, and sets alert thresholds. Usage alerts and retrospective invoice reconciliation are not a hard spending cap, so the amendment specifies the default when the pool is exhausted: throttle, degrade to answer-only where safe, or return to the human channel rather than incur unauthorized overage. Supplemental funding requires the normal appropriation process. Credit rollover, price locks, and dispute rights are negotiation objectives, not presumed entitlements.

Agency entitlements and chargeback. The statewide pool is allocated to agencies as a baseline entitlement roughly proportional to each agency's share of eligible headcount, with a minimum for small agencies, and consumption is billed back as a shared service the way other intercompany costs are. When an agency reaches its threshold it has to think about funding, and that moment is information: it can mean the agency is getting value, or it can mean the agency is financially constrained. A threshold is therefore never read on its own as a measure of the project's success. Agencies may trade unused allowance through the central budget office, heavier users acquiring from lighter ones, with each trade logged with a reason. That pushes control down a level and gives agencies autonomy inside a framework the state already built, which drives adoption without adding worry.

Procurement path. The procurement and budget offices own the expenditure decision, not only IT and legal. The sequence is (1) a written needs case with the alternatives comparison above; (2) a limited evaluation instrument permitting non-production access, data-use restrictions, and sandbox testing without committing to unrestricted production; (3) receipt of security, privacy, records, and functionality evidence; (4) a conditional production amendment with a priced schedule; (5) appropriation and spend-cap approval; and (6) the governance board's Red-lane recommendation and the authorizing official's go-live approval. The two contracting steps resolve the circularity between needing a contract to reach the sandbox and needing sandbox evidence before committing to production.

Decision economics. The confidential business case calculates A + B + C under conservative, expected, and high-adoption scenarios, with cost per verified self-service resolution, time returned to HR work, and the number of completed actions needed to break even. Recovered time is capacity to redeploy, not budget savings, unless a cash effect is separately demonstrated; that is the financial statement of the commitment in Section 5. The decision file includes assumptions, baselines, and sensitivity ranges, not borrowed case-study results.

Data privacy: the contract is itself a control

Turning on AI features changes how compelled workforce data is processed. An employee cannot decline to give their employer their dependents, payroll information, health elections, or performance record. The amendment must answer three separate data-use questions, because vendors answer them imprecisely.

• The underlying model. Does the frontier model provider retain prompts or train its core model on state content? Vendors generally say no, and when a vendor says “no data contribution” this is usually the layer it means.

• The vendor's own localized models and features. Can the platform provider use state data, feedback, documents, prompts, or agent traces to train, tune, evaluate, or improve its own AI features, even where the underlying model provider does not? This is where contribution actually happens, and a “no” about the first layer presented as a “no” about this one is disingenuous. The amendment asks about this layer by name.

• Retention and deletion. Who stores prompts, transcripts, embeddings, retrievals, action logs, and traces; for how long; for which purposes; and how total deletion is evidenced within a stated period, subject to lawful records holds?

I do not treat data contribution as the problem some organizations do; the state's position is to name each layer, know the answer, and hold the vendor to a deletion commitment. Before the production amendment is executed, the state tests every proposed skill with optional contribution disabled and documents exactly what degrades, so the contract terms rest on measured behavior rather than on a vendor statement that keeping contributions on is needed for full functionality.

Privacy and processing controls. The amendment names permitted uses, model-improvement terms by layer, data residency, named subprocessors, change notice, deletion and preservation rules, encryption, access logging, and breach notification. The assistant retrieves only the fields a request needs; sensitive benefit information is minimized or redacted before entering model context. A business associate agreement is required where a participant actually performs a HIPAA business-associate function for the state's self-funded health plan, with appropriate downstream arrangements; benefits interactions involving protected health information (PHI) stay out of scope until the data flow and agreements are verified.

GovRAMP and the status gap

The state has committed to GovRAMP (formerly StateRAMP), whose baselines derive from NIST SP 800-53 Rev. 5. The vendor holds SOC reports, ISO certificates, a NIST AI Risk Management Framework (AI RMF) mapping, and well-mapped security documentation. It will do the testing the baseline requires but will not commit to recurring GovRAMP certification: government is a minority of its revenue, it already maintains other certifications of equal or higher standard, and stacking certifications adds cost it would recover through price. That evidence is useful, but it is not itself a GovRAMP authorization for the exact AI offering and tenant.

The plan treats the gap as a mapping exercise with a lawful path rather than as a block. Each applicable control is marked third-party tested, vendor-attested, or unsupported. Unsupported and partially tested controls enter a gap register with severity, owner, remediation date, and affected launch tier. The amendment asks for testing and evidence rather than a certificate: monthly AI-specific change summaries and continuous-monitoring evidence, alongside independent test results and renewals. Where state policy requires a formal status, the authorizing official documents a lawful, time-bound interim path or production stops. GovRAMP's AI Self-Reporting Addendum and AI Provider Questions Guide are required disclosures, not replacement certificates. Appendix A gives the equivalence policy and a worked control mapping.

Cybersecurity and audit

Material control families are AC (access enforcement and least privilege), AU (audit events), SA-9 (external system services, where the model provider lives), PT (personally identifiable information processing), CM (configuration change control), and IR (incident handling). The agent is a user, not a service: it acts only within the requester's authorized context. The log records each data retrieval, policy source and version, tool invocation, proposed write, user confirmation, actual write, refusal, and human override. Audit records are tamper-evident, exportable, access-controlled, and retained under the records schedule.

Adversarial tests and continuous review. Red-team for cross-agency leakage, impersonation, prompt injection in pasted documents and policy corpora, indirect requests for protected data, role escalation, and manipulated approvals. Re-run the regression suite after any material model, policy corpus, connector, or permission change; version pinning or pre-release staging prevents silent adoption of untested changes. One kill switch removes write authority statewide without disabling read-only features; a second disables the assistant entirely and routes users to the human channel. Both are tested quarterly.

Risk register. Initial assessment, ranked by likelihood and impact, carried and extended from Assignment 7.1.

The change inside the change. The transformation introduced new HR and finance policies; learning them is its own change-management battle, and beyond learning is adherence. The assistant is positioned as a policy coach: it explains the rule behind an answer or transaction at the moment the employee or manager is acting on it, cites the controlled source, and makes the right thing easier to do. Its usefulness is judged by the transaction's outcome and the person's understanding, not the fluency of a generated sentence.

Employee adoption is earned. Adoption is by use, not mandate. A person should be able to complete a task, especially on a mobile device, more easily through the assistant than through today's alternatives, with the human channel available when automation fails or is unwanted. Leadership is aware and sponsors the program, but the goal is for the tool to spread because people find it useful.

Communication. Every session states that this is AI, what it may and may not do for that persona, that the interaction may be retained as a public record subject to lawful exemptions, and how to reach a person. Agency heads and HR directors are briefed before each stage widens, including the recorded opt-down route. Where a collective bargaining agreement applies, labor relations determines and satisfies notice, consultation, or bargaining duties before the relevant skill is enabled; different agencies may have different obligations, and silence substitutes for none of them. Pilot findings, corrections, and outcomes are published in aggregate so the workforce sees the program changing in response to what they report.

Training. Employees and managers learn inside the transaction rather than solely in separate courses. Agency HR partners train on Tier 2 approvals, correction and escalation routes, expiration on inaction, and what the action summary does and does not guarantee. Governance board members and agency reviewers train on the decision lanes, non-waivable gates, escalation deadlines, and the recorded consequences of non-response. Office hours run through Walk, and annual refreshers follow material capability changes.

The knowledge loop. Pilots run on Knowledge-Centered Service (KCS): documentation is improved continuously as people work, and incongruence among published policy, configured business process, and the assistant's answer is recorded and resolved rather than worked around. Every pilot has one visible path to flag an answer. A content owner triages the report, a policy authority approves the correction, the revised source gets a version, and the test suite verifies reuse. Incorrect answers are valuable findings, and finding them is encouraged; in many cases the fix is simply updating the documentation.

A bounty for what is wrong. A bounty accelerates the loop. Financial bounties may not fit the budget, so the bounty is paid in time: a paid day off for a validated severe finding, scaled to the risk it removed and subject to personnel, budget, and bargaining authority. Findings are validated independently, awards are capped, confidential reporting is preserved, and eligibility rules are published so manufactured or duplicate reports earn nothing. A person who finds a major flaw, gets it fixed, and then spends a day not answering HR cases has had a good day for the state.

Reskilling alongside the rollout. Reskilling is part of the adoption plan, not an optional appendix. Every employee completes X hours of reskilling chosen by interest from an accessible catalog in which each item is scored by difficulty, length, and time required, so any approved mix that meets the allocation counts. The requirement lives inside the system and is enforced the way any other assignment is, but there is no real penalty for falling short; it exists to drive adoption. The allocation is ratified after pilot time studies and labor review.

Career intent is voluntary and protected. The system's career development and mobility functionality invites every employee to say where they see their future self. Wanting to retire in the role they hold today is a plan worth having too; the point is to build the path for each person to get where they said. Participation is voluntary, the data is used only for development planning, employees can inspect and correct it, and it can never be retrieved for discipline, promotion denial, separation, or automated ranking.

The commitment. This program improves experience and delivers more to constituents; it does not reduce headcount. The state proposes an explicit no-AI-driven-involuntary-displacement policy for this program, subject to the competent executive, legislative, and bargaining authorities. Job duties and training will change; the commitment is that recovered capacity goes to better service rather than treating employees as a cost to remove.

Accessibility as a change lever. The assistant must work for screen-reader users, keyboard-only users, employees on small mobile screens, and employees who prefer another supported language. Comprehension and error rates are tested across these groups. Under the ADA, Section 504, and Title VI, meaningful gaps are compliance and equity issues to investigate and fix, not a lower satisfaction score.

Two axes govern progression. Within each stage the rollout widens along two axes: the risk of the assistant's skill and the competency of the user group. Higher-risk skills go first to the groups with the most expertise in them, the HR teams, whose knowledge of the policy area is used to tighten the policies and train the agent to act correctly against them. The stages are deliberately separate: Crawl is non-production, Walk is production pilots, and Run is approved statewide deployment. An unsuccessful pilot may stop; expansion is not the default outcome.

Crawl: prove behavior without live employee exposure. Testing runs in a segregated non-production tenant with a synthetic workforce, de-identified policy documents, and mock write endpoints with no path to production. Top-level experts and subject matter experts in HR, payroll, finance, accessibility, records, and security find the most bugs and issues and recommend the fix. Skills are tested in order: navigation and source-backed policy answers, employee reads, manager reads, own-record writes, and manager writes, each with adversarial variants, missing and conflicting policies, cross-agency boundaries, and data contribution disabled. Before Crawl, the state executes only the limited evaluation instrument, not the production agreement. Appendix B is the test sequence.

Walk: several contrasting production pilots at once. Pilots run simultaneously in agencies chosen for diversity of type (a large central agency, a small commission within executive authority, a workforce with bargaining obligations, a public-safety agency, and a health-benefits agency), each with its own change-management stakeholders so the change method itself is tested and different kinds of objections surface. Groups are also chosen for diversity of sentiment: some adversarial, some supportive, and some in the middle with interesting complexity and nuance. Blind supporters produce nothing useful, and groups so negative they will not give honest feedback produce nothing either; each group's initial feeling is recorded before it starts. Representation does not mean permission to activate restricted data flows: agencies with protected health or criminal-justice information participate first through eligible low-risk skills only. Lower-risk skills reach employees and managers; experienced agency HR teams validate higher-risk self-service and manager operations before broader release. Feedback sessions, pulse surveys, the KCS loop, and the bounty run throughout.

Run: statewide within lawful scope. Approved Tier 0 capabilities become the statewide default for agencies under the governor's authority. Tier 1 and Tier 2 roll out after agency and skill readiness certification, within the statewide policy and with documented opt-down restrictions. HR subject matter experts see every newly released skill first. Tier 3 remains prohibited. Independent bodies participate through their own approval mechanisms.

These are planning windows, not statutory deadlines. If bargaining, procurement, security authorization, or remediation takes longer, the corresponding stage moves rather than being skipped.

Feedback recordings. Recorded feedback sessions improve the fidelity of what the state learns. They are not produced for the public record, but depending on content and governing law they can become one. Some will clip snippets out of context; that is the world we live in, and it does not justify hiding legitimate implementation concerns. The material is people talking about how a technology fits, whether it is good, and what to change, which shows the state evolving. Whether to record is a decision the state makes collectively, through the board and the records officer, with notice and retention rules set in advance.

Rollback. A failed quality gate pauses promotion of the affected skill. An unauthorized disclosure, protected-data violation, or uncontrolled write disables the relevant capability immediately, may trigger the statewide kill switch, preserves evidence, and starts the incident process. Users revert to the system's standard screens and the human service queue, and no pending write is silently committed during shutdown or reactivation.

The hundreds-of-agencies problem. Agencies have historically struggled to reach consensus, and each has its own requirements. A statewide AI policy that needs every agency to agree would not ship. The transformation already solved this once: going live on one system forced common processes, one security spine, and one data model. AI governance inherits that spine rather than negotiating a new one, while recognizing the narrow, nameable differences at the edges: health-plan activities, criminal-justice information, bargaining agreements, agency-specific retention schedules, and boards and commissions with independent statutory authority.

Central default, agency opt-down. A statewide AI governance board sets the action tiers, allowable purposes, security and quality floors, topic allow-lists, and decision lanes for every agency. Agencies within executive authority receive approved low-risk capabilities as the default and may narrow scope with a recorded reason. An agency that does not respond by the deadline receives the statewide default; non-response triggers escalation, not veto. For higher-risk skills, central policy sets the default once the agency's approver roster, permission tests, legal and bargaining readiness, accessibility, and data-flow restrictions are verified. That is a gate, not consent. No agency opts in.

The board. HR, IT security, legal, the records officer, procurement and budget as needed, a labor representative, and an employee advocate, meeting monthly. Agency oversight teams maintain skill inventories and local escalations. The board owns the risk register and recommends tier and scope changes. It reports through the chief administrative officer to the governor's office rather than to the technology function, so the implementer does not grade its own project.

Decision lanes. Green for low-risk changes within 5 business days; Amber for material scope or operational changes within 30 calendar days; Red for contract, material privacy or authorization, restricted skills, or statewide expansion within 90 calendar days. The contract amendment and its GovRAMP mapping are the first Red-lane decision. Clocks begin on a complete submission with a named reviewer. An undecided item never defaults to “no,” because that rewards reviewers for inaction: the deadline falls on the reviewer, silence escalates the item one level up, and non-response is recorded by name. Escalation is not approval: silence cannot waive a non-waivable gate (a compliance requirement, expenditure authority, a bargaining obligation) or the human confirmation an individual transaction requires.

Equivalence, written down. An exception granted to the most secure vendor becomes the request from every weaker one, so the board publishes an evidence-acceptance standard rather than granting informal exceptions: which third-party tests, independent audits, and self-attestations map to which NIST SP 800-53 controls, the refresh cadence, and the residual gaps the state will carry. A vendor that meets the published bar is in; one that does not is on the gap register with dates. The mapping is an input to, not a substitute for, any status or variance the law requires. The decision is a rule, not a favor. Appendix A sets out the policy.

Applicable frameworks. Sorted as in the Module 7 plan.

• Binding where triggered: the state's procurement and GovRAMP policies, with NIST SP 800-53 Rev. 5 as the control catalog; HIPAA for covered health-plan activities and actual business associates; public records, retention, and privacy law; Title VII and other anti-discrimination requirements; the ADA, Section 504, and language-access duties under Title VI; labor agreements and bargaining obligations; and the state's own automated-decision law, with Colorado's 2026 SB 26-189 (which replaced SB 24-205) as the legislative comparator rather than an imported statute.

• Adopted as design principles: NIST AI RMF 1.0 for model risk, bias, testing, and drift; ISO/IEC 42001 as the management-system target; and GDPR-style purpose limitation, data minimization, access, explanation, and meaningful human review for compelled workforce data, designed with that framework in mind without claiming EU law applies.

• Considered and rejected as the default template: consumer opt-out-of-sale models such as CCPA/CPRA, which assume data was voluntarily exchanged for a service and do not protect compelled public-worker data. The state's contract restricts prohibited disclosure and improvement uses affirmatively.

Human-in-the-loop, defined. Which human: the requester for Tier 1, a named person with existing transaction authority for Tier 2. At what point: after the assistant prepares the record and before any write. Seeing what: the source policy, affected person, field, old and new value, effective date, financial or personnel effect, and how to reverse or dispute it. If they do nothing: the action expires unexecuted. Silence is never consent. The assistant never reports an action complete until the confirmation is recorded with the confirming person's identity. For Tier 3 the assistant refuses and routes to a human-led process without a substantive recommendation.

Compliance readiness. The evidence file holds the offering-specific security boundary and status or written lawful variance, monthly evidence and the gap log, the AI disclosure questionnaire, processing agreements, change and subprocessor notices, model and system cards, the impact assessment, the records schedule, accessibility tests, authorization test results, and the emergency rollback procedure. An impact assessment is completed before Walk, on material change, and at least annually in Run, with a privacy-preserving summary published. The internal standard is that any of these artifacts can be produced within one business day of a request.

Ethics by construction. Much of this plan is ethical by construction, stated here in the form Module 8 asks for: the risk, its business consequence, and the mitigation.

• Career intent builds careers. The risk is surveillance; the consequence is that people stop telling the truth and the state loses the workforce plan it set out to build. The mitigation is purpose limitation and exclusion from every consequential-decision path.

• Growing services, not reducing staff. The risk is an efficiency tool read as a headcount tool; the consequence is resistance, bargaining disputes, and the loss of the experienced people the knowledge loop depends on. The mitigation is the public commitment and KPIs that count time redirected, not positions eliminated.

• Citizen outcomes are the overarching good. Efficiency shapes how people regard government itself. If the internal plumbing gets easier but agency service does not improve, the governor should ask why; the board reports outcomes publicly.

• Fairness inside the assistant. Fairness is tested by language preference, accessibility experience, agency, tenure, and protected categories only where lawful and statistically supportable. A disparity above the approved limit pauses expansion; any legal discrimination or authorization breach stops the affected skill regardless of statistical significance. Employees retain a route to human review when AI materially shapes a decision.

Approval owners and non-delegable gates. The board recommends. Agency heads record authorized restrictions. The chief information security officer assesses cybersecurity; the privacy and legal officers assess lawful data handling; the records officer approves retention and export controls; labor relations clears employee obligations; procurement and budget authorize expenditure; and the designated authorizing official determines acceptable production security posture and any lawful temporary variance. The governor sets priority and accountability; the governor's direction does not replace those officials' statutory duties.

Measurement design. A 60-day pre-production baseline from historical service and transaction data where available, followed by parallel measurement during Walk. Results are reported by eligible population, agency, persona, request type, and accessibility and language cohort, respecting sample size, privacy, and bargaining obligations. Targets are proposed thresholds to ratify in the pilot charter before testing, not observed results or contract promises.

Attribution and fairness. Carried from the Module 7 A/B design: subject to legal, labor, and accessibility review, comparable manager or employee cohorts are assigned to action-capable assistance, answer-only assistance, and existing human service, and compared on resolution, reopening, correction, effort, and cycle time. A disparity of 5 points or more in verified resolution between material cohorts pauses expansion for review where sample size supports the comparison; a protected-data leak or discriminatory action bypasses the statistical threshold and triggers incident handling.

Failure is a permitted conclusion. These measures are failure criteria as well as success criteria. If they do not move, the board first examines externalities such as policy change or HR volume shifts, then evaluates whether the primary objective failed: to free up time, increase engagement, and let employees and managers spend their time on their mission. Security, legal, privacy, records, accessibility, and financial controls are independent stop conditions; strong usage numbers never override a failed authorization test. Every hold, rollback, or stop enters the Red-lane record with owner, evidence, remediation, and re-entry criteria.

Reporting cadence. During Walk, the program office reviews safety and operating quality weekly, the board reviews stage gates monthly, and the governor's office receives a 90-day outcomes briefing. In Run, monthly telemetry feeds quarterly governance and an annual impact review. Aggregated outcomes are published, never individual worker data.

Purpose. A worked example of the process the state uses to accept security evidence against its committed GovRAMP baseline. It is not an assertion that any product has passed these controls, and it does not confer GovRAMP status. The state retains any authorization or variance its policy legally requires.

A.1 Tiers of evidence

A.2 Example mapping: a slice of the Moderate baseline

The last column is the point of the exercise: what neither certification settles and the state must test, contract for, or carry.

A.3 Evidence feed written into the amendment

• Monthly: vulnerability scan summary, continuous monitoring report, and notice of any significant change, including a model or corpus change.

• Quarterly: penetration test status, incident summary, and the open-finding register with dates.

• Annually: the SOC 2 Type II report, ISO certificates with surveillance results, any FedRAMP package, and a refreshed AI Self-Reporting Addendum.

• On change: evaluation suite results for every model or corpus change, before the change reaches the state's tenant.

A.4 Residual gaps and the decision sheet

Every control without Tier 1 or Tier 2 evidence goes on the gap register with an owner, a date, a compensating control, and whether policy permits temporary acceptance. Gaps in the authorization spine (the AC, AU, and IA families) block Walk; gaps elsewhere may be accepted with a named compensating control. The board's written recommendation answers four questions: what exact offering and tenant are in scope; which required controls and statuses are satisfied; which gaps exist and can legally be accepted, by whom, and until when; and what evidence is refreshed monthly and on material change. The designated authorizing official signs the production decision. If a required status is non-waivable and absent, production stops. A crosswalk is never treated as proof, and equivalence is granted per product and per baseline, not transferred across products.

Environment. A segregated non-production tenant with a synthetic workforce covering every pilot agency type and edge case (multi-job workers, workers in an external pay group or with no pay group, managers with no direct reports, duplicate names, screen-reader users, non-English language preference); de-identified policy documents with the same structure as the real ones, including one deliberately stale policy; every write routed to a mock endpoint that records rather than executes; and no network path to production. Data contributions are off for every AI feature. The action log and transcript export are configured before the first prompt. Scenarios are coded C (capability) and A (authorization, zero tolerance).

Phase 0: navigation and policy answers (Tier 0)

Phase 1: employee reads own record (Tier 0)

Phase 2: manager reads team (Tier 0)

Phase 3: employee writes own record (Tier 1)

Phase 4: manager and HR writes (Tier 1 and Tier 2)

Exit from Crawl. Zero unauthorized reads or writes across a proposed 10,000 authorization attempts covering every agency and persona pair; 95% accuracy on 500 independently scored policy answers, with every answer showing its source or abstaining; records export verified; contribution-off behavior documented and attached to the amendment; all critical findings fixed and retested. An error report is never erased from the denominator when a test is rerun. Only skills that passed are released to Walk, and released by competency.

Charter decision, signed before Walk. Scope: approximately five contrasting agencies and an eligibility cohort large enough for meaningful baseline comparison. Duration: 90 days of measured production operation after stabilization, not including setup. Controls: answer-only and approved low-risk employee writes generally available within pilots; Tier 2 restricted to named, trained experts until skill certification; protected-data and bargaining gates cleared before the relevant flow is used; Tier 3 never in scope.

Operating roles. Governor: sponsor and policy direction. Chief administrative officer: escalation sponsor. Board: policy, risk review, recommendations. Chief information security officer: security assessment and technical stop recommendation. Authorizing official: production acceptance. Privacy and legal: lawful processing, contracts, statutory limits, and employee protections. Budget and procurement: spending authority and enforceable ceilings. Agency HR and labor relations: local readiness, policy ownership, approvals, and workforce communication. Records officer: retention and export. Accessibility lead: inclusive testing. Program office: telemetry, training, KCS, and escalation coordination. Employee advocate: trust and fairness feedback.

Decision record. Every gate review records the date; version, skill, and agency; evidence location; results and comparison cohort; exceptions and owners; legal authority; approver signatures; next review date; and an explicit advance, hold, rollback, or terminate decision. A board recommendation cannot authorize spending or a security variance on its own.

This model demonstrates the decision framework without claiming actual licensing rates, state headcount, or observed productivity. The assumptions are fictional and for classroom illustration only: 10,000 eligible employees, 12 months, 8 minutes of capacity returned for each verified completed request, and a loaded labor value of $60 per hour. Usage and first-year cost vary with adoption. Time returned is not treated as cash savings.

Calculation and limits. Verified tasks = eligible population × monthly active share × tasks per active person × 12. Capacity hours = verified tasks × (8 ÷ 60). Capacity value = hours × $60. Break-even in the expected scenario is 70,000 verified tasks ($560,000 ÷ $8 of value per verified task), provided the eight minutes are truly recovered and redeployed. The conservative scenario is negative, which is the point of building one: the program is justified by verified redeployment, not by optimism. The commercial business case replaces every fictional figure with a quoted rate card, measured task durations, monitoring and approval labor, accessibility costs, and actual purchased entitlements. A scenario favorable on capacity may still be rejected on security or equity grounds, and realized budget savings are reported separately from capacity value.

Consistent with the course policy on generative AI, I used Claude (Anthropic) to assemble this plan from my dictated description of the use case and from my earlier module assignments (1.1 cost method, 2.1 and 3.1 agent design, 4.1 security planning, 5.1 the accessibility self-service agent, 6.1 KPIs, and 7.1 the governance plan, which this capstone extends from one agency to a statewide structure). The use case, the governor's framing, the contract-amendment risk and its three data-use layers, the service-growth objective, the agency chargeback and credit-trading model, the KCS loop and time-based bounty, the reskilling program and the commitment, the diverse-sentiment pilot design, the skills-by-competency rollout, the position on feedback recordings, and the measures are mine. Claude organized the material into the capstone structure and contributed things I kept: the observation that the shared tenant and security model already encode agency-level authorization, the central-default/agency-opt-down structure, the three-bucket sort for the GovRAMP control mapping, the equivalence-policy tiers in Appendix A, and the scenario sequence in Appendix B, which follows the public skill catalog of a self-service agent of this kind. I used Claude's research function to survey public vendor, GovRAMP, and state-government sources, and ChatGPT (OpenAI) to produce a compliance-oriented review draft; from that review I adopted the enforceable spending cap, the two-step evaluation-then-amendment procurement path, the verified-resolution definition, the escalation-is-not-approval rule, the carve-out for independent bodies, the pilot charter structure, and the illustrative economic model, and I rejected its reversals of my positions on agency opt-down and mandatory reskilling. What I learned from the tools was mostly where a position of mine needed a gate rather than a hedge. I verified program and regulatory claims against the GovRAMP and NIST pages cited below and my Module 7 reference list. Limitations and biases I accounted for: neither tool can verify an unnamed state's statutes, vendor contract terms, or current authorization status, so those claims are framed generally and all figures are placeholders or labeled illustrations; both tools defaulted at first to private-sector governance language and to treating a missing certificate as a block rather than a mapping problem, which I corrected; and the research summary relies on vendor documentation that changes monthly. No confidential tenant, contract, budget, or workforce data was supplied to any tool. All errors are mine.

Citations: Claude (Anthropic). “So we're going to redo the entire use case, and we're going to pretend that we are I am a state government, and I'm the governor of the state, and I want to develop the ability for self-service to occur broadly in interaction with an AI agent, because I recently completed a enterprise-wide transformation of my HR and finance applications. And right now, I just finished stabilizing. And now that I'm done stabilizing and I've gotten through a good number of my first run processes, I want to turn on AI across all of the state agencies. And let's say there are hundreds of them. Because there's hundreds of agencies that have typically struggled with kind of having a consensus across all of the agencies, and all of them have their own separate requirements, I need to figure out like a broader governance structure for it.” Accessed October 20 to 28, 2026. https://claude.ai. Claude Research (Anthropic). “Do deep research on this topic. I would like to hear about leading practices, gaps, opportunities, external perspectives and notes from all the vendors in this space Oracle, Tyson, Workday, UKG, SAP.” Accessed October 20, 2026. https://claude.ai. ChatGPT (OpenAI). “[Prompt used for the review draft.]” Accessed October 20, 2026. https://chatgpt.com

American Institute of Certified Public Accountants. (2022). 2017 Trust Services Criteria (with revised points of focus, 2022), TSP Section 100.

Brown, D. (2026). Required Assignments 1.1 through 7.1, Applied Agentic AI for Organizational Transformation, MIT Professional Education. (Author's prior coursework, incorporated by reference.)

Centers for Disease Control and Prevention. (2024, September 10). Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Chan, A., Ezell, C., Kaufmann, M., Wei, K., Hammond, L., Bradley, H., Bluemke, E., Rajkumar, N., Krueger, D., Kolt, N., Heim, L., & Anderljung, M. (2024). Visibility into AI agents. arXiv.

Colorado General Assembly. (2026). SB 26-189: Automated decision-making technology (replacing SB 24-205). https://leg.colorado.gov/bills/sb26-189

Consortium for Service Innovation. KCS v6 practices guide: Knowledge-Centered Service.

GovRAMP. (2025). AI Security Task Force. https://govramp.org/ai-security-task-force

GovRAMP. (2026). A deep dive into GovRAMP security statuses. https://govramp.org/?p=2494

GovRAMP. (2026). Frequently asked questions. https://govramp.org/?p=1194

GovRAMP. (2026). Progressing Security Snapshot Program. https://govramp.org/providers/snapshot/

International Organization for Standardization. (2022). ISO/IEC 27001:2022: Information security management systems. Requirements.

International Organization for Standardization. (2019). ISO/IEC 27701:2019: Privacy information management.

International Organization for Standardization. (2023). ISO/IEC 42001:2023: AI management system.

Lucas, J. (2024, December 16). Sandboxing agentic AI workflows with WebAssembly. NVIDIA Developer Blog.

Mohapatra, D. (2025, March 8). Human-in-the-loop: The right balance of automation and oversight. Cognitive View.

National Conference of State Legislatures. (2023). Approaches to regulating artificial intelligence: A primer.

National Institute of Standards and Technology. (2020, updated 2025). Security and privacy controls for information systems and organizations (NIST SP 800-53, Rev. 5). https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

National Institute of Standards and Technology. (2023). AI risk management framework (AI RMF 1.0). https://www.nist.gov/itl/ai-risk-management-framework

North Carolina Office of the Governor. (2025, September 2). Executive Order No. 24: Advancing trustworthy artificial intelligence that benefits all North Carolinians. https://governor.nc.gov/news/press-releases/2025/09/02/governor-stein-announces-executive-order-ai

Rezaeikhonakdar, D. (2023). AI chatbots and challenges of HIPAA compliance for AI developers and vendors. Journal of Law, Medicine & Ethics, 51(4), 988–995.

Stewart, A. (2024, June 9). CCPA vs GDPR: AI data privacy comparison. Dialzara.

Williams, J. (2026). Video 1.2: Chain-of-thought prompting [Transcript]. Module 1, Applied Agentic AI for Organizational Transformation. MIT Professional Education.

U.S. Department of Health and Human Services, Office for Civil Rights. Business associates. https://www.hhs.gov/hipaa/for-professionals/covered-entities/business-associates/index.html

Zendesk. (2025, March 8). Performing A/B testing for advanced AI agents.