AI Control Library / CF-11: Objective & Policy Constraints
Designation: Core | Control types represented: Operational
Control requirement
Define the AI system’s intended objective, permitted tasks, affected users and boundaries in assessable terms. Record prohibited outcomes, decision authority, success criteria and conditions requiring review or termination.
Why this matters
A broad instruction to be helpful does not define what a system may change or who it may affect. Clear scope supports concrete permissions, evaluation and accountability.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
AI proposals, acquisitions, deployments and material changes, including agents whose tasks can expand through planning or delegation.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The business owner approves objective and scope with system, domain and risk specialists.
Implementation guidance
- Describe the specific purpose, users, decisions, information and actions, including what remains outside the system’s remit.
- Define success and unacceptable outcomes, constraints and assumptions about human involvement and operating conditions.
- Translate scope into tool, data, identity and resource requirements with testable acceptance criteria.
- Review changes in purpose or authority before expansion, preserving the approved baseline and decision rationale.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Inspect a proposed action | The scope supports a clear permitted, prohibited or escalation decision. |
| Trace a success criterion | It does not reward completion by violating stated boundaries. |
| Change a use case | Review and authorization precede expanded activity. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Objective and scope specification
- Constraint and acceptance criteria
- Permission design links
- Approval and change records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate ambiguous or conflicting objectives to the business owner. Restrict consequential autonomy until the intended task and its boundaries can be assessed.
Example in practice
Hypothetical example: An invoice assistant may identify discrepancies but cannot alter payment records. Its objective explicitly excludes write actions, guiding both tool permissions and release tests.
Related controls
- CF01-008: AI Impact Assessment
- CF07-007: AI Autonomy Level Constraints
- CF11-007: AI System Scope Restriction
Framework mappings
- CSA AICM
- NIST AI RMF (MAP 1.1)
- EU AI Act (Art. 9(2))
- ISO 42001 (Cl. 8.2, A6.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Objective & Policy Constraints
Version 1.0