Sensitive Activity
Actions that might introduce risk—the hinge between definition layers and measurement layers.
Role
Layer 4 names the activity being governed. Definitions above (guidance, controls, policy) describe what good looks like; measurements below (evaluation, enforcement, audit) inspect instances of the activity. In Ten Factor terms, this is where Factor I’s sensitive activity meets Factor II’s Governance Twin: the activity is the shared identity of implementation and governance.
Examples
Employee FOSS contribution
Writing open source software and attempting to contribute it from within the organisation—across company-moderated, company-interest and personal contexts. Catalogs and logs organise around that activity: registration, review, merge gates and quarterly audit all refer to contribution instances, not to “GitHub” in the abstract.
Source: Worked FOSS contribution activity in the FOSS Contribution Policy programme (foss-contribution-policy).
Mortgage approval in a lending platform
Approving or declining a mortgage application is the sensitive activity. The Governance Twin binds fair-lending guidance, controls and policy to that decision; evaluation and enforcement attach to each approval instance.
Source: Worked illustration in Build a Governance Twin (Approve Mortgage).
AI-generated credit recommendation
Producing a credit recommendation from a model is the activity. Principles such as least exposure and auditability, plus bias and explainability controls, govern that recommendation—not the ML platform as a whole.
Source: Worked illustration in Build a Governance Twin, oriented by AIR-PRIN principles such as Least Exposure and Auditability.
Links upstream
Links downstream
- Evaluation Log inspects instances
- Enforcement Log acts on those results
- Audit Log reviews programme conformance
Anti-patterns
Naming a platform instead of an activity
“Lending platform” or “AI stack” as the Layer 4 object. You cannot say which decision was governed.
Activity with no definition above it
A named activity that no guidance, control or policy attaches to. Measurement then has nothing to evaluate against.