← Control library
G01 · Governance and scope
Named accountability
No one can accept residual risk or keep the agent within its approved use.
Requirement
Name an accountable owner, technical operator and independent decision reviewer; the implementer must not certify their own work.
Expected evidence
- Signed role matrix with decision rights.
- Conflict declarations and reviewer competence record.
Proposed verification
- Interview the named roles against one incident scenario.
- Confirm the final reviewer did not implement the assessed controls.
Limit
A role chart proves assignment, not effective day-to-day oversight.