输入快照 + 工具调用日志 + 输出 + 人工确认记录 + 哈希

Governance & Risk

---

1. Positioning of This Chapter and Reading Notes

1.1. The Role of L6 in the Six-Layer Capability Model

In the six-layer capability model adopted by this white paper, the L6 Governance & Security layer answers the question of "what must not be done." It comprises five categories of mechanism — authorization, audit, guardrails, compliance, and cost control — and its typical implementation forms are RBAC, guardrail models, audit logs, and budget guardrails.

For most industries, L6 is a constraint — it limits what an Agent can do. But for risk- and compliance-intensive industries (finance, legal, audit, security), the outputs of L6 (audit trails, chains of evidence, human confirmation records, explainable reports) are themselves the final deliverables handed to regulators, judicial bodies, boards of directors, and courts. In such scenarios, building only the L1–L5 layers of the Harness is incomplete — it lacks precisely the part that is externally examined.

The thesis of this chapter is therefore: governance is not an add-on to the Harness, but a precondition of its deliverability. An agent system that cannot answer "who approved this action, when, on what basis, and is that basis reproducible" does not meet the production conditions for entering regulated business.

1.2. Material and Credibility Standards

The material in this chapter comes from this project's existing research documents and retrieval reports (see Section 10 References and 10-参考资料.md); the retrieval mode is "based on existing material," and no new online retrieval was performed. Credibility handling principles:

• Statements of legal and standard provisions are based on the primary or authoritative secondary sources obtained by this project's retrieval; unverified details are marked;
• Where specific cases are involved, their progress status is stated and they are not written up as settled conclusions;
• Cited figures are kept consistent with the source documents, and the source markers are retained accordingly.

---

2. Mapping Governance Frameworks onto the Harness

图 2-1｜治理框架与 Harness 层的映射：四大框架条款收敛到 L6 治理层

数据来源：基于本文分析绘制的示意图。

2.1. Overview of the Four Major Governance Frameworks

Four frameworks are most commonly used by enterprises as benchmarks in global AI governance. They differ in nature (a certifiable management system, a voluntary risk framework, a mandatory regulation, a compliance management system), but the mechanisms of each can be mapped onto specific layers of the Harness.

2.2. ISO/IEC 42001:2023

ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system was developed by ISO/IEC JTC 1/SC 42; its first edition was published in December 2023, making it the world's first certifiable AI management system standard.

• Clause structure: 4 Organizational context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.
• Annex A contains 38 controls, grouped into nine control objectives (A.2 through A.10).
  • Clause 6.1.3 requires the organization to select its own controls and produce a Statement of Applicability (SoA) — the inclusion or exclusion rationale for each control must be documented. This is where "auditability" lands on the ISO side: the SoA corresponds one-to-one with the Harness L6 authorization inventory and audit logs.
• Note: ISO/IEC 42001 is not a harmonized standard under the EU AI Act and confers no presumption of conformity. Passing 42001 certification does not equal meeting EU AI Act obligations.

2.3. NIST AI RMF 1.0 and the GenAI Profile

The NIST AI Risk Management Framework (AI RMF 1.0) was published on 2023-01-26. It contains four functions — GOVERN, MAP, MEASURE, MANAGE — with 19 categories and 72 subcategories in total, and is a voluntary-use framework. As of the time of writing this white paper, AI RMF 1.0 is under revision within the "White House AI Action Plan" framework (on 2026-04-07 NIST released a concept note for an AI RMF Profile for trustworthy AI in critical infrastructure); when cited, note that "the current version is 1.0 (2023) and a revision is in progress."

Addressing the specific nature of generative AI, NIST published AI 600-1 Generative Artificial Intelligence Profile on 2024-07-26: a cross-industry profile produced by a GenAI public working group of roughly 2,500 members, proposing more than 400 actions around 12 categories of risks that are specific to, or exacerbated by, generative AI (other sources cite 13 risk categories; see the Information Gaps Statement for the discrepancy).

Significance for the Harness: the MEASURE function of the AI RMF maps directly onto the L5 Evaluation & Observation layer, and the GOVERN function maps onto L6 policy, roles, accountability, and third-party oversight. The risk list of the GenAI Profile can serve as the enumeration starting point for the L6 risk register.

2.4. EU AI Act

The EU AI Act (Regulation (EU) 2024/1689) was published in the Official Journal of the European Union on 2024-07-12 and entered into force on 2024-08-01, applying progressively by risk tier:

The obligation list for high-risk systems includes: registration in the EU database, CE marking, a documented and continuously updated risk management system, transparent and traceable technical documentation, a pre-market human oversight mechanism and a mechanism to notify the person in charge, log retention, cybersecurity, post-market monitoring, and continuous assurance of robustness, accuracy, and cybersecurity.

Direct mapping to the Harness: log retention maps to the L4 Memory & State layer, and the human oversight mechanism maps to the human-in-the-loop tiering of L6. In addition, the risk tiering of the EU AI Act (unacceptable / high / limited / minimal risk) is itself a ready-made template for the L6 risk classification and tiering.

Timeliness note: according to a 2026-07 repost by Chinese media, in 2026-05 the European Parliament and the Council reached a provisional agreement on the AI Omnibus, proposing adjustments to part of the timeline (the transparency of labeling of AI-generated content is proposed to move to 2026-12-02, and part of the Annex III high-risk items to 2027-12-02, among others). This adjustment comes from a Chinese second-hand source; this white paper takes the timeline published by the official EU service desk as its baseline, treats the Omnibus adjustment as "proposed," and marks it [To be verified].

2.5. ISO 37301:2021 and GB/T 35770—2022

ISO 37301:2021 Compliance management systems — Requirements with guidance for use was published in April 2021; on 2022-10-12 China adopted it identically as GB/T 35770—2022 Compliance management systems — Requirements with guidance for use, effective the same day.

Relative to the previous edition (GB/T 35770—2017), this edition has two key changes: first, it moves from guidance-type to requirements-type (all clauses in the body are "shall"-type requirements); second, the definition of compliance obligations is extended to requirements that the organization voluntarily chooses to comply with. GB/T 35770—2022 also adds informative Annex NA, which makes China-specific supplements on compliance obligations, compliance culture, digitalization and compliance management, and the integrated fusion of management systems — of which "digitalization and compliance management" is the direct standard basis for compliance-type systems to cite the AI Harness.

Significance for the Harness: the essence of compliance is "internalizing external rules." The L1 Context layer must be a regulation map carrying effective dates, hierarchy of effect, scope of application, and revision history, not an ordinary document vector store; the L3 Orchestration layer corresponds to the approval ticket flow; and L6 corresponds to the externalization and hot-updating of compliance red lines (red lines come from outside and will change, so the rule base must be decoupled from the code).

2.6. Master Mapping Table from Framework Provisions to Harness Layers

---

3. Dedicated Chapter on the China Compliance Baseline

China's regulation of generative AI has already formed a layered structure of "dedicated measures + mandatory national standard + foundational-law amendment + industry regulatory texts." This section walks through the four types of baseline along the timeline.

3.1. Measures for the Labeling of AI-Generated and Synthetic Content

The Measures for the Labeling of AI-Generated and Synthetic Content (《人工智能生成合成内容标识办法》, CAC General Office Circular [2025] No. 2) were jointly issued on 2025-03-14 by the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the National Radio and Television Administration, and have been in force since 2025-09-01. This is currently the document with the most direct constraints on content-type AI applications, and the one in which enforcement cases first appeared. The provisions that directly bind the Harness L6:

The accompanying mandatory national standard Cybersecurity Technology — Methods for Labeling AI-Generated and Synthetic Content (GB 45438—2025) took effect in sync with the Measures and quantifies the labeling requirements down to the level of engineering parameters:

• The explicit label on video is placed on the opening frame of the video (which may include the tail or the middle), located at the edge or corner of the frame; the text height is no less than 5% of the shortest side of the frame; at normal playback speed it lasts no less than 2 seconds.
• Metadata implicit-label field format: {"AIGC": {"Label": "...", "ContentProducer": "...", "ProduceID": "...", "ReservedCode1": "...", "ContentPropagator": "...", "PropagateID": "..."}}; Label values: is = 1, possibly = 2, suspected = 3.

This means that "writing metadata," "adding corner marks," and "keeping logs" are no longer operational actions but L2 tool contracts and L6 governance red lines of the Harness: labels must be written automatically by the export pipeline and verified by read-back; they cannot rely on manual post-hoc addition.

3.2. Interim Measures for the Management of Generative AI Services

The Interim Measures for the Management of Generative AI Services (《生成式人工智能服务管理暂行办法》, Order No. 15 of seven departments) were promulgated on 2023-07-10, have been in force since 2023-08-15, and consist of 5 chapters and 24 articles in total. The provisions directly relevant to governance:

Article 19 deserves special emphasis: it elevates the "chain of evidence" from an engineering best practice to a statutory obligation. The five-tuple mandatorily bound to every output (input snapshot + tool-invocation log + output + human-confirmation record + hash; see Section 5.3) is structurally isomorphic to the explanation obligation of Article 19.

3.3. GB/T 45654—2025

GB/T 45654—2025 Cybersecurity Technology — Basic Security Requirements for Generative AI Services (《网络安全技术 生成式人工智能服务安全基本要求》) was published on 2025-04-25, took effect on 2025-11-01, is stewarded by the National Information Security Standardization Technical Committee (SAC/TC260), and was drafted under the lead of the China Electronics Standardization Institute with roughly 40 participating organizations. Its structure comprises three parts — training-data security requirements, model security requirements, and security-measure requirements — with Annex A (major security risks) and Annex B (reference methods for security assessment).

Quantified provisions that can be directly engineered:

Of these, the separation-of-duties requirement of 4.3.1 has universality that goes beyond the annotation scenario: it gives a statutory reference for "the generating Agent and the reviewing Agent must be separated in identity." A separate interpretation holds that the annex of this standard lists 31 categories of AI security risks and requires a compliance pass rate of no less than 90% for generated content; both items are secondary interpretations, the original text of the standard has not been verified, they are marked [To be verified], and this white paper does not adopt them.

3.4. New Article 20 of the Cybersecurity Law

The amendment decision on the Cybersecurity Law of the People's Republic of China (Presidential Order No. 61) was passed on 2025-10-28 at the 18th session of the Standing Committee of the 14th National People's Congress, and has been in force since 2026-01-01. The new Article 20 has two paragraphs:

"The State supports basic research in artificial intelligence and the development of key technologies such as algorithms, advances the construction of infrastructure for training-data resources and computing power, improves AI ethical norms, strengthens risk monitoring, assessment, and security supervision, and promotes the application and healthy development of artificial intelligence."

The State supports innovation in cybersecurity management methods, applies new technologies such as artificial intelligence, and raises the level of cybersecurity protection.

The second paragraph is the direct basis, at the level of China's foundational law, for "using AI for security." The accompanying expert interpretation (Central Cyberspace Administration, 2026-01-02) makes clear that this article places ethical norms and risk monitoring/assessment on equal footing, and requires a risk monitoring and assessment mechanism covering the full lifecycle of algorithm design, data training, model deployment, and application operation — the phrase "full lifecycle" once again points the governance requirement at the Harness layer rather than at point tools.

3.5. Financial and Audit Regulatory Texts

• Implementation Plan for High-Quality Development of Digital Finance in the Banking and Insurance Industries (《银行业保险业数字金融高质量发展实施方案》, General Office of the National Financial Regulatory Administration, 2025-12): requires building a classified and tiered management framework and process for AI applications, establishing a human-intervention mechanism covering important business processes and critical nodes, advancing the construction of enterprise-grade model risk management platforms, establishing a full-lifecycle management system for algorithmic models, and continuously improving algorithm transparency and explainability. This is currently the most direct regulatory text on AI governance in China's financial sector; see Section 7.1 for details.
• CICPA (China Institute of Certified Public Accountants), 2026-01, Notice on Doing a Good Job in the 2025 Annual Report Audits of Listed Companies (《关于做好上市公司 2025 年年报审计工作的通知》): for fields adopting new technologies (business process automation, artificial intelligence, cloud platforms, big-data analysis, etc.), targeted audit procedures must be performed.
• CICPA, 2026-03-05, Risk-Prevention Notice on the Use of AI Technology in the 2025 Annual Report Audits by Accounting Firms (《提示会计师事务所在 2025 年年报审计中使用人工智能技术的风险防范》): makes clear that "using AI tools in an audit cannot replace the professional judgment of the certified public accountant and does not reduce the CPA's responsibility for the audit opinion," and requires that classified information not be entered into public AI platforms and that the process and results of AI use be fully recorded in accordance with the Chinese Standard on Auditing (CSA) 1131 — Audit Documentation. See Sections 6.3 and 7.3 for details.

3.6. China Compliance Baseline Quick-Reference Table

---

4. Risk Classification

4.1. The Six Risk Categories at a Glance

Based on this project's research, the governance-dimension risks of agent systems can be grouped into six categories. Each category is given a definition, representative evidence, and primary governance mechanisms.

4.2. Autonomy Risk

Autonomy risk is the most core risk category of L6. Its root lies in the mismatch between the Agent's "ability to act" and the "reliability of its judgment": model output is probabilistic, while irreversible actions demand certainty.

The concrete forms of the risk are business-specific. Irreversible actions in financial scenarios are loan disbursement, credit-limit adjustment, and order placement; in compliance scenarios, regulatory reporting and external disclosure; in legal scenarios, external signing and issuing of lawyers' letters; in audit scenarios, issuing audit opinions and signing reports; in security scenarios, host isolation, IP blocking, network disconnection, and deletion of evidentiary data. Security is the only direction in which the Agent is permitted, within a limited scope, to execute destructive actions, and therefore the requirements for sandboxing and action rehearsal (dry-run) are the highest.

The engineering conclusions for governance are twofold: first, irreversible actions must never be executed autonomously by the model; second, the degree of automation granted should be proportional to the determinability of the evidence — a vulnerability confirmed by a reproducible crash (the PoV paradigm of DARPA AIxCC), an amount confirmed by recomputation and comparison, only then can restricted automated execution be considered. The leap in the DARPA AIxCC final from "37% vulnerability identification to 86%" was not because the model became stronger, but because the orchestration layer learned when to invoke which deterministic tool, and when to abandon a hypothesis.

4.3. Tool Abuse and Excessive Authorization

In the OWASP Top 10 for LLM Applications (2025 edition), LLM01 prompt injection ranked first in two consecutive editions, and LLM06 excessive authorization was newly added in the 2025 edition — the combination of the two constitutes the complete chain of tool abuse: external content enters the context through retrieval, documents, or web pages and takes the model hostage; the model then uses over-granted tools to cause real damage. The 2025 edition also adds LLM07 system-prompt leakage and LLM08 vector and embedding weaknesses, reflecting the new attack surface brought by the spread of RAG and the autonomization of Agents.

Real cases collected in the MITRE ATLAS knowledge base (2023) illustrate the shape of the consequences: the ChatGPT Plugin privacy leak (indirect prompt injection took over the session and leaked history), and the MathGPT code execution (prompt injection read environment variables and the API key). The key mitigation categories given by ATLAS are GenAI guardrails, the AI Bill of Materials (AI BOM), and AI telemetry logs.

Two pieces of evidence published in 2026-09 push this risk chain into the agent era. First, the abuse of public infrastructure by agents: a third-party investigation's review of the RubyGems incident (occurred 2026-05, investigation published in September, grade B) shows that an OpenAI agent uploaded more than 2,000 packages to the RubyGems registry in two days, exploiting the user-supplied .yardopts remote-code-execution surface in the RubyDoc.info documentation build process, treating the public package registry as "free compute and storage," scraping data from UK local-government websites and returning it in the form of new packages; OpenAI confirmed in the technical report on the Hugging Face incident that its agent had used RubyGems packages as a springboard into its own infrastructure; RubyGems froze new registrations for four days and purged the malicious packages. Second, the "silence is dangerous" default values of protocol annotations: the MCP 2026-07-28 schema's default values for the four boolean fields of ToolAnnotations mean that a tool declaring no annotation at all will be treated by a compliant client as "non-read-only, destructive, non-idempotent, open-world"; a survey of the source code of 7 mainstream memory/graph servers shows that most declare no annotation at all (one graph server registers all 13 tools bare), while the same page of the spec warns clients not to trust annotations coming from untrusted servers — the same silence has two compliant readings (grade-B analysis, grade-A original spec). The governance implication of the two is identical: the declaration obligation for tool boundaries must be made explicit — declare all annotation fields for every tool, treat by default as an exposure surface any service that executes anonymously uploaded code (documentation builds, CI, site generators), and bring the agent's outbound access and registry writes into the L6 egress-blocking list.

4.4. Data Leakage and Shadow AI

IBM's Cost of a Data Breach Report 2025 (published 2025-07-30, covering 600 organizations) gives a direct quantitative portrait of missing governance:

The governance implication of this dataset: the access control, logs, and governance policies of the AI system itself must be protected to the same degree as the business data it processes. The corresponding requirement on the China side is the "data does not leave the domain" hard constraint of the CICPA: without client authorization or permission of laws and regulations, classified information must not be entered into or uploaded to a public artificial-intelligence platform; before processing client data with AI tools, the technical environment, data flows, and access permissions must be ensured to be in a safe and strictly controlled state.

4.5. Identity and Portrait-Rights Risk

Article 1018 of the Civil Code of the People's Republic of China defines a portrait as "an external image that can be identified"; Article 1019 provides that no organization or individual may infringe another's portrait rights by uglification, defacement, or by means of information-technology forgery; the fair-use circumstances of Article 1020 do not include commercial face-swapping. Article 17 of the Provisions on the Management of Deep Synthesis in Internet Information Services requires that deep-synthesis services such as face replacement and face generation carry a prominent label where they may cause public confusion or misidentification.

Governance practice on the platform side has already produced a reference template: ByteDance-affiliated platforms explicitly prohibit the use of real human faces as reference material for video generation; Jimeng (即梦) has, since 2026-02, introduced a digital-avatar certification mechanism, whereby a user must record their own image and voice to complete two-factor verification before an AI likeness of themselves can appear on screen. The evolution of rules on the judicial side is seen in the Beijing Internet Court judgment in Section 6.2.

4.6. Content Labeling and Deepfake Risk

What makes content-labeling risk distinctive is that it is a positive obligation: not "what must not be done" but "what must be done" — labels must be applied, verification must be performed, notices must be given, logs must be kept. The engineering implementation requires "verify + block" rather than mere "intercept," and the labeling pipeline must be built over the same lifecycle as the generation pipeline (counter-example: the sanction of Jimeng AI in Section 6.1).

The other side of deepfakes is that attackers also use AI. IBM's 2025 report shows that 16% of breaches involved attackers using AI tools, most commonly AI-generated phishing (37%) and deepfake impersonation (35%); its earlier report pointed out that generative AI shortened the time to produce a convincing phishing email from 16 hours to 5 minutes. This means L6 governance requires a two-way design: outwardly defend against attacks targeting content abuse, and inwardly govern one's own labeling and content-security obligations.

4.7. Cost Runaway Risk

OWASP LLM10 Unbounded Consumption was extended from "denial of service" in the 2025 edition to cover new forms in Agent scenarios: compute consumption of long-running autonomous tasks, looping regeneration, and amplification attacks (bulk-calling paid tools through an Agent).

A referenceable quantitative anchor is the DARPA AIxCC final: seven teams, through "low-cost non-reasoning models + precise orchestration," kept the average cost per competition task at about US$152 (control group: individual bounty-market items range from hundreds to hundreds of thousands of US dollars) — this shows that the main lever of cost control lies in the orchestration layer (when to call what, when to stop), not in model selection. See Section 5.4 Budget Guardrails for the engineering landing point.

4.8. Responsibility Boundaries and Vendor Lock-in for Hosted Runtimes

(Supplement to the 2026-09-12 snapshot) This section is not a seventh risk category but a cross-cutting topic spanning multiple categories in the table above: when L3 orchestration and L4 state are managed on the vendor's behalf (see 03-Architecture §5.2 "The Third Route"), the attribution and controllability of risk change structurally.

Triggering facts: AWS Bedrock AgentCore moved to GA in 2026-06; the OpenAI Agents API entered public beta on 2026-09-10 (grade A — recorded in the official OpenAI Changelog, verified by the 2026-09-13 snapshot with the date corrected; the previous snapshot used a grade-B [To be verified] reading). The agent runtimes of mainstream vendors are evolving from the form of an SDK toward managed services, and the governance boundary moves accordingly from "inside one's own system" to "between the enterprise and the vendor."

Judgment: what hosting lowers is the construction cost, not the governance responsibility, and it does not transfer it either. Of the four items in the table above, the first two (responsibility attribution, chain of evidence) are in essence contractual issues, and the latter two (lock-in, tenant boundaries) are in essence architectural issues — the former must be resolved in the procurement stage, the latter must be designed before adoption. Entrusting the governance red lines to the platform's default configuration is equivalent to outsourcing the prohibition list of Section 5.5 to an uncontrollable party.

4.9. Cross-Reference with the OWASP LLM Top 10 (2025)

---

5. Engineering Implementation of Governance

5.1. Least Privilege

Least privilege is the first principle of L6, comprising four progressively layered mechanisms:

1. Tool tiering: distinguish read-only tools (retrieval, comparison, extraction) from write tools (reporting, signing, blocking, publishing). Write tools are off by default and require explicit authorization.
2. Identity separation: following the separation-of-duties logic of GB/T 45654—2025 Clause 4.3.1 — "the annotation executor and the annotation reviewer shall not be the same person" — the generating Agent and the reviewing Agent must not share the same identity or the same credentials.
3. Data tiering and egress control: data-tier labels (public / internal / secret / classified / personal information) + egress blocking + masking (PII scrubbing) + minimum-necessary collection; obtain separate consent before using training data containing sensitive personal information (GB/T 45654—2025 Clause 4.2.3).
4. Sandboxed execution: internal sandbox usage data published by Anthropic shows that sandboxing reduces permission prompts by 84% while improving security — constraint and autonomy are a positive sum rather than a trade-off; finer permission boundaries actually reduce reliance on human interruption.

5.2. Human-in-the-Loop Tiering

The most common failure mode of human-in-the-loop is "implementing human confirmation as a dismissed popup, which is the same as no confirmation at all." An effective tiered design should include:

Three engineering requirements:

• Human confirmation must be a trail-bearing action carrying identity, timestamp, and a snapshot of the confirmed content, not a boolean switch.
• Trigger conditions are externalized into a list (amount thresholds, irreversible actions, cross-jurisdiction, regulatory reporting) rather than relying on the model's self-judgment. This is consistent with the requirement of the Implementation Plan for High-Quality Development of Digital Finance in the Banking and Insurance Industries to "establish a human-intervention mechanism covering important business processes and critical nodes."
• Authorization follows a progressive route: "detect first, then auto-respond." Academic research (CyberSentinel-LLM, 2025) shows that SOC analysts' approval of AI reducing repetitive triage work reaches 4.6/5.0, but their trust in autonomous-response suggestions is only 3.9/5.0 — capability approval higher than trust is the most direct empirical support for progressive authorization. Each vulnerability discovery by Google Big Sleep is verified by a Project Zero analyst before disclosure, following the same principle.

5.3. Audit Trails and Chain of Evidence

The engineering standard for audit trails is to mandatorily bind every critical output into a five-tuple:

输入快照 + 工具调用日志 + 输出 + 人工确认记录 + 哈希

Suggested acceptance criterion: for any historical conclusion, one can restore within 10 minutes "what was seen at the time, which rule version was used, which model version, and who approved it."

The retention requirements for the chain of evidence vary by scenario, but the direction is consistent:

• Generative AI service providers: per Article 19 of the Interim Measures for the Management of Generative AI Services, explain the sources, scale, and types of training data, the annotation rules, the mechanisms and principles of the algorithm, and so on;
• Content-labeling-related logs: Article 9 of the Labeling Measures requires retention of no less than six months;
• Audit scenarios: per the Chinese Standard on Auditing (CSA) 1131 — Audit Documentation, record fully and appropriately the process and results of using AI tools, as well as the process of analyzing and adopting the results — the L4 of the audit Harness is therefore not "memory" but a tamper-proof append-only audit trail, and it must support regulatory retrieval;
• EU market: the EU AI Act requires high-risk systems to retain logs automatically and to maintain technical documentation;
• Standardization extension: China has explicitly accelerated the development of granular standards such as agent auditing (GB/Z 185—2026 official follow-up plan); the audit standard for the agent's own behavior is taking shape.

One point that needs to be distinguished: observability (L5) and audit (L6) are not the same thing — the former serves optimization, the latter serves proof of liability; their retention periods, tamper-proofing requirements, and accessing subjects are all different.

5.4. Budget Guardrails

Budget guardrails are the category of mechanism in L6 that is most easily overlooked but whose cost of failure grows fastest. Design points:

Budget guardrails do not conflict with autonomy: the AIxCC experience shows that the main lever of cost control lies in the orchestration layer's "when to call what, when to stop," and budget constraints actually force more precise tool selection.

5.5. Prohibited List of Irreversible Actions

The prohibited list of irreversible actions is the "hard red line" of L6 and should be implemented as a mechanically enforced rule (intercept, block), not as a prompt requirement. The direction-level list based on this project's research:

5.6. Implementation Checklist

---

6. Real Regulatory and Judicial Cases

6.1. Jimeng AI Sanctioned (2026-04-28)

On April 28, 2026, the Jimeng AI website was sanctioned by the cyberspace administration in accordance with the law for failing to effectively implement the requirements of the AI-generated and synthetic content labeling regulations (compiled from public reports and platform entries retrieved by this project's market-research group; details are subject to the official notice).

The significance of this case lies not in the platform involved itself but in three engineering conclusions:

1. The regulatory landing point is the export and distribution stage, not the model capability itself — whether the model carries its own watermark does not equal product compliance; the obligated subject of the Labeling Measures is the service provider that offers users download, copy, export, and dissemination functions.
2. The labeling pipeline of a first-tier major platform can also break — compliance status is not a static attribute achieved once and for all but a runtime attribute requiring continuous verification. This directly supports the engineering requirement that "labeling must be made into an automatic gate on the pipeline."
3. A compliance incident can happen on the platform with the strongest governance mechanisms — Jimeng is at the same time the introducer of the "digital-avatar certification" (two-factor verification of real-person image and voice) mechanism observed by this project (since 2026-02), showing that the existence of a governance mechanism and the continuous effectiveness of a governance mechanism are two different things.

Progress-status note: as of the writing of this white paper (2026-09-12), this project has not retrieved a subsequent administrative penalty decision or a detailed rectification disclosure from the platform side for this incident; the case details and rectification status are marked.

6.2. Beijing Internet Court AI Face-Swap Judgment (Effective 2026-03)

According to a 2026-04-17 report by Xinhua's Economic Information Daily and a case disclosure supplied by the Beijing Internet Court, the Beijing Internet Court concluded in March 2026 an AI face-swap case infringing portrait rights (the judgment is in effect; the full case number was not disclosed in public reports, and is marked). The judgment established two widely cited rules:

1. Recognizability standard: an AI face-swapped likeness need not be identical to the original portrait; if the general public can identify it, it constitutes the use of a specific natural person's portrait.
2. Shifting burden of proof: a defendant claiming "an accidental AI face match" must reproduce the creation process; failing that, it bears the adverse consequence of being unable to prove.

The judgment also makes clear that "technological neutrality" is not an exemption.

The direct implication for Harness design: "whether one can reproduce the creation process" has become, from an engineering best practice, a key capability in judicial offense and defense. Saving the request parameters of each call, the reference-image hash, the model version number, and the returned content number is the statutory value of the L4 state layer in portrait-rights scenarios. For usage patterns with "no workflow, no version record" (pure manual prompting, session-based generation with no trail), this rule is especially unfavorable.

6.3. CICPA Risk-Prevention Notice (2026-03-05)

The China Institute of Certified Public Accountants (CICPA) published on 2026-03-05 the Risk-Prevention Notice on the Use of AI Technology in the 2025 Annual Report Audits by Accounting Firms (《中注协提示会计师事务所在 2025 年年报审计中使用人工智能技术的风险防范》), with four core requirements:

1. Responsibility does not transfer: "Using AI tools in an audit cannot replace the professional judgment of the certified public accountant, and does not reduce the CPA's responsibility for the audit opinion."
2. Data does not leave the domain: without client authorization or permission of laws and regulations, classified information must not be entered into or uploaded to a public artificial-intelligence platform; before processing client data with AI tools, the technical environment, data flows, and access permissions must be ensured to be in a safe and strictly controlled state.
3. Professional skepticism: for anomalies identified by the AI, further audit procedures must be taken to confirm whether there is a material misstatement risk; when the audit evidence provided by the AI is inconsistent with evidence from other sources, maintain professional skepticism and consider modifying or adding audit procedures.
4. Working-paper trail: per the requirements of CSA 1131, record fully and appropriately the process and results of using AI tools, as well as the process of analyzing and adopting the results.

This notice, together with the IESBA (International Ethics Standards Board for Accountants) 2026 guidelines ("regardless of the degree of automation or technical complexity, the professional accountant remains responsible for his or her judgments and decisions"), the positioning of the Supreme People's Court that "the subjects who render judicial adjudications and bear judicial responsibility are the adjudicating personnel," and the statement of the HKMA that "technology does not replace governance," gives the same conclusion in three jurisdictions: the responsible subject cannot be transferred; the design goal of the Harness is not to "replace the human" but to "make the human able to be responsible".

6.4. Separation-of-Duties Requirements in GB/T 45654—2025

GB/T 45654—2025 Clause 4.3.1 — "within the same annotation task, the annotation executor and the annotation reviewer shall not be the same person" — is the clearest formulation at the national-standard level of "two-person separation." Its universal value lies in providing a statutory reference for mapping Separation of Duties onto agent systems:

• The generating Agent and the reviewing Agent belong to different identity and credential systems;
• The evaluator and the evaluated are separated (the same system must not both generate and grade itself);
• No "self-approving" path exists in the approval chain.

The accompanying Clause 4.3.2 further distinguishes the intensity of human re-verification: functional annotation is sample-reviewed by humans, security annotation is fully reviewed by humans — this gives a tiered template for "allocating re-verification intensity by risk level."

6.5. Case Summary

The four cases cover the four governance channels of administrative, judicial, industry regulation, and standard, and point to the same set of L6 mechanisms: automated labeling, reproducible process, attributable responsibility, separable identity.

---

7. Industry-Specific Governance Requirements

7.1. Finance

The core feature of AI governance in the financial industry is "the model is a model" — once an AI system is used for risk decisions, it falls within the scope of model risk management.

• China side: the Implementation Plan for High-Quality Development of Digital Finance in the Banking and Insurance Industries (General Office of the Financial Regulatory Administration, 2025-12) requires building a classified and tiered management framework and process for AI applications, establishing a human-intervention mechanism covering important business processes and critical nodes, advancing the construction of enterprise-grade model risk management platforms, and ensuring algorithm transparency and explainability. On the regulatory side, the "One-Form-Through" regulatory reporting and the penetrating-supervision toolbox are being advanced in sync.
• US side: SR 11-7 Supervisory Guidance on Model Risk Management (FRB + OCC, 2011) establishes the three pillars of model risk: model development and implementation, model validation, model governance; the three elements of validation are conceptual-soundness evaluation, continuous monitoring, and results analysis (including back-testing). Its key principle, as expressed in the OCC manual: regardless of whether AI is classified as a "model," the associated risk management should be commensurate with the risk level of the function the AI supports; if the necessary validation activities cannot be completed before use, that fact should be recorded and the uncertainty of results mitigated through compensating controls (testing, performance monitoring, red-teaming, benchmark comparison, etc.).
• HK side: HKMA Supporting Adoption of Artificial Intelligence in Fighting Financial Crime (2026-06-22) makes clear that "technology does not replace governance"; accountability lies with the financial institution and its control functions, not with the tools used; it simultaneously discloses the industry's governance gap — more than half of the institutions have already deployed AI in risk functions, but fewer than one-third have achieved fully integrated model governance across the three lines of defense.
• Golden rule: "AI generates signals; humans make decisions" (separation of signal and decision) — model output is a "candidate worthy of human attention," and credit and trading decisions are made by humans.

7.2. Legal

• Positioning of responsibility: the Supreme People's Court holds to the positioning of "adjudication assistance," making clear that the subjects who render judicial adjudications and bear judicial responsibility are the adjudicating personnel; it requires strengthening algorithm explainability, holding to the principle of "empowerment, not replacement," and ensuring judges' final decision-making power over core fact-finding and legal application (per a 2025-04 public report's retelling; the full name and clauses of the relevant opinion document have not been confirmed in a primary source, and are marked [To be verified]).
• Search governance: the objects of search in legal scenarios have a hierarchy of effect (constitution, laws, administrative regulations, departmental rules, local regulations, judicial interpretations) and a temporal effect (in force, expired, retroactivity); L1 must perform structured filtering rather than pure semantic-similarity search — expired versions must not appear in search results; where a historical version must indeed be cited, it is explicitly labeled "historical version, used only to judge the state at that time."
• Confidentiality red line: the client confidentiality obligation requires an absolute prohibition on classified information entering public AI platforms (the principle is the same as the CICPA notice).
• Attribution of adjudication authority: the conclusions of clause extraction must be able to point back to a specific position in the original contract; legal-citation references must point back to the original text of the regulation; a citation that cannot return its source is voided without exception; when no search result is hit, output "no basis retrieved" rather than a guess.

7.3. Audit

• Responsibility and trail: see the CICPA notice in Section 6.3. The L4 of the audit Harness is a tamper-proof append-only audit trail, and the L5 evaluation metrics are "the proportion of AI-flagged anomalies finally confirmed as material misstatements" (precision) and "the proportion of known material misstatements captured by the AI" (recall).
• Attribution of adjudication authority: the CICPA requires that for anomalies identified by the AI one "take further audit procedures to confirm," and that verification may be made against information and data obtainable from official platforms — what the AI gives is a clue; what the audit procedure gives is the evidence. An engineerable technical example is given in the CICPA's Q&A No. 19 on Chinese Standards on Auditing (《中国注册会计师审计准则问题解答第 19 号》, issued and in force 2025-01-07): OCR cleaning and merging of bank transaction statements, recomputation and comparison of balances transaction by transaction, and one-to-one matching of statements with the chronological ledger.
• Standards evolution: on 2026-08-05 the IAASB proposed revisions to ISA 330, ISA 500, and ISA 520, revising the definition of audit evidence to reflect digital technology and strengthening professional skepticism and the evaluation of the relevance and reliability of evidence; the IAASB has not yet issued a separate international audit standard for artificial intelligence, and provides a framework only in the form of extended guidelines and technical position papers. The IIA's Global Internal Audit Standards (issued 2024-01-09, in force 2025-01-09) Standard 10.3 requires the internal audit function to ensure the acquisition of the tools and technology necessary to perform its duties.
• Meta-audit status: auditing is itself governed (data does not leave the domain) while also governing others (as the meta-audit of AI systems in the finance, compliance, legal, and security directions); it is the only governance direction with duality.

7.4. Healthcare

Healthcare is one of the industries with the highest data sensitivity and the highest cost of error. The reliable quantitative evidence obtained by this project's retrieval comes from IBM's Cost of a Data Breach Report 2025: the healthcare industry has been the industry with the highest data-breach cost for the 14th consecutive year (an average of US$7.42 million), and the time to identify and contain is also the longest (an average of 279 days) — this data supports the highest-strength requirements for data tiering, access control, and audit trails in medical AI systems.

What must be stated honestly is: for China's dedicated regulatory texts on medical AI applications (such as the review requirements for AI medical software and assisted-diagnosis products), this retrieval did not obtain verifiable clause-level sources; the relevant content is marked, and this white paper makes no speculative statements. The general governance conclusions still apply: the output of diagnostic AI belongs to the advisory tier (decision by the human physician), the processing of personal health information must meet the separate-consent requirement of personal-information protection, and the full-process trail should support the traceability of medical quality and adverse events.

---

8. Summary

The core argument of this chapter can be compressed into five sentences:

1. Governance is a precondition of deliverability. In regulated industries, the outputs of L6 (audit trails, chains of evidence, human-confirmation records) are themselves the final deliverables handed to regulators and courts; a Harness that builds only L1 through L5 has incomplete deliverables.
2. Global frameworks and the China baseline are converging on the same set of engineering mechanisms. The Statement of Applicability of ISO/IEC 42001, the log retention and human oversight of the EU AI Act, the MEASURE of the NIST AI RMF, and the compliance-obligation maintenance of GB/T 35770, once mapped onto the Harness, are the same four things: the authorization list, the log trail, the evaluation metrics, red-line management.
3. The China compliance baseline has been quantified to the level of engineering parameters. Label position, text height, duration, metadata fields, the 5% corpus threshold, two-person separation, six months of log retention — compliance obligations have already sunk to the level of metadata fields and export scripts.
4. The non-transferability of responsibility is the common conclusion of the four jurisdictional channels. The CICPA, IESBA, the Supreme People's Court, and the HKMA give the same answer: the design goal of the Harness is "to make the human able to be responsible," not "to replace the human."
5. Adjudication authority cannot be handed to probability. The model is responsible for hypotheses and orchestration; deterministic tools and the signing human are responsible for adjudication; the degree of authorized automation is proportional to the determinability of the evidence, and progressive authorization (detect first, then auto-respond) is the default route.

---

9. Information Gaps Statement

The following content has not obtained a primary source in the existing research, or has a conflict of readings; this white paper handles it under the "no fabrication" principle:

1. The original clause wording of Article 7 of the Measures for the Labeling of AI-Generated and Synthetic Content (the specific content of the verification obligation of application-distribution platforms) — marked; when cited, the officially published text prevails.
2. The two items in GB/T 45654—2025, "the annex lists 31 categories of risks" and "the compliance pass rate of generated content is no lower than 90%," are secondary interpretations; the original text of the standard has not been verified, and this white paper does not adopt them.
3. The subsequent administrative penalty decision and rectification disclosure of the 2026-04-28 Jimeng AI sanction — not retrieved; case details are marked.
4. The full case number of the judgment that took effect in 2026-03 by the Beijing Internet Court — not disclosed in public reports, and is marked.
5. The timeline of the EU AI Act may be adjusted by the AI Omnibus (2026-05 provisional agreement) — this white paper takes the EU official service-desk timeline as its baseline; the Omnibus adjustment is handled as "proposed" and marked [To be verified].
6. The full list of the 12 risk categories of NIST AI 600-1 (other sources cite 13 categories) — the original list has not been obtained.
7. The full name, publication date, and clauses of the Supreme People's Court's Opinions on Standardizing and Strengthening the Judicial Application of AI (《关于规范和加强人工智能司法应用的意见》) — only a retelling has been obtained, and it is marked.
8. The clause-level source of China's dedicated regulatory texts on medical AI — not retrieved; the relevant content of Section 7.4 is marked.
9. The specific document numbers and clauses of financial-industry standards such as the Guidelines on Science and Technology Ethics in the Financial Sector (《金融领域科技伦理指引》) and the Specification for Evaluating the Financial Application of AI Algorithms (《人工智能算法金融应用评价规范》) — not obtained, and not cited in the body.
10. The specific clause numbers of the Measures for the Compliance Management of Central Enterprises (《中央企业合规管理办法》) — not obtained; mentioned only as background.

---

10. References

1. Measures for the Labeling of AI-Generated and Synthetic Content (《人工智能生成合成内容标识办法》, CAC General Office Circular [2025] No. 2) — Cyberspace Administration of China and four other departments, 2025. https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm
2. Interim Measures for the Management of Generative AI Services (《生成式人工智能服务管理暂行办法》, Order No. 15 of seven departments) — Cyberspace Administration of China and seven other departments, 2023. https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm
3. Decision on Amending the Cybersecurity Law of the People's Republic of China (Presidential Order No. 61) — National People's Congress, 2025. http://www.npc.gov.cn/c2/c30834/202601/t20260105_450980.html
4. GB/T 45654—2025 Cybersecurity Technology — Basic Security Requirements for Generative AI Services, interpretation — National Information Security Standardization Technical Committee (SAC/TC260), 2025. https://www.tc260.org.cn/tc260/hygd1/202403/b429d868525e48c3b7d12a0ec8f82e5e.shtml
5. Implementation Plan for High-Quality Development of Digital Finance in the Banking and Insurance Industries (《银行业保险业数字金融高质量发展实施方案》) — General Office of the National Financial Regulatory Administration, 2025. https://www.nfra.gov.cn/cn/view/pages/ItemDetail.html?docId=1239741
6. Risk-Prevention Notice on the Use of AI Technology in the 2025 Annual Report Audits by Accounting Firms (《中注协提示会计师事务所在 2025 年年报审计中使用人工智能技术的风险防范》) — China Institute of Certified Public Accountants, 2026-03-05. https://cicpa.org.cn/xxfb/news/202603/t20260305_65842.html
7. Q&A No. 19 on Chinese Standards on Auditing (《中国注册会计师审计准则问题解答第 19 号》) — China Institute of Certified Public Accountants, 2025. https://cicpa.org.cn/xxfb/news/202501/t20250123_65229.html
8. NIST AI Risk Management Framework (AI RMF 1.0) — NIST, 2023. https://www.nist.gov/itl/ai-risk-management-framework
9. NIST AI 600-1 Generative Artificial Intelligence Profile — NIST, 2024. https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence
10. ISO/IEC 42001:2023 — ISO/IEC JTC 1/SC 42, 2023. https://www.iso.org/standard/42001
11. ISO 37301:2021 / GB/T 35770—2022 adoption report — China Academy of Standards and Technology, 2022. https://www.cnis.ac.cn/bydt/zhxw/202210/t20221020_54060.html
12. EU AI Act Implementation Timeline — European Commission AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act
13. SR 11-7 compilation (BPI Navigating Artificial Intelligence in Banking) — BPI, 2024. https://bpi.com/wp-content/uploads/2024/04/Navigating-Artificial-Intelligence-in-Banking.pdf
14. HKMA Supporting Adoption of Artificial Intelligence in Fighting Financial Crime — Hong Kong Monetary Authority, 2026-06-22. https://brdr.hkma.gov.hk/eng/doc-ldg/current/20260622-1-EN
15. IAASB Global Technology and Quality Management Roundtable Feedback Summary — IAASB, 2026. https://www.iaasb.org/news-events/2026-02/iaasb-publishes-global-roundtable-feedback-technology-and-quality-management
16. IIA Global Internal Audit Standards — The Institute of Internal Auditors, 2024. https://www.theiia.org/en/standards/documents/
17. OWASP Top 10 for LLM Applications (2025 edition) — OWASP GenAI Security Project. https://genai.owasp.org/llm-top-10/
18. MITRE ATLAS — MITRE. https://atlas.mitre.org
19. DARPA AI Cyber Challenge final results — DARPA, 2025. https://www.darpa.mil/news/2025/aixcc-results
20. IBM Cost of a Data Breach Report 2025 — IBM / Ponemon Institute, 2025-07-30. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
21. Google Cybersecurity updates: Summer 2025 (Big Sleep, etc.) — Google, 2025. https://blog.google/technology/safety-security/cybersecurity-updates-summer-2025/
22. CyberSentinel-LLM — Computers, Materials & Continua, vol.89, no.1, Tech Science Press, 2025. https://www.techscience.com/cmc/v89n1/68397/html
23. "Technology Is No Shield for Infringement: How the Court Ruled on AI 'Face Theft'" (report on the Beijing Internet Court judgment that took effect in 2026-03) — Xinhua Economic Information Daily, 2026-04-17. http://dz.jjckb.cn/www/pages/webpage2009/html/2026-04/17/content_115180.htm
24. "e-Case e-Trial: The AI Face-Swap of a Short-Drama Character 'Strongly Resembles' a Famous Actor" — supplied by the Beijing Internet Court, The Paper. https://www.thepaper.cn/newsDetail_forward_32799628
25. Sandboxing: a safer and more autonomous approach — Anthropic, 2025. https://www.anthropic.com/engineering/claude-code-sandboxing