The matrix sets out who is responsible for checking, monitoring and intervening in each of Quillmarrow’s 20 AI uses. It is an operational guide: it does not by itself prove that an approval happened, that a setting works or that an owner has reviewed an output. Where evidence is missing, the owner must retain the relevant restriction and follow up rather than assume the control is operating.

Approve, monitor and intervene

Approve means a named role examines the information needed to make a decision and can accept, amend or reject it. Approval must happen at the point specified in the matrix. For example, the Purchasing Lead must approve each AI-03 purchase order before the agent sends it. Approval of a High-tier use by the Managing Director (MD) is a separate decision from approval of an individual action.

Monitor means the named owner or operator checks whether the use continues to operate within its agreed purpose and boundaries. Depending on the use, this may involve reviewing individual outputs, exceptions, complaints, action logs or periodic performance records. For AI-14, the Purchasing Lead reviews forecast exceptions and stock decisions rather than approving every forecast.

Intervene means the responsible person can correct an output, reject an action, pause the workflow or escalate the issue. The matrix should identify who can intervene and what they can do. If a person cannot reach the control or does not have authority to stop an action, recording them as the overseer is not enough.

Choosing the level of human involvement

The Model AI Governance Framework, Second Edition (PDPC and IMDA, January 2020) describes three arrangements:

• Human-in-the-loop: a person reviews and makes the relevant decision before an action or output takes effect.
• Human-over-the-loop: a person monitors the system and can intervene, including by reviewing exceptions.
• Human-out-of-the-loop: the system makes or carries out the relevant decision without human intervention at that point.

The reviewer chose the arrangement for each use by considering the severity and reversibility of potential harm, alongside the information involved and the system’s autonomy. There is no single arrangement for every use. A draft that can be corrected before publication calls for a different check from an agent able to send a purchase order or a recommendation affecting a credit decision.

The loop label describes the intended oversight, not proof that it operates. In particular, an approval gate must be demonstrated before it is relied upon. A hold or prohibition remains in place even if a possible future human-review process has been described.

How to read the matrix

Each row corresponds to an AI use in the register. Read it across to identify the use and its loop label, the person who approves, who monitors, and who can intervene. The reversibility column explains how readily an error can be corrected; harm if wrong describes the potential consequence. The status and conditions in the register still apply.

The listed role is accountable for the specified action, but an authorised user may perform a check where the register permits it. Owners should make clear how checks are recorded and how staff reach the person who can intervene.

Uses requiring the tightest oversight

• AI-03 — supplier reorder agent. An incorrectly sent purchase order could create a commitment that is difficult to undo. The Purchasing Lead must approve every order before sending. The agent must also have per-order and per-day limits and block orders outside the approved supplier list. Technical bounds, the approval workflow and test evidence have not been supplied; these controls are requirements, not verified settings.
• AI-12 — customer web-chat bot. A customer-facing response could mislead someone or disclose information before an error is corrected. The bot is not yet live and may be piloted only after controls are approved. Customer Service must review pilot responses before any customer-facing use. Pilot design, permissions, escalation and test evidence are missing.
• AI-16 — credit-limit recommendation. A credit decision may materially affect a B2B customer and can be difficult to reverse. The Finance Director or authorised finance staff make the decision; automatic decisions and automatic limit changes are not permitted. The vendor, inputs, recommendation logic and decision records have not been supplied.

AI-04 also remains on hold: no candidate screening or ranking may occur until the hold is reconsidered and controls are approved.

Keeping the matrix current

The COO owns the matrix. Use owners should tell the COO when the AI use register changes, including a change to purpose, owner, data, permissions, status or required approval. The COO updates the matrix with the register and refers High-tier approval decisions to the MD. An incident, failed control or proposed expansion should also prompt a review.

Evidence that oversight operated

Useful evidence includes a dated output or action record, the approver’s identity and decision, exception and intervention logs, and records of corrections or pauses. For AI-03, an order record should link the specific purchase order to the Purchasing Lead’s approval and the subsequent send outcome. Configuration and test evidence are needed to support claims about technical gates; an approval record alone does not prove those gates work.

The full matrix follows and is also supplied as an XLSX workbook.

Open items before this matrix is relied on

• AI-03 supplier reorder agent: the approval gate and kill switch must be shown working in Quillmarrow's own tenant (see A7) before the pilot widens. Owner: Purchasing Lead with the IT Manager.
• AI-12 web-chat bot: hand-off to a person, the out-of-scope message list and transcript sampling must be set up before any customer-facing pilot. Owner: Head of Customer Service.
• AI-16 credit-limit recommendations: Finance to keep a record of each human credit decision, including when a recommendation was overridden. Owner: Finance Director.
• All Tier 3 uses: first quarterly evidence check to be filed with the register. Owner: COO.

Approval

The matrix, part 1: who approves, monitors and intervenes

The matrix, part 2: reversibility, escalation, evidence and review