Enterprise AI · Assurance
AI assurance reference for IBM Maximo and MAS estates
MaxIron configures scope limits, review gates and run records around each AI-assisted workflow. Risk, engineering and service owners agree the authority to approve outcomes and the evidence retained for audit. Q1 to Q7 connect assurance questions to those records.
Scope
Who this reference is written for, and where it stops
What this reference applies to
- Written for
- Internal audit, risk, information security, engineering authority, procurement and public-sector assurance teams.
- Covers
- AI-assisted work on IBM Maximo and MAS estates that MaxIron delivers or operates, in assist, draft or controlled automation mode.
- Anchored by
- MaxIron Assist execution controls, which hold the modes, the gates and the run record.
What it does not
- Out of scope
- AI tooling your organisation runs independently of MaxIron.
- Not claimed
- That any model output is correct. We publish no accuracy figure.
- Citation
- Codes Q1 to Q7 and A1 to A4 are stable once published and safe to quote in a submission.
The scope register, retained run record and acceptance schedule provide the evidence for risk, engineering and service-owner review before release.
Register 1
Assurance questions, Q1 to Q7
Asked roughly in this order. None of them is about model architecture. All of them are about who decided and what exists to show it.
| Ref | Question | Usually asked by | The answer | Artefact |
|---|---|---|---|---|
| Q1 | What context can the model see? | Information security, data protection | A written scope per stream of work: which environments, record types and document sources are approved as input, and what is out of bounds. The answer is a list rather than an assurance that it behaves sensibly. | A1 |
| Q2 | Which decisions can it make on its own? | Risk, operations leadership | A mode per workflow. Assist for advisory work, draft where a named person approves before publish or execution, controlled automation only inside a boundary agreed in advance. Agents, actions and workflows are enabled independently. | A1 |
| Q3 | Who approved this outcome, and when? | Internal audit | The run record: stages passed, the draft as produced, the reviewer edits, the named approver, the timestamps, and the lineage where one run resumed from another. | A2 |
| Q4 | What happens when the model is uncertain? | Risk, engineering authority | Uncertain output does not progress. It routes to a review gate or escalates to a named owner. Compliance-critical calculations are deterministic, so they never reach a generative stage. | A1, A2 |
| Q5 | How do you stop it learning the wrong lesson? | Quality, engineering authority | Nothing is learned automatically. A correction made at a gate is raised as a proposal with its evidence, and a person with authority over that role approves or rejects it. | A3 |
| Q6 | What are you certified to, and what does it cover? | Procurement, public-sector buyer | Certificates and the G-Cloud listing are on the Trust Centre. Coverage of each mark is named there. | A4 |
| Q7 | Can we turn it off? | Risk, procurement | Your own people can disable an individual agent, action or workflow, and reduce any workflow to advisory mode without a change request to us. Approved outcomes stay in your Maximo estate. | A1 |
Cite a row as Q1 to Q7. Codes are stable once published and are never renumbered.
The gates
Scope, review and learning approval gates
Every AI-assisted run on a MaxIron-managed estate passes these in order. The refused column is the one an engineering authority reads first.
-
Gate 1 Scope gate
Signed by The stream owner, at scoping
Passes
A run inside the purpose, environments and record types written into A1 for that stream of work.
Held back
A run that would widen its own remit, escalate its permissions or retry against a broader target. It stops and says so.
-
Gate 2 Review gate
Signed by The named approver for that decision type
Passes
A draft a named reviewer has read, edited where needed and approved. The corrected version runs, and the difference from the original stays visible.
Held back
Higher-impact work awaiting a named reviewer. The run remains at the review gate until authorised coverage is available.
-
Gate 3 Learning gate
Signed by The owner of the role being changed
Passes
A reviewer correction promoted into what an agent knows next time, with the evidence behind it and a dated approval.
Held back
A correction changing future behaviour on its own. Permission to act and permission to learn are separate approvals.
Register 2
Evidence artefacts, A1 to A4
Each artefact connects source context, reviewer decisions and approval authority for a later audit sample.
| Ref | Artefact | What it contains | Where it is produced |
|---|---|---|---|
| A1 | Scope and mode register | Per stream of work: purpose, approved context, prohibited context, operating mode, named owner, escalation threshold. Versioned, so a widening of scope appears as a dated decision rather than as drift. | Agreed at scoping, held in the MaxIron Portal, changed only by the named owner. |
| A2 | Run record | Per run: stages passed, input and output at each stage, the draft as produced, reviewer edits, named approver, timestamps, cost, and lineage where one run resumed from another. | Captured as the work runs, by Assist execution controls. |
| A3 | Learning approval log | Every change to what an agent knows: who proposed it, the evidence behind it, who approved it, and when. This is the artefact an engineering authority asks for second. | Raised at the learning gate, approved separately from the work itself. |
| A4 | Credential set | The marks MaxIron holds, each with its register link and the limit of what it covers. | Maintained in the Trust Centre. |
Illustrative. Internal audit samples an automated remediation that ran four months earlier: A2 returns the scheduled check that opened the case, the two steps the reviewer corrected before approval, her name, and the timestamps either side of a five-hour wait at the review gate. A3 shows the correction was approved separately rather than absorbed into future behaviour.
Supplier assurance
Security and supplier evidence is maintained in the Trust Centre
- Trust Centre Security controls and company credentials
Review the supplier evidence separately from the workflow-specific scope, run records and acceptance tests required for AI assurance.
Register 4
Situations, and the control that catches them
T1 to T4 provide acceptance checks for scope limits, reviewer availability, learning approval and audit retrieval in your non-production environment.
- T1
An agent is asked to act outside the scope written into A1
- Passes when
- The run halts, records the refusal against the scope entry it breached, and does not retry against a broader target.
- Witnessed by
- Your stream owner and an information security reviewer, in your own non-production environment
- T2
Higher-impact work reaches the review gate with nobody available to approve it
- Passes when
- The run queues and stays queued. Nothing reaches the estate on the model’s own judgement.
- Witnessed by
- The operations lead who owns that decision type
- T3
A reviewer correction would change how the agent behaves next time
- Passes when
- The correction applies to this run, and appears in A3 as a dated proposal awaiting the role owner rather than taking effect quietly.
- Witnessed by
- Your engineering authority
- T4
An assurance sample lands months after the work ran
- Passes when
- A2 returns the draft, the reviewer edits, the named approver and the timestamps for a run your auditor selects, not one we choose.
- Witnessed by
- Internal audit
Scope and boundaries
Where this governance model stops
The limits of the model, stated as commercial facts.
No AI-specific certification, and no implication of one
None of the marks in register 3 covers model governance. Where an AI-specific standard becomes relevant to your assurance position, we state where we stand against it.
No warranty that an output is correct
We publish no accuracy figure and we will not warrant a model output. What is governed is the decision that follows it: a named person with the authority reviewed it, the review is recorded, and nothing with consequence reached the estate without them.
No substitute for your own accountability structure
Where nobody has decided who may approve what, this model has nowhere to attach. Naming decision owners, agreeing escalation thresholds and funding the review time are organisational commitments, and how we run it day to day sets out what they cost.
AI governance, frequently asked questions
- Do you hold an AI-specific certification?
- MaxIron’s company credentials and their scope are maintained in the Trust Centre. AI assurance relies on the workflow-specific scope register, retained run records, reviewed learning changes and demonstrated acceptance controls.
- How is auditability handled?
- Each gated step captures review and decision evidence as the work happens, because assurance questions arrive months later. A2 answers who approved what and when. A3 answers whether a correction was allowed to change future behaviour.
- Can this satisfy public-sector assurance expectations?
- The model is built around controlled access, human approval, traceability and procurement-verifiable markers including the UK G-Cloud 14 route. Whether it satisfies a particular authority depends on the requirements that authority sets, which is why we would rather see your questionnaire early than send a generic answer late.
- Can we cite this reference in an assurance submission?
- Yes, and the codes exist for that. Cite a question as Q1 to Q7 and an artefact as A1 to A4. If your authority needs the answers against its own wording on letterhead, ask and we will produce them.
- How does this differ from the Assist product page?
- Assist is the product: chat in Manage, MCP, governed role work and data proposals. This reference covers the question, the artefact that answers it, and the exact boundary of each credential.
Bring the AI assurance questionnaire.
Bring the AI assurance questions, one proposed workflow and its accountable owner. We map the requirements to the scope register, run record and acceptance tests, then identify the evidence needed before release.
Bring this to the first call
- Your AI or automation assurance questionnaire, in whatever state it is in
- The last question internal audit asked about an automated change
- Your current position on who may approve a change that touches production
- Any public-sector or regulatory assurance requirement you are held to