AI Three Lines Governance / Decision Rights / Assurance Operating Model Playbook

配对阅读：本手册的原理/架构解读版是 docs/ai-foundations/papers/174-ai-three-lines-governance-decision-rights-assurance-operating-model-architecture.md。先读 paper 建立机制与取舍，再用本手册落地为模板、RACI 与门禁，两者不需要重复精读。

版本: v1.1 日期: 2026-07-01

本文把 AI use case 的三道防线职责、生命周期 gate、decision rights、evidence forum、challenge memo、issue/action tracking、assurance packet、escalation path 和 architecture governance 连接成可运行的 operating model。它不构成法律意见、监管解释、审计意见、模型验证结论、内控有效性结论或生产批准。

核心问题不是“风险部门是否签字”, 而是:

Who owns the business outcome and residual risk?
Who independently challenges the control design and evidence?
Who provides assurance without becoming a release approver?
Which evidence supports each gate decision?
What happens when lines disagree, controls fail or conditions age?

---

1. Core Problem and System Boundary

AI 治理最常见的失效不是缺少委员会, 而是责任被口头合并:

• 业务说风险已经看过。
• 风险说业务会承担后果。
• 技术说系统只是辅助。
• 内审被拉进会议后被误认为已批准上线。
• 条件放行后没有 owner、到期日和关闭证据。

三道防线模型在 AI 场景中的价值, 是把管理责任、独立挑战和独立保证分开, 同时让它们围绕同一份证据工作。

推荐使用场景:

Definition:

AI Three Lines operating model =
  first-line product/process ownership
  + second-line independent challenge
  + third-line independent assurance
  + lifecycle decision rights
  + evidence forum
  + issue/action tracking
  + architecture governance integration

---

2. Operating Principles

三道防线的边界应当稳定, 但执行深度应按风险分层。低风险内部知识助手可以用轻量 gate; 信贷、反洗钱、财富建议、欺诈、投诉、客户可见回答和带工具执行的 agent 必须有完整证据论坛和挑战记录。

---

3. Operating Cadence

Cadence design tradeoff:

• Too many meetings turn governance into theater.
• Too few gates allow scope creep, stale evidence and unowned residual risk.
• The practical solution is risk-tiered governance plus reusable evidence: inventory, control matrix, trace store, issue register, eval report, ADR and management attestation.

---

4. Three-Lines Role Map

Use this map at intake and update it at design, pilot, release, scale, material change and retirement.

Completed example:

---

5. Lifecycle Decision-Rights Matrix

Decision vocabulary:

---

6. Evidence Forum Design

An evidence forum is not a status meeting. It is a decision mechanism that binds claims to artifacts, issues and authority.

Forum discipline:

• Do not review every artifact page by page; use evidence index and exception-based review.
• Do not allow verbal closure of issues; closure requires acceptance criteria and evidence.
• Do not combine risk acceptance with unclear owner language; record first-line accountable owner.
• Do not treat internal audit attendance as release approval.
• Do not use “risk signed off” as decision wording; record first-line decision and second-line position separately.

---

7. Second-Line Challenge Memo Pattern

Second-line challenge is valuable when it is specific, testable and linked to decision consequences. A useful challenge memo states scope, position, concerns, conditions, residual issues and review triggers.

# Second-Line Challenge Memo: AML Copilot Release Gate

Date: 2026-07-01
Gate: release
Challenge functions: Financial Crime Compliance, Model Risk, Privacy, Security
First-line accountable owner: Financial Crime Operations Director

## 1. Scope Reviewed

- Use case: AML copilot drafts sourced investigation timelines and narrative suggestions for alert types A and B.
- Channel / user population: L2 AML analysts in the retail banking investigations queue.
- Automation boundary: The copilot cannot close alerts, change disposition, file suspicious activity reports or send customer communications.
- Customer / employee / regulatory impact: Analyst productivity and case narrative quality; regulatory sensitivity through case record content.
- Model / RAG / agent / vendor components: Enterprise LLM gateway, approved AML procedure corpus, case timeline retriever, narrative drafting copilot.
- Evidence packet version: AML-COPILOT-REL-2026-07-01-v1.

## 2. Challenge Summary

| Area | Challenge position | Required condition or rationale |
|---|---|---|
| Risk tier and scope | conditional no objection | High-risk operational support is acceptable for controlled release only because final disposition remains analyst-owned. |
| Control design | condition | Narrative evidence must bind each saved paragraph to source-span ids and analyst approval event. |
| Evidence sufficiency | condition | Current eval report is sufficient for common typologies but needs 30-case source-span sample before broad scale. |
| Operational readiness | no objection | SOP, reviewer training and fallback to manual narrative drafting are documented. |
| Change and incident readiness | condition | Material changes to AML corpus, prompt or narrative template must reopen release gate. |

## 3. Material Concerns

| Concern id | Concern | Severity | Gate impact | Suggested action |
|---|---|---|---|---|
| C-001 | Paragraph-level source-span evidence is incomplete for high-risk typology narratives. | high | conditional release only | Add event capture and produce 30-case source-span review sample. |
| C-002 | Material-change trigger for AML corpus updates is not reflected in ADR. | medium | condition | Update ADR with corpus, prompt and workflow materiality rules. |

## 4. Conditions for Proceeding

| Condition id | Condition | Owner | Due date | Closure evidence |
|---|---|---|---|---|
| CON-001 | Capture source ids, passage ids, analyst edit diff and approval event for every narrative saved to case record. | AML capability owner | 2026-07-15 | Event extract, 30-case sample workbook, reviewer sign-off. |
| CON-002 | Update ADR with material-change triggers for corpus, prompt, workflow and vendor gateway changes. | Product Architect | 2026-07-10 | Approved ADR-AML-COPILOT-004. |

## 5. Residual Concerns and Review Triggers

- Residual concern: Analysts may over-rely on fluent narrative drafts despite source support.
- Review trigger: Source-span error above 2% in monthly sample, any unsupported regulatory-sensitive phrase, or material corpus update.
- Escalation trigger: Any production narrative saved without source-span event.

## 6. Challenge Position

Final position: conditional no objection for controlled production release, no broad scale until CON-001 and CON-002 close.

The memo should not merely say “approved with comments.” It must specify whether the second line has no objection, has conditions, objects, or requires escalation.

---

8. Issue and Action Log

Issues must be managed as control objects, not as meeting notes.

Severity guide:

---

9. Assurance Packet

Assurance packet is the minimum artifact set that lets reviewers understand what was decided, on what evidence, by whom, with which issues and review triggers.

Quality bar:

• Every claim in executive narrative links to evidence.
• Every material issue has owner, due date and acceptance criteria.
• Every conditional go has explicit follow-up forum or review date.
• Every architecture tradeoff appears in an ADR.
• Every high-risk action has policy and evidence route.
• Every human oversight control records authority, information, time and accountability.

---

10. Escalation Path

Escalation decision memo:

---

11. Review Questions by Governance Lens

These questions are not preparation prompts; they are operating checks used at gates.

Product and Process Lens

Process Analysis Lens

Architecture Lens

---

12. Release Checklist

Use this as a gate-entry checklist. A release meeting should not begin until the required items exist.

No-go signals:

• No named first-line owner.
• Second-line objection unresolved and not escalated.
• Critical or high blocker lacks closure plan.
• Evidence packet cannot support the proposed gate decision.
• Architecture lacks evidence capture for material control.
• Conditional go has no owner, due date or closure evidence.
• Internal audit is being asked to approve release.

---

13. Executive Narrative

Use this narrative pattern for steering committee or portfolio review. Keep wording factual and avoid saying “risk approved.”

We are requesting conditional go for the AML copilot at the release gate.

The first-line accountable owner is the Financial Crime Operations Director, who owns the business outcome, operational process, control operation and residual-risk proposal. The use case is limited to L2 analyst support for alert types A and B. The AI is not permitted to close alerts, change disposition, file suspicious activity reports or send customer communications.

The release packet includes the AML copilot architecture view, control matrix, eval/test evidence, second-line challenge memo, issue/action log and ADR-AML-COPILOT-004. Second-line functions reviewed the packet and recorded conditional no objection. The material conditions are paragraph-level source-span evidence for saved narratives and an ADR update for corpus, prompt, workflow and vendor material-change triggers, each with owner, due date and closure evidence.

The main value case is reduced narrative preparation time and improved case evidence consistency. The main risk/control considerations are unsupported narrative claims, analyst over-reliance and material corpus change. Open issues are classified as two release conditions and no unresolved blocker. The decision requested is conditional production release for the defined population, with review triggers for corpus update, prompt change, vendor gateway change, source-span sample failure, incident signal or scale request.

Internal audit is not approving this release. The use case will be visible to audit for future assurance planning because it affects financial crime case records.

Scenario emphasis:

---

14. Failure Modes

---

15. Source Anchors

---

16. Landing Check

This operating model is working only when the organization can prove: