Governance Stack • CRSP + NRC + AER

From user intent to a governed institutional artifact.

CRSP in one line

Coherent Reflexive Super-Prompt
CRSP treats every model output as a proposed commitment position that must pass explicit governance gates before it can be treated as institutionally endorsed or action-authorizing.
Practical effect: “drafts with receipts” — structured claims, evidence, accountable roles, and release labels.

Two primitives

NRC → AER
NRC routes work by risk posture and authority boundaries.
AER is the gating sequence that yields an auditable decision record: Ask → Evidence → Release (or Reject / Escalate).

Institutional posture

CASRC memo
The assistant drafts governance artifacts meant for review by bodies like CASRC. It does not “decide,” “approve,” or “authorize.” It produces structured proposals for review.

Auditability by construction

log every gate
Every run emits a linked chain: NRC receipt → AER events → evidence bundle references → entitlement outcome → release label. That chain is what makes the artifact institutionally answerable.

NRC Contract

A Normative Routing Contract (NRC) is the governance “front door.” It specifies artifact intent, audience, and—most importantly—the authority boundary the assistant must not cross. The NRC makes the run routable: it determines which policies, defeaters, and approval requirements apply.

Design intent: Keep the model “inside the lane.” NRC is the lane definition: what may be claimed, what must not be done, and what review gates are required.

Minimum NRC fields

intake UI
Use these fields in your NRC form so runs are reproducible and auditable.
Artifact intent WHY
Artifact type, target audience, and release posture.
Authority boundary MUST NOT
Explicit prohibitions: no autonomous decisions, no bypassing review, no action authorization.
Risk & sensitivity ROUTE
Domain risk level, data sensitivity, required evidence / approvals.
Accountable roles WHO
Named human roles responsible for decisions (clinical lead, security, legal, etc.).

Tip: attach the NRC receipt hash to every AER event emitted downstream.

Example NRC payload

copy/paste JSON
{ "nrc_id": "NRC.SUTTER.TYPEIII.RETEAM.RISK_SCORE.AUTHORITY", "artifact": { "type": "misuse_risk_analysis", "audience": "CASRC", "release_posture": "internal_draft" }, "constraints": { "prohibited": [ "clinical_decision_making", "treatment_recommendations", "autonomous_action_authorization", "bypassing_human_review" ], "required": [ "explicit_accountable_roles", "evidence_bundle_references", "defeater_checks", "aer_audit_log_emission" ] }, "risk": { "sensitivity": "high", "misuse_focus": ["prompt_injection", "data_exfiltration", "authority_escalation"], "escalation_required_on": ["policy_conflict", "missing_evidence", "ambiguous_authority"] }, "accountability": { "requestor_role": "Solutions Lead", "approver_role": "CASRC Chair", "domain_owner_role": "Clinical Governance Lead", "security_reviewer_role": "Security Officer", "legal_reviewer_role": "Privacy Counsel" } }
Operational rule: the same prompt under a different NRC is a different governance event. NRC is not “metadata”; it is the authority boundary and routing key.

Complete AER Flow

This is the completed, end-to-end AER run: not just “Ask → Evidence → Release,” but the full institutional gating chain required to safely produce a CASRC-governed institutional artifact. Each phase emits a log record and may terminate early (reject/escalate) if a defeater triggers.

Key principle: The assistant may draft proposals; entitlement is institutional. AER makes that separation explicit, machine-checkable, and auditable.

Phases (what happens)

AER.run()
0
Preflight bind the contract NRC
  • Validate NRC: audience, release posture, prohibited/required constraints.
  • Bind policy pack + defeater library versions for this run (reproducibility).
  • Create run_id and an immutable nrc_receipt (hash + timestamp).
1
ASK normalize the request intake
  • Rewrite the user prompt into a bounded “work order” aligned to NRC scope.
  • Extract deliverable shape: sections, required tables, required controls list.
  • Run authority checks: detect implicit requests for decisions/approvals/autonomy.
  • If violated: return rejected or rewrite_required (no drafting past the boundary).
2
EVIDENCE collect & ground inputs
  • Retrieve applicable governance sources: policies, standards mappings, prior CASRC decisions, approved controls.
  • Attach references: policy IDs, version stamps, URLs/sections (or internal doc pointers).
  • Classify evidence quality: authoritative / secondary / unsupported.
  • If missing evidence: mark gaps and require review before release.
3
DEFEATERS stop bad runs early guards
  • Prompt-injection indicators, data exfiltration patterns, scope creep, policy conflicts, ambiguous authority.
  • Safety posture checks (regulated domain): “medical advice,” “clinical decision,” “action authorization.”
  • Consistency checks: does the draft contradict NRC prohibited constraints?
  • If triggered: terminate with rejected or escalate + reason codes.
4
DRAFT generate the proposed artifact proposal
  • Generate a structured artifact (e.g., CASRC memo) as a proposal, not an institutional decision.
  • Embed explicit accountable roles and “non-authorizing” language per NRC.
  • Include evidence citations / references and enumerate assumptions and open questions.
  • Attach “review checklist” section (what reviewers must confirm).
5
ENTITLE scorekeeping outcome decision
  • Determine entitlement status under NRC (not “true/false,” but “allowed-to-release-under-which-conditions”).
  • Compute required reviewers by posture: security / privacy / CASRC chair / domain owner.
  • Emit structured entitlement token: approved_for_distribution / review_required / rejected.
  • Record reasons + any mandatory edits before release.
6
RELEASE label + distribute output
  • Attach release label aligned to entitlement: internal_draft, review_required, approved_for_distribution, or rejected.
  • Enforce distribution rules (restricted/internal/external) and redact if required by sensitivity posture.
  • Emit the artifact + a machine-readable AER audit record for traceability.
7
MONITOR post-release governance loop
  • Track downstream feedback: reviewer comments, policy changes, incident reports.
  • Create defeater updates (new patterns, new prohibited language, new escalation triggers).
  • Optionally run “refresh checks” when evidence expires (freshness windows).
  • Feed learnings into CRSP/NRC updates (nested learning loop).

In demos: show each phase as a UI panel (even if implemented as one model call), so the audience sees explicit governance rather than “magic output.”

What gets emitted (artifacts)

receipts + tokens
NRC Receipt immutable
Contract hash, versions, timestamps. Binds the run to a governance lane.
Evidence Bundle trace
Policy references, mappings, provenance notes, and evidence-quality classification.
Entitlement Token gate
Status + reasons + required reviewers + conditions for release.
AER Audit Log ledger
Event-by-event record: phase outcomes, defeater triggers, release label, distribution scope.
Released Artifact memo
CASRC-ready draft labeled by posture; never presented as an institutional decision unless entitled.
Default-safe behavior: if authority is ambiguous or evidence is incomplete, entitlement resolves to review_required and release remains internal_draft.

Example: a complete run record

single JSON
{ "run_id": "aer_2026-01-29T14:02:11Z_7c2f", "nrc_receipt": { "nrc_id": "NRC.SUTTER.TYPEIII.RETEAM.RISK_SCORE.AUTHORITY", "hash": "sha256:…", "issued_at": "2026-01-29T14:02:11Z", "policy_pack_version": "policy_pack:v3", "defeater_library_version": "defeater_library:v5" }, "phase_outcomes": [ {"phase":"preflight","status":"pass"}, {"phase":"ask","status":"pass","notes":["bounded scope confirmed","audience=CASRC"]}, {"phase":"evidence","status":"pass","evidence_refs":["policy:access_control@v2","policy:privacy@v4","casrc:decision@2025-12"]}, {"phase":"defeaters","status":"pass","checks":[ {"name":"prompt_injection","status":"pass"}, {"name":"data_exfiltration","status":"pass"}, {"name":"authority_escalation","status":"pass"}, {"name":"policy_conflict","status":"pass"} ]}, {"phase":"draft","status":"produced","artifact_id":"artifact:casrc_memo:2026-01-29:001"}, {"phase":"entitle","status":"review_required","required_reviewers":["Security Officer","Privacy Counsel","CASRC Chair"]}, {"phase":"release","status":"internal_draft","distribution":"restricted"}, {"phase":"monitor","status":"armed","freshness_expires_at":"2026-04-29T14:02:11Z"} ], "release_label": "internal_draft", "notes": "Draft only. Not a decision. Not medical advice. Not action-authorizing." }

This record is the bridge from “LLM output” to “institutional artifact”: it explains what happened, why it happened, who must sign off, and what was released.

Quick links

anchors
Jump to NRC Contract Jump to AER Flow Return to Learning
These anchors match the links you referenced from learning.html.