This starts chapter F1. Its course guide is F1 in the Function F course guide →
Not recorded yet. The lesson below is complete and runnable today — the video is added later without touching this page.
recordings/F1.0.mp4A trustworthy-AI statement with no owner per property, so every property is somebody else's job.
One register, risk-tiered, with each property mapped to a control, an owner and evidence that can be re-checked.
Take the seven properties and assign each an owner in your own organisation. The gaps are the programme.
A list of approved products works at forty products. It does not survive a thousand agents, most of them assembled by people who do not think of themselves as building software. Governing autonomy is a different exercise from approving tools.
cybertravels/governance/__init__.py is six trustworthy-AI properties with two columns beside each: the function that owns it and the artefact that evidences it. Call unowned() with the properties your own statement claims and it returns the ones nothing in this system evidences — usually a longer list than anybody expects, because a statement is written before the artefacts are.Governance stated as a table rather than a value: each property a trustworthy-AI claim makes, the function that owns it, and the artefact that evidences it — because a property with no artefact is a value, and values do not survive an audit.
A trustworthy-AI statement with no owner per property means every property is somebody else's job.
Assign each of the seven properties an owner, and read the three chapters as one unit built, evidenced and run.
Properties with a named owner. Security owns one of seven outright, which is why this is not a security document.
Measure this
| what to measure | denominator or target |
|---|---|
| trustworthy-AI properties with a named owner | count out of seven; security owns one outright |
approving tools governing autonomy +-------------------+ +---------------------------+ | a list of 40 | | levels + conditions | | grows forever | vs | attach to behaviour | | governs nothing | | still works at 1000 agents | +-------------------+ +---------------------------+ seven trustworthy-AI properties, one owner each valid+reliable . safe . secure+resilient . accountable+transparent explainable . privacy-enhanced . fair security owns one of the seven outright
Someone at CyberTravels signed off on the platform. Function F is about whether that signature still means anything.
It has to, because the sign-off happened when CyberTravels was a chatbot. It now issues refunds, writes code, reads invoices and indexes contracts. Nothing about the approval was wrong on the day; everything about it is stale, and the approval process has no step that notices.
Governing autonomy rather than approving tools is the shift. A list of approved products works at forty products. CyberTravels will not stop at four agents, and neither will the list.
The vocabulary is trustworthy AI, and it is worth being precise about, because it is used loosely everywhere else. Seven properties, and not one of them belongs to a single team:
| property | what it means for CyberTravels |
|---|---|
| valid and reliable | it recommends hotels that exist, repeatably, and somebody measured that |
| safe | a wrong recommendation does not become a $5,000 refund |
| secure and resilient | it withstands the twelve risks in the register, and recovers |
| accountable and transparent | a named person owns it, and its actions are visible |
| explainable | the reason it issued a refund can be recovered afterwards |
| privacy-enhanced | passport numbers do not end up in a log or a vector store |
| fair, harmful bias managed | it does not quietly serve some travellers worse |
Security owns one of the seven outright. That ratio is the whole reason this function exists as more than a security document.
Contributing evidence to six properties you do not own only works if the evidence is in a form the other six owners can use, which is why the whole of Function F is written in one unit: a key control indicator. F1.1 defines it — a number computed from the estate, with a denominator, and a target set before the measurement is taken — and the three chapters are that one unit built, evidenced and run:
Every lesson in this function carries a line under its concept saying what it contributes to that indicator or takes from it. Where a lesson looks like it belongs to a different argument, that line is the place to check.
Two rows of the register belong to this function outright: R2, where a guardrail was disabled for a demo and nobody had to approve it, and R12, where contracts were indexed for better answers and became searchable by contractors.
| trustworthy-AI property | who owns it at CyberTravels | security's share |
|---|---|---|
| valid and reliable | engineering + the eval harness (C2.19) | contributes evidence |
| safe | the CyberTravels product owner + risk | contributes evidence |
| secure and resilient | security | owns it |
| accountable and transparent | the named system owner | contributes evidence |
| explainable and interpretable | engineering + model risk | contributes evidence |
| privacy-enhanced | privacy office + engineering | contributes evidence |
| fair, harmful bias managed | product owner + legal | contributes evidence |
The approval was accurate when it was given. This is what changed underneath it, and which of those changes raised a ticket.
| at approval | today | did it go through change management? |
|---|---|---|
| one agent, answers questions | four agents | no |
| read-only | issues refunds | no |
| no repository access | opens and self-approves pull requests | no |
| no document store | indexes contracts and pricing models | no |
| hosted model, fixed version | provider upgrades it silently | no — you may not be told |
Governance work is mostly translation, and the first translation is the cheapest: a control you already operate is usually named in several framework vocabularies at once. cybertravels/governance/__init__.py is the tree increment this lesson adds — six trustworthy-AI properties, each with the function that owns it and the artefact that evidences it, because a property with no artefact is a value and values do not survive an audit. This skill is the lookup in the other direction:
The skill — skills/regulatory/framework-reference-lookup/SKILL.md
name: framework-reference-lookup
description: >-
Look up which control vocabularies a lesson maps to, and which lessons address
a given control, from the commons' own mapping file. Use when answering "where
is this framework covered", when preparing an audit response, or when checking
a framework's coverage for gaps.
allowed-tools: Read, Grep, GlobNobody asks what a lesson maps to. They ask "show me where human oversight is addressed", and the answer has to be a list of things that exist rather than a paragraph asserting coverage.
This reads curriculum/frameworks.json — the same file every lesson page is labelled from — so a reference table and a lesson's chips cannot disagree.
| framework | what it is | when it is the right lens |
|---|---|---|
| OWASP Top 10 for LLM Applications | LLM01–LLM10, application-level risks | reviewing a feature that calls a model |
| OWASP Agentic AI Top 10 | T1–T15, threats specific to agents | the system plans and calls tools |
| MITRE ATLAS | adversary tactics against AI systems | describing what an attacker did |
| NIST AI RMF 1.0 | GOVERN, MAP, MEASURE, MANAGE | organising a programme, not a bug |
| EU AI Act | Regulation 2024/1689, by article | an obligation, with a deadline |
The first three describe what can go wrong. NIST describes how you organise to find out. The EU AI Act describes what you must be able to show. A control usually needs one of each, which is why lessons carry several.
Preparing an audit or assurance response, checking coverage before claiming it, and picking the right vocabulary for a finding — an ATLAS tactic in a risk register and a NIST function in an incident write-up are both category errors.
1 — Decide which direction you need. Lesson → controls for a reader; control → lessons for an auditor.
2 — Use the vocabulary the audience uses. Do not translate a regulator's article into a threat id for them.
3 — Read the coverage counts as a gap finder. A control with one lesson is thin; one with none is a hole.
4 — Follow the link before quoting the label. The labels are indicative mappings, not a certification.
Output — from a real run:
Art. 14 Human oversight 17 lessons
B1.2 OWASP LLM01 · OWASP T6 · ATLAS AML.T0051 · ATLAS Initial Access · NIST MAP · EUAI Art. 15{
"frameworks": [{"name": "str", "url": "str", "size": "str"}],
"euai_articles": [{"article": "str", "title": "str", "lessons": 0}],
"coverage": {"nist": {"GOVERN": 0}, "owasp": {"LLM01": 0}},
"lookup": {"by_lesson": {"B1.2": ["str"]}, "by_control": {"Art. 14": ["str"]}}
}Three ways to do this lesson. Pick one. They run the same procedure against the same code — what changes is who drives it, and how much you see.
The agent reads the lesson, explains the idea, fetches the code, runs the check and answers your questions as you go. This is the one to take if you are here to learn.
Install it, once. From the folder you cloned. --all does every agent it finds on your machine:
python3 scripts/install_skills.py --all --lessons F1.0Then restart your agent and open it in that folder. On Windows, if python3 says Python was not found, use python instead.
Then pick f1-0-start-here:
| agent | install just for this agent | start it |
|---|---|---|
| Claude Code | python3 scripts/install_skills.py --tool claude --lessons F1.0 | type /f1-0-start-here |
| GitHub Copilot (VS Code) | python3 scripts/install_skills.py --tool copilot --lessons F1.0 | type /f1-0-start-here in Chat |
| Cursor | python3 scripts/install_skills.py --tool cursor --lessons F1.0 | type / in Agent chat and search for it |
| Codex | python3 scripts/install_skills.py --tool agents --lessons F1.0 | type $f1-0-start-here, or run /skills |
No agent, no conversation. The same lesson executes and prints the same readback. Take this one if you have no assistant, if you are reviewing rather than learning, or if you want the result without the teaching around it.
python3 scripts/lesson.py F1.0Neither of the above, and no model needed. The first command writes CyberTravels exactly as it stood at the end of this lesson; the second prints the diff — the lines this lesson added or changed, and nothing from any later one.
python3 scripts/checkpoint.py --at F1.0 --out work/cybertravels
python3 scripts/checkpoint.py --at F1.0 --diffOn Windows, type python wherever these say python3 — and use \ instead of / in the paths. Everything else is identical. A0.0 step 2 explains why.
Ways 1 and 2 need a model; way 3 does not. A signed-in Claude Code CLI needs no API key, and any OpenAI-compatible endpoint works too. With neither, the audit exits 2 and says so rather than inventing an answer. A0.0 sets this up.
Ways 1 and 2 both end with the same readback: What I did, What changed, The number and Read this next. A step that was skipped or refused is reported as exactly that, never as a pass.
If you did the last lesson’s challenge, expect this to stop. Most challenges ask you to edit the code, and ways 1 and 2 will not overwrite your edits: you get stopped, not a failure, with two options — --out for a fresh folder that keeps your work, or --force to discard it and start this lesson clean.
Seven trustworthy-AI properties with a named owner each and security owning exactly one outright. Five material changes to CyberTravels since its approval, none of which raised a ticket. The three chapters laid out by how far from the system each one sits.
Find the approval record for one agent you run and compare it to what that agent does today. The gap is the programme, and the reason nobody noticed it is what chapter 10 is for.
Skill source: skills/regulatory/framework-reference-lookup