Not recorded yet. The lesson below is complete and runnable today — the video is added later without touching this page.
recordings/F1.10.mp4Legal, compliance, privacy, cyber and model risk each hold part of the AI control estate and none holds all of it. The programme fails at the seams between them, not inside any one.
A stakeholder operating model naming who decides, who tests, who signs — and where the handoffs leave gaps nobody is watching.
Map five stakeholders to the controls each operates, then locate the four classic seam failures in your own estate.
Legal, privacy, model risk and security each hold a piece of the AI control estate, and none of them holds all of it. Every failure in this function is a failure at a boundary between two of those teams.
seam_map() sorts the estate into owned, shared and unowned — and makes the point that a shared part is not safer than an unowned one. It is an unowned one that looks covered from both sides. Two parts of this system are owned by nobody, and one of them is "evidence that a control works".Where the estate is held, and the distinction that matters: a part two functions share is not safer than one nobody holds, because it is a gap that looks covered from both sides.
Five functions each hold part of the AI control estate and none holds all of it, so each assumes another has the middle.
Map who asks what: liability, obligation, lawful basis, containment, fitness.
One reading, five readers. The question nobody asked is the one no indicator was built for.
Measure this
| what to measure | denominator or target |
|---|---|
| one reading, read by five readers | count of distinct questions asked of it; the one nobody asked is the one no indicator was built for |
the AI control estate, and who holds a piece of it
+----------+ +---------+ +--------------+ +----------+ +---------+
| legal | | privacy | | model risk | | security | | product |
+----------+ +---------+ +--------------+ +----------+ +---------+
\_____________\________|________/_____________/
the seams
every failure in this function happens at a boundary, not inside a boxFive functions hold the AI control estate between them, and none of them holds all of it. The programme does not fail inside any one function. It fails at the seams, where each side reasonably believed the other had it.
| Stakeholder | The question they are actually asking |
|---|---|
| Legal | Can we be held liable, and under what theory? |
| Compliance | Which obligations apply, and can we demonstrate we meet them? |
| Data Privacy | Whose data is in this, on what basis, and for how long? |
| Cyber Security | Can this be attacked, and can we contain it if it is? |
| Model Risk | Is this fit for its stated purpose, and will we know when it stops being so? |
Two seats are routinely forgotten. The business or product owner in the first line, who defines intended purpose and risk appetite and funds remediation — if that seat is empty, the other five are governing an orphan. And internal audit in the third line, whose job is independent assurance that the five are doing what they claim.
What makes this a lesson rather than an org chart is the four gaps below. Each one is a real failure that happens because both sides made a reasonable assumption about the other.
Anchor → F1.1. One indicator, five readers, five different questions. Legal reads a containment number as liability, model risk reads it as fitness, privacy reads it as exposure. Publishing the reading is not the same as it being consumed, and the question nobody asked is the one no indicator was built for.
| function | the question it is asking | the controls it holds |
|---|---|---|
| legal | can we be held liable, and under what theory | contract clauses · acceptable-use terms · IP screening · e-discovery retention |
| compliance | which obligations apply, can we demonstrate we meet them | AI policy · use-case classification · attestations · disclosure triggers |
| privacy | whose data, on what basis, for how long | impact-assessment gate · PII redaction · retention schedules · transfers |
| cyber | can this be attacked, can we contain it | agent identity and JIT authz · tool permissions · sandbox and egress · guardrails · telemetry · kill switch |
| model risk | is it fit for purpose, will we know when it stops being | pre-deployment validation · thresholds · drift alerting · revalidation |
| the seam | one side assumed… | the other assumed… | what happened |
|---|---|---|---|
| agent traces are full of personal data | cyber: privacy owns retention of anything containing personal data | privacy: security owns the log store, so security sets its schedule | no schedule was set; three years of prompts are discoverable |
| the model was validated, the tools were not | model risk: validation covered the model, which is our scope | cyber: MRM signed it off, so the deployment was approved | an agent holds production write access that was never in scope |
| “no training on our data” was negotiated, never instrumented | legal: the clause is in the contract and it is binding | cyber: legal handled the vendor, so the restriction is handled | nobody built the control that verifies the vendor honours it |
| the use case was risk-tiered before it had tools | compliance: classified low-risk — it was a chatbot when we saw it | business owner: we shipped features, not a new use case | it files tickets, sends mail and moves money at the low-risk tier |
Five functions, every one reporting coverage, and four use cases nobody governed. The skill counts the controls each function operates rather than opines on, then walks real use cases through the map to find the seams.
The skill — skills/programme/stakeholder-seam-map/SKILL.md
name: stakeholder-seam-map
description: >-
Map which control function operates which controls and what question each is
asking, then find the seams where two individually reasonable assumptions
leave a use case ungoverned. Use when everyone reports full coverage and
something was still missed.
allowed-tools: Read, Grep, GlobGovernance failures cluster in the seams. Legal assumes security assessed the tool; security assumes procurement assessed the vendor; procurement assumes it was an internal build. Each assumption is reasonable, each function reports full coverage, and the use case is governed by nobody.
Standing up an AI governance programme, and after any incident where several functions were involved and none of them owned it.
1 — List the functions and the question each asks. Legal, compliance, security, privacy, model risk, internal audit. The question is what makes their coverage claim meaningful — "is it lawful" is a different sweep from "is it contained".
2 — Count the controls each function operates. Operates, not opines on. The total is usually smaller than the sum of what everyone believes they cover.
3 — Take each function's self-report at face value and record it. This is the state everybody is in before the exercise.
4 — Walk real use cases through the map. For each, which function actually governed it. The ones nobody claims are the seams, and there are always some.
5 — Write the seam as a pair of assumptions, with an owner. "Legal assumed security reviewed the connector; security assumed it was procurement" — then name who closes it. A seam with no owner is a seam next quarter.
Input — the fixture committed at the top of scripts/stakeholder_seam_map.py. Edit it and re-run: the buckets, counts and verdicts below are derived from it, not hard-coded.
Output — the opening lines of a real run:
compliance 4 controls green
cyber 6 controls green
legal 4 controls green
model_risk 4 controls green
privacy 4 controls green
functions reporting green : 5/5
open seams : 4The run continues past this. test_skills.py executes the script on every build, with no model configured — so what CI proves is that it runs and refuses legibly, not that it prints these lines. The output above is a recorded run against a real model, and nothing re-diffs it: a model's answer is not reproducible, and this repository does not claim otherwise anywhere it can be checked.
{
"functions": [{"name": "str", "question": "str", "controls_operated": 0}],
"self_reports": [{"function": "str", "claims_coverage": true}],
"use_cases": [{"name": "str", "governed_by": ["str"], "ungoverned": false}],
"seams": [{"assumption_a": "str", "assumption_b": "str", "owner": "str|null"}]
}Three ways to do this lesson. Pick one. They run the same procedure against the same code — what changes is who drives it, and how much you see.
The agent reads the lesson, explains the idea, fetches the code, runs the check and answers your questions as you go. This is the one to take if you are here to learn.
Install it, once. From the folder you cloned. --all does every agent it finds on your machine:
python3 scripts/install_skills.py --all --lessons F1.10Then restart your agent and open it in that folder. On Windows, if python3 says Python was not found, use python instead.
Then pick f1-10-the-stakeholder-map:
| agent | install just for this agent | start it |
|---|---|---|
| Claude Code | python3 scripts/install_skills.py --tool claude --lessons F1.10 | type /f1-10-the-stakeholder-map |
| GitHub Copilot (VS Code) | python3 scripts/install_skills.py --tool copilot --lessons F1.10 | type /f1-10-the-stakeholder-map in Chat |
| Cursor | python3 scripts/install_skills.py --tool cursor --lessons F1.10 | type / in Agent chat and search for it |
| Codex | python3 scripts/install_skills.py --tool agents --lessons F1.10 | type $f1-10-the-stakeholder-map, or run /skills |
No agent, no conversation. The same lesson executes and prints the same readback. Take this one if you have no assistant, if you are reviewing rather than learning, or if you want the result without the teaching around it.
python3 scripts/lesson.py F1.10Neither of the above, and no model needed. The first command writes CyberTravels exactly as it stood at the end of this lesson; the second prints the diff — the lines this lesson added or changed, and nothing from any later one.
python3 scripts/checkpoint.py --at F1.10 --out work/cybertravels
python3 scripts/checkpoint.py --at F1.10 --diffOn Windows, type python wherever these say python3 — and use \ instead of / in the paths. Everything else is identical. A0.0 step 2 explains why.
Ways 1 and 2 need a model; way 3 does not. A signed-in Claude Code CLI needs no API key, and any OpenAI-compatible endpoint works too. With neither, the audit exits 2 and says so rather than inventing an answer. A0.0 sets this up.
Ways 1 and 2 both end with the same readback: What I did, What changed, The number and Read this next. A step that was skipped or refused is reported as exactly that, never as a pass.
If you did the last lesson’s challenge, expect this to stop. Most challenges ask you to edit the code, and ways 1 and 2 will not overwrite your edits: you get stopped, not a failure, with two options — --out for a fresh folder that keeps your work, or --force to discard it and start this lesson clean.
Five control functions, the question each is asking and the controls each operates — 22 in total. Four seam failures laid out as pairs of individually reasonable assumptions, and every function still self-reports green while all four gaps are open. Naming one accountable owner per handoff closes them, and a use case with all five control functions and no business owner is shown to be ungoverned.
Pick one of the four seams and find out, today, who owns it in your organisation. The answer 'I assume security does' from one side and 'I assume privacy does' from the other is the finding.
Tools used
Skill source: skills/programme/stakeholder-seam-map