Ai governance

Skill valdomirosouza/agent-skills/skills/ai-governance

Expert AI Agent Skills for SDD, SRE, DevSecOps and Enterprise Engineering

Install

npx -y skills add valdomirosouza/agent-skills --skill ai-governance

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Applies AI responsibility, ethics, and governance standards to systems that use or are built with artificial intelligence. Covers human accountability, AI risk classification, prompt security, LLM observability, and EU AI Act compliance. Use when designing AI-assisted features, reviewing AI usage in systems, classifying AI risk level, implementing prompt versioning, auditing AI outputs, or assessing compliance with the EU AI Act or organizational AI policies.

SKILL.md

5.3 KB, as published. Nobody here has run it

AI Governance

Core principle

AI has no legal, moral, or organizational responsibility. It is a tool. The human engineer is always the final decision-maker and is fully accountable for AI outputs used in production.

What AI can and cannot do in this standard
Human responsibility matrix
AI risk classification
Ethical principles checklist
Prompt security (prompt injection, versioning)
LLM observability

AI Can / Cannot

AI Can (suggestions only)	AI Cannot (human gate required)
Generate code, specs, tests, documentation	Approve PRs or specs
Identify patterns, vulnerabilities, inconsistencies	Merge without human review
Assist in incident triage and RCA	Execute actions in production
Analyze logs and metrics	Classify final security risk
Suggest runbook steps	Make architectural decisions without review
Draft threat models	Take irreversible actions autonomously

Human Responsibility Matrix

Role	Responsibility over AI outputs
Engineer	Review, test, and approve all AI-generated code
Tech Lead	Validate AI-generated specs align with architecture
SecOps	Audit AI usage for compliance with security policies
Product	Confirm AI-generated features meet business requirements
Legal / DPO	Assess privacy implications of AI usage on customer data

AI Risk Classification

High Risk — mandatory committee review:

AI making credit, health, or employment decisions
AI with access to customer PII
AI executing irreversible actions

Medium Risk — Tech Lead + SecOps review:

AI generating code for critical systems
AI analyzing production logs
AI in incident response flows

Low Risk — engineer review:

AI generating documentation and specs
AI in development environments
AI for internal TOIL automation

Ethical Principles — Operational Checklist

Transparency

Users informed when interacting with AI-based systems
AI outputs labeled as such in internal interfaces
Model and version used are documented and traceable

Fairness

AI outputs reviewed for bias in decisions affecting users
Automated decisions with significant user impact have mandatory human review
High-risk AI systems documented under EU AI Act requirements

Privacy

PII is NOT sent to external AI models without a DPA (Data Processing Agreement)
Customer data not used in prompts without anonymization
Logs of prompts/responses with sensitive data protected as production logs

Auditability

All AI usage in critical flows is logged and traceable
AI decisions with user impact have an explanation mechanism (Right to Explanation — LGPD/GDPR)
Prompt versions are versioned alongside code

AI Security

Protection against prompt injection in AI-integrated systems
AI outputs validated before use in critical operations
Rate limiting and usage audit on AI API calls
AI model has no direct access to production systems without an intermediary layer

AI Traceability Header

Every file generated with AI assistance MUST include:

# ============================================================
# AI-GENERATED ARTIFACT
# Generated by  : Claude Sonnet 4.6 / GPT-4o / [model]
# Prompt ID     : [hash or traceable ID]
# Generated at  : 2024-01-15T10:30:00Z
# Reviewed by   : [engineer name]
# Approved at   : 2024-01-15T11:00:00Z
# Spec reference: SPEC-2024-042
# ============================================================

Prompt Security

Prompt injection prevention:

Never concatenate user input directly into system prompts
Validate and sanitize all user-provided content before inclusion in prompts
Use structured prompt templates with clearly demarcated user input sections
Monitor for anomalous prompt patterns in production

Prompt versioning:

prompts/
  v1/
    payment-categorizer.txt
    risk-scorer.txt
  v2/
    payment-categorizer.txt   ← Current

Prompts versioned in repository alongside code
Changes to prompts follow the same PR and review process as code changes
Prompt version referenced in AI-generated artifact headers

LLM Observability

Metric	Purpose	Alert on
Latency per API call	Performance baseline	p99 > SLO
Token cost per request	Cost control	Budget threshold
Error rate	Reliability	> 1% for 5 min
Output quality score	Drift detection	Degradation vs baseline
Prompt injection attempts	Security	Any detected attempt

Model drift detection: Compare output distributions weekly. If behavior changes significantly without model version change → investigate and re-evaluate outputs.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.