Recommended resources
The freely available resources this lesson will direct you to.
Welcome back. Last lesson, you proposed a Harborline scorecard: less agent effort without more rework, successful evidence-finding or escalation, supported answers, and no restricted-document disclosures in the agreed tests. Those measures are still proposals. Someone must establish what counts as approved guidance, someone must test the agent’s actual task, and someone must decide whether the resulting business improvement is worth pursuing.
This lesson is about identifying those people and the decisions they must validate. By the end, you will have a stakeholder map for Harborline’s returns-guidance assistant—not merely a list of people to invite to a meeting, but a way to establish who provides evidence, who can approve a decision, and who can stop a pilot when a required condition is unmet.
Start with the decision each person is qualified to make
A knowledge assistant can pass a software test while failing its intended purpose. Suppose it cites a returns PDF that opens correctly, but the PDF has been withdrawn. A developer can confirm that the link works; the owner of the returns guidance must confirm that the document is authoritative. Likewise, an agent can report that an answer feels useful without being able to authorize disclosure of a restricted document.
The distinction is expertise versus decision authority. Many people should contribute observations. Fewer can approve a particular risk or business decision. The NIST AI Risk Management Framework Playbook recommends documenting responsibilities and communication lines, and it notes the value of review that can challenge the development team rather than simply endorse its work.
Read NIST’s guidance to see why a stakeholder map needs explicit authority and room for independent challenge, not just broad participation.
In “Govern 2,” use the first subsection on documented roles and lines of communication. Under “About,” read the explanation, from the opening sentence about defining responsibilities through the paragraph ending with concerns being bypassed or ignored. Then, under “Suggested Actions,” read the role list, from the action beginning “Establish policies” through “Oversight functions.” Focus on why testing, oversight, product ownership, and development need identifiable responsibilities.
For Harborline, start with four questions: Who can validate the knowledge? Who can validate its safe use? Who can validate the agent’s experience? Who can validate the business result? Each question points to different evidence and may require more than one person. The team building the assistant contributes technical evidence across all four, but it should not be the sole judge of its own results.
The diagram below names four common AI-governance concerns. It is a useful reminder that security is not the only reason for review; transparency and oversight also matter when an assistant presents apparently authoritative answers.
Identify who can validate the knowledge and its permitted use
Imagine Harborline’s team finds two returns PDFs with conflicting instructions. One appears newer. Who decides which may be indexed and cited? Not necessarily the person who can upload them, and not necessarily the engineer who can sort them by date.
The returns-policy owner or subject-matter expert should validate which guidance is approved, how conflicting or withdrawn versions are treated, what evidence supports a correct answer, and when the assistant must direct an agent to a specialist. If ownership differs across document collections, name an owner for each relevant collection rather than appointing a single expert to approve everything. A document or data steward may maintain inventories, quality checks, metadata, and update procedures; confirm whether that steward also has authority to approve policy content before assigning that decision to them.
The short Lights OnData segment describes the steward’s practical quality and metadata responsibilities. As you watch, distinguish keeping information reliable from deciding what Harborline’s returns policy means.
What Is A Data Steward | What Does It Mean To Be A Data Steward?
Watch “What Is A Data Steward | What Does It Mean To Be A Data Steward?” from Lights OnData to clarify what a steward could contribute to Harborline’s document validation.
Watch the stewardship roles. The segment covers data quality, metadata, governance procedures, and departmental feedback. Consider which of those activities would help detect an outdated PDF, and which still require the policy owner’s judgment.
Now separate document approval from permission to disclose. A current document may still be restricted to certain staff. Harborline’s information-security or identity-and-access owner must validate the permission rules and the results of tests using authorized and unauthorized accounts. They should review whether restricted text could leak through an answer, summary, or citation preview. The source-system or IT owner can explain existing access controls and how permissions are maintained; the security owner should confirm how those controls apply to the proposed assistant.
A privacy or data-protection lead should review whether personal information is present in documents, prompts, test cases, or logs, and what handling rules apply. Legal and compliance specialists should be involved when the proposed use raises contractual, regulatory, retention, or disclosure questions. Which roles are required, and who can approve the outcome, depends on Harborline’s jurisdiction and its own governance arrangements—not on a generic job-title checklist. The UK Information Commissioner’s Office offers one example of making leadership, privacy, technical, and operational responsibilities explicit; its UK-specific requirements should not be assumed to apply to Harborline.
Governance and accountability in AI | ICO
Read the Information Commissioner’s Office guidance as an example of how an organization can assign privacy and oversight responsibilities. Apply the role distinction, not a presumed UK legal obligation, to Harborline.
In the opening section, begin with the paragraph starting “This section is aimed at senior management.” Read the responsibilities through the “Ways to meet our expectations” item about assigning technical and operational roles. Focus on the difference between leadership endorsement, privacy oversight, and day-to-day technical responsibilities.
For the pilot, the practical output of these conversations is not “security has been consulted.” It is a record of which document collections may be used, who verifies their approved status, which users may see them, and which test results are required before release.
Give agents and business owners different validation jobs
Harborline’s returns agents are essential usability validators because they perform the task. Ask a representative group to work through cases using the proposed assistant and the current workflow. They can show whether citations are easy to inspect, whether an escalation instruction makes sense during a live case, and whether the tool saves effort or creates extra checking work. Include agents with different levels of experience and, where relevant, different access permissions. A team lead or service-operations manager can help select realistic cases, arrange the pilot, and identify effects on handoffs and specialist queues.
Agents’ feedback should be acted on, not treated as a ceremonial sign-off. NIST’s Playbook emphasizes feedback from people outside the team that developed the system, including intended users, when judging whether an AI system fits its actual context of use.
Return to NIST’s Playbook for the reason user participation belongs in validation, including when technically sound results appear promising.
In “Govern 5,” use the first subsection on engagement with relevant AI actors. Under “About,” read the discussion, beginning with testing beyond the development setting and ending with the warning against perfunctory engagement. Focus on how feedback can reveal task conditions that a laboratory evaluation misses.
Business validation belongs to Harborline’s executive sponsor or accountable business owner, supported by the service-operations manager and whoever maintains the case and staffing measures. They must agree on eligible returns cases, verify the pre-pilot baseline, approve how agent effort and policy-related rework will be measured, and judge whether a measured improvement warrants further investment. The sponsor should understand the limitations of the pilot: a faster median on a small case set is not, by itself, a proven financial return.
These roles overlap but are not interchangeable. An agent can demonstrate that finding a citation is cumbersome; the policy owner can determine whether the citation supports the answer; the operations manager can check the measured time; the sponsor can judge whether the benefit justifies the next step. No single favorable opinion resolves all four questions.
Make the stakeholder map usable at a pilot decision
A concise map connects each validator to a specific decision and its evidence. This draft uses roles rather than names because Harborline has not yet confirmed its organization chart or delegated authorities.
| Validation area | People to identify at Harborline | Decision and evidence they must review |
|---|---|---|
| Data and policy | Returns-policy owner; owners of other included collections; document or data steward | Approve eligible sources, document status, conflict handling, and expected evidence for sample cases. Review the source inventory and disputed examples. |
| Security | Information-security and identity-and-access owner; source-system owner | Confirm permission rules and review restricted-document test results, including answers and citation previews. |
| Privacy and compliance | Privacy or data-protection lead; legal or compliance specialist where applicable | Determine required handling and approvals for personal information, records, and any applicable obligations. Review proposed data flows and pilot practices. |
| Usability | Representative returns agents; team lead; UX researcher if available | Observe task attempts and review success, failure, effort, and escalation findings across case types. |
| Business value | Accountable sponsor; service-operations manager; metrics owner | Approve the baseline and measurement method, then judge effort reduction, rework, costs, and whether a larger rollout merits consideration. |
The delivery team or consultant coordinates this work: it records assumptions, supplies the prototype and test results, and makes unresolved issues visible. It should not silently substitute its judgment for a client policy owner’s approval or a security owner’s assessment. Likewise, a sponsor’s enthusiasm for time savings does not make an access-control failure acceptable.
Before scheduling a go/no-go meeting, add four fields to each row: named person, delegated authority, evidence due, and escalation route. If a person can advise but cannot approve, record who can. If two owners disagree—for example, a policy owner wants a useful document included but security says its permissions cannot yet be enforced—record the disagreement and the decision required. Until the necessary owners resolve it, the document stays outside the pilot scope. This is a proposed decision rule for Harborline, not a claim that it has already adopted one.
Validation also occurs at different moments. Before building with documents, confirm source ownership and permitted use. Before the pilot, review the policy examples, representative agent tasks, privacy handling, and access-control tests. After the pilot, bring task results, technical failures, effort, and rework together for the business decision. Keep a record of what each owner accepted, rejected, or requested to change; an invitation to a meeting is not evidence of approval.
Conclusion
To identify stakeholders, begin with the decision that needs validation, then find the people with the relevant knowledge and authority. Harborline needs policy and document owners for trustworthy sources, security and privacy roles for safe use, agents and operations staff for realistic task validation, and an accountable sponsor for business value. Give each a defined question, evidence to review, and a way to raise or block unresolved concerns.
With those validators identified, Harborline can make informed scope choices rather than treating every requested capability as equally ready. The next lesson will use a structured method to prioritize candidate MVP features.