Write the lab's AI policy, standard and procedure at the right level

short · 40 min · Objective 4.1

Task

Write the three governance documents for your own lab system: a short AI policy with nine required sections, a standard that makes it measurable, and a procedure for asking to add a new AI use. Then prove that each rule sits at the level the lesson assigns it: no technical value in the policy, a concrete value in most lines of the standard, and ordered steps with an owner in the procedure.

Steps

  1. Create lab/ai-policy.md with exactly these nine level-two headings, in this order: ## Purpose and scope, ## Roles and accountability, ## Acceptable use, ## Data rules, ## Approval and re-approval, ## Logging and monitoring, ## Incident reporting, ## Exceptions, ## Review. Keep it under 600 words. Scope must name the systems it covers: the model runner, the gateway and the retrieval app.
  2. Write policy statements only: what is required and why. 'Restricted documents may be returned only to users authorised to read them' is policy. An address, a port, a version, a token limit or a retention period in days is a standard, and does not belong here.
  3. Create lab/ai-standard.md with at least eight lines of the form - STD-03 (Data rules): ..., where the bracket names the policy section the line implements. At least six must contain a number: the address the runner binds to, the count of fields every gateway record carries, the log retention in days, the maximum prompt tokens, the model version in service, the review interval in months.
  4. Create lab/procedure-new-ai-use.md. Its first line is Owner: <role>, naming the team that performs it, followed by at least six numbered steps: who a request goes to, what the requester supplies, what decides the depth of review, where the decision is recorded and when it lapses.
  5. Prove three standard lines against the running system. Record them in lab/standard-evidence.csv with header std_id,command,result, run each command and paste what it printed: for example ss -ltn showing the runner listening only on 127.0.0.1, or a count of the fields in the last gateway record.
  6. Plant a fault to show the check can fail: add 'the gateway listens on port 8088' to the policy, run the verify block, watch the technical value count rise above zero, then move the sentence into the standard.

Verify

cd ~/secai-lab
python - <<'EOF'
import csv, re
want = ["Purpose and scope", "Roles and accountability", "Acceptable use",
        "Data rules", "Approval and re-approval", "Logging and monitoring",
        "Incident reporting", "Exceptions", "Review"]
text = open("lab/ai-policy.md", encoding="utf-8").read()
got = [l[3:].strip() for l in text.splitlines() if l.startswith("## ")]
print("missing sections:", [w for w in want if w not in got])
print("order correct:", [g for g in got if g in want] == want)
tech = re.findall(r"[0-9]+[.][0-9]+|:[0-9]{2,5}|ports? *[0-9]+|[0-9]+ *(?:tokens|ms|days|months)", text, re.I)
print("technical values in policy:", len(tech))
std = [l for l in open("lab/ai-standard.md", encoding="utf-8") if l.startswith("- STD-")]
ref = lambda l: l.split("(", 1)[1].split(")", 1)[0] if "(" in l else ""
print(len(std), "standard lines;",
      sum(any(c.isdigit() for c in l.split(":", 1)[-1]) for l in std), "with a value")
print("citing no policy section:", [l.split()[1] for l in std if ref(l) not in want])
ev = list(csv.DictReader(open("lab/standard-evidence.csv", encoding="utf-8")))
print("standard lines evidenced:", sum(bool(r["command"] and r["result"]) for r in ev))
EOF
grep -cE '^[0-9]+[.] ' lab/procedure-new-ai-use.md
grep -c '^Owner: ' lab/procedure-new-ai-use.md

No missing sections, order correct True, zero technical values in the policy, eight or more standard lines of which six or more carry a value, none citing an unknown section, three evidenced lines, six or more procedure steps and exactly one owner line. A policy that scores above zero on technical values will need board-level change control every time a port moves.

Notes

The plant in step 6 matters more than it looks. The pattern match that counts technical values is crude, and you only know it catches a port number because you watched it do so. Keep these three files: the applied lab and the capstone build on them rather than starting again.

This is an independent study companion for CompTIA SecAI+ CY0-001 and is not produced by or endorsed by CompTIA.