HR policy RAG chatbot (global workforce)
More
Recommended next steps
Highest-priority open actions
At a glance
- Owner
- Aisha Rahman
- Sponsor
- Chief People Officer
- Business unit
- Human Resources
- Lifecycle stage
- Operate
- Architecture
- No amplifiers declared
Top risks driving the decision
- R-DA-01 PII exposure via retrieved documents
- R-AI-01 Hallucinated policy answers
Key conditions
- Corpus excludes salary and medical records
- Every answer includes source citation
- GDPR Article 22 disclosure visible in Teams
What drives the score
GII points contributed by each CALIBRE factor (score 0 to 4 × weight)
Findings from each capability
- ARA Agentic Risk Analyst
- 8 findings
- CALIBRE Governance intensity
- 6 controls + GII summary
- Secure-RAG Evidence
- 0 citations
Decision narrative
Initiative SAMPLE-03 (HR policy chatbot) is assessed at ARA overall-residual Low, CALIBRE band Moderate (GII 38.75/100). The retrieval-only design and policy-scoped corpus keep this well within enterprise risk appetite.
Approve. Continue normal monitoring; no additional conditions required beyond the three listed controls.
Description
A global manufacturer wants a RAG chatbot over its HR policy library so 40,000 employees across three languages (English, Mandarin, Portuguese) can ask policy questions in natural language. Personal data (salary, medical leave) may appear in retrieved documents. Embedded in Microsoft Teams. Uses an external commercial LLM.
How action status is reported
A control is reported as implemented in the attestation only when its action is Complete. Add a link to the evidence where possible.
CALIBRE sets the required controls by band, not by reading the description. If a control does not apply, mark it Waived and put the written justification (or a link to it) in the evidence field. The waiver is shown in the attestation.
| Priority | Action | Status |
|---|---|---|
| Medium | Verify Role-based corpus filtering configuration SAMPLE-03-A-01
|
Open |
| Medium | Verify Citation-required answers behaviour SAMPLE-03-A-02
|
Open |
| Medium | Publish GDPR Article 22 disclosure in Teams UI SAMPLE-03-A-03
|
Open |
No actions match
Change the filters to see more.
ARA R-DA-01PII exposure via retrieved documents
Retrieved HR documents may include employee salary and medical leave data.
ARA R-AI-01Hallucinated policy answers
LLM may generate policy content not present in retrieved documents.
ARA CMP-01GDPR (European Union) - applicable
EU employees' personal data is processed by the chatbot; GDPR Article 22 (automated decision-making) applies where policy determinations affect employees.
ARA CMP-02Privacy Act 1988 (APPs) (Australia) - applicable
Australian workforce data processed by the chatbot.
ARA T-AI-01Prompt injection via employee query
Employees may attempt to extract restricted content via crafted prompts.
ARA C-01Role-based corpus filtering
Retrieval restricted to policy documents; salary and medical records excluded from index.
ARA C-02Citation-required answers
Chatbot cites source policy document for every answer; refuses to answer if no relevant citation retrieved.
ARA C-03GDPR Article 22 disclosure
In-app disclosure that responses are AI-generated and employees may request human review.
CALIBRE CAL-GII-ModerateGovernance Intensity Index = 38.75/100 (band: Moderate)
CALIBRE band: Moderate.
CALIBRE CAL-GOV-02GOV-02 - AI impact and risk assessment
CALIBRE core control, required from band Moderate upward. Maps to NIST MAP-5.1 | ISO 42001 A.5.2; A.5.4 | EU AI Act Art.9; Art.27.
CALIBRE CAL-DATA-01DATA-01 - Data governance and PII protection
CALIBRE core control, required from band Moderate upward. Maps to NIST MEASURE-2.10 | ISO 42001 A.7.2; A.7.3; A.7.4; A.7.5 | EU AI Act Art.10.
CALIBRE CAL-SEC-01SEC-01 - AI security controls
CALIBRE core control, required from band Moderate upward. Maps to NIST MEASURE-2.7 | ISO 42001 A.6.2.3 | EU AI Act Art.15.
CALIBRE CAL-SUP-01SUP-01 - AI supply-chain and third-party assurance
CALIBRE core control, required from band Moderate upward. Maps to NIST GOVERN-6.1; MANAGE-3.1 | ISO 42001 A.10.2; A.10.3 | EU AI Act Art.25.
CALIBRE CAL-LIT-01LIT-01 - AI literacy and competence
CALIBRE core control, required from band Low upward. Maps to NIST GOVERN-2.2 | ISO 42001 7.2 | EU AI Act Art.4.
CALIBRE CAL-GOV-01GOV-01 - AI use-case registration
CALIBRE core control, required from band Low upward. Maps to NIST GOVERN-1.6 | ISO 42001 A.4.2 | EU AI Act Art.49.
No findings match
Change the filters to see more.
Runtime: operating envelope, control tests and authority checks
Operating envelope
No operating envelope
Push one from ARA. Until then every agent action is escalated.
Recent authority checks
Open authorityNo checks recorded for this initiative.
Agent gateways call POST /api/authority/check before acting. Secure-RAG reports control tests to POST /api/test-results.