OperateRFP § 6.2
Control tower
Each control is a rule over catalog metadata. Failures become steward tasks; nothing is changed automatically.
| Control | Framework | Applies to | Pass | Fail | Failing assets |
|---|---|---|---|---|---|
GDPR-01 PII assets carry a named steward | GDPR | 1 | 1 | 0 | |
GDPR-02 PII assets are at least Confidential | GDPR | 1 | 1 | 0 | |
GDPR-03 PII assets declare a limited purpose (max 2) | GDPR | 1 | 1 | 0 | |
AIA-01 AI agents are certified before use | EU AI Act | 5 | 5 | 0 | |
AIA-02 AI agents declare an approved purpose | EU AI Act | 5 | 5 | 0 | |
AIA-03 Agents have an agent contract | EU AI Act | 5 | 4 | 1 | |
INT-01 Promoted assets are certified | Internal standard | 3 | 3 | 0 | |
INT-02 Deprecated assets have no live downstream consumers | Internal standard | 1 | 1 | 0 | |
INT-03 Data quality score at least 75 | Internal standard | 15 | 12 | 3 | |
INT-04 Trust score at least 60 | Internal standard | 27 | 25 | 2 |
Evaluated over 27 assets visible to Claire Dubois; 2 withheld by policy and not reported here.