How to read this page
- Every step is one screen, or one moment, in a real run. The label under the title names where it happens, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Screenshots are real pictures of the Munitas console, the web app that people open in a browser. Click any picture to enlarge it.
- Every name of a person, patient or card holder in the example data is invented, and every screenshot is unedited apart from being cropped to the part that matters.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Department
- A team inside an organisation that owns some of its data, such as Cardiology.
- Custodian
- A person who holds the data custodian role, which allows deciding who may read data. A custodian decides for the departments they are an approver for.
- Agent
- A program registered on Munitas, with a named owner, that Munitas runs on somebody’s behalf instead of a person reading data directly.
- Version of an agent
- One uploaded and sealed copy of an agent’s code. Uploading again makes a new version, and the older ones stay.
- Sealed
- Finished and closed for good, so that it can never be edited.
- Deploy
- To make one version of an agent the one that runs when somebody starts a run. Only one version of an agent is active at a time.
- Run
- One execution of an agent or a pipeline, started for a stated purpose.
- AI risk owner
- The one person who answers for how the organisation holds its AI agents. The role writes the risk levels and the approved tools list, confirms the level of each agent, and gives the second approval on a change to an agent where its level asks for one.
- Risk level
- One of the levels an organisation writes for how carefully it holds its agents, from the least strict to the most strict. A level says whether a change that lets an agent do more needs a second approver, how often the agent must be confirmed as still needed, and whether an agent at that level may be deployed at all. The person who registers an agent proposes a level, and the AI risk owner confirms it.
- Widening
- A change that lets an agent do more than the version before it: a new tool, a new external host, more data, or a different model. A widening has to be approved before the version can be deployed.
- Approved tools list
- A list, written by the AI risk owner, of tools the organisation has approved in advance. Each entry names one tool, says what it does, how far it is approved, the highest risk level it is approved for, the conditions, a reason and the date it must be looked at again. A new version of an agent that adds only listed tools does not wait for the people who would otherwise decide it.
- Sponsor
- The person who answers for an agent. The sponsor is an approver of the department that owns it, and has to confirm from time to time that the agent is still needed and held at the right level.
- Agent registry
- A list of every agent in the organisation, open to everybody signed in. It shows the department that owns each agent, its risk level, its sponsor and what needs attention.
- Dataset
- A named collection of records, such as a table of patient admissions.
- Version
- One sealed state of a dataset. Changing the contents means making a new version, never editing an old one.
- Filter
- Keeping only the rows of a table that match values the custodian names, such as one patient’s id, so that other people’s rows do not leave with them.
The organisation decides how carefully each agent is held
An AI agent is a program that works on data on somebody's behalf, with a named owner, under the same rules as a person. Before an agent does any work, the organisation decides how much care it needs. The organisation writes a short list of risk levels, from the least strict to the most strict. A level says whether a change to an agent needs a second approver, and how often somebody has to confirm that the agent is still needed.
Okafor is the AI risk owner of the Health organisation, the one person who answers for how the organisation holds its AI agents. The levels were written earlier, and every person signed in can read them. Where it says a second approver, it means that a change which makes an agent able to do more needs the AI risk owner as well as the department that owns the agent. The top of the list, High, is the level for an agent whose output can change what happens to a person.
Devi is a data engineer in the Health organisation. The new agent plans follow-up appointments from a consultation note, for scheduling staff to confirm. The Cardiology department owns it. The person who registers an agent proposes its level, and says who is affected by what the agent produces and why the level fits. Devi cannot confirm the level, because that belongs to the AI risk owner.
Munitas has registered the agent, with no version yet. The page says what it means that no level is confirmed: every approval for this agent treats it as High, the strictest level that still allows it to be put to work, and because the organisation holds its agents to its levels, the agent cannot start a run yet. Devi's proposal is kept with who made it and when.
A version of an agent is one uploaded copy of its code. Munitas seals it, which means finished and closed for good, so it can never be edited. A tool is something the agent may do. This version may only read the details of a dataset version, so Devi lists that one tool. The model is none, because this code calls no model.
To deploy a version is to make it the one that runs when somebody starts a run. This version is the first one, so it is compared with nothing and counts as a widening: it gives the agent a tool it did not have. Even though the tool is on the organisation's list of tools approved in advance, a first version is never covered by that list, because the agent's level is decided together with it. The page says in words what the version waits for, so that nobody has to guess why the button is grey. It needs an approver of the Cardiology department and the AI risk owner.
Two different people decide the first version and its level
The department that owns an agent answers for what the agent does, so an approver of that department decides first. The AI risk owner decides second. The person who uploaded a version is never one of the people who decide it.
Hartley is a data custodian for the Cardiology department, a person who may decide who reads its data and approve changes to agents it owns. The page lists every version waiting for a decision, and says what each one changes compared with the version before it. Hartley writes a reason, because every decision is kept with its reason, who made it and when. Hartley can give the department's part only: the page says that the officer's part belongs to the AI risk owner.
One approval is not enough. The card now records who approved for the department and when, with the reason Hartley wrote, and it names who the version waits for next. Hartley has no box for the officer's part, because Hartley does not hold that role.
Because this is the agent's first version, its level is decided with it, so that no version ever exists without a level. Okafor sees what Devi proposed, and chooses a different level, High, because the agent works with named appointment requests and a later version is expected to message people, even though scheduling staff confirm every booking. One reason covers both the level and the version. Okafor did not upload the version and so is allowed to decide it. The box shows the last lines of what was typed, and the whole reason is recorded and shown in later pictures.
The agent is listed at its level, and somebody answers for it
The registry lists every agent of the organisation in one place, for anybody signed in. A sponsor is the person who answers for an agent. The sponsor has to be an approver of the department that owns it.
Okafor has no need of the Agents menu item, which is for the people who build and run agents. The Agent registry is for everybody who oversees them, and each agent in it is a link to its own page. The registry shows the department that owns the agent, who registered it, its risk level, and what needs attention. It flags that this agent has no sponsor yet.
Okafor follows the link from the registry. The level that was proposed as Moderate is now confirmed as High, with Okafor's name, the date and time, and the reason. The earlier proposal is kept: the page offers the full history of proposals and decisions. Under it, the same page offers the sponsor to be chosen from the approvers of Cardiology, and says how often the agent must be re-confirmed: re-confirming means somebody checks that the agent is still needed and still held at the right level.
Okafor chooses Hartley, an approver of Cardiology, and writes why. The sponsor is a person who can be asked about the agent, and who has to re-confirm it every 90 days. The assignment is a new record and the earlier state stays in the history.
With the level confirmed and the first version approved, the Deploy button works. Devi presses it, and version 1 becomes the version that runs when somebody starts a run. Only one version of an agent is active at a time. The Runs section now offers a box for a purpose and a dataset, because a run has to say what it is for.
A later version adds a tool that is not on the approved list
A version that lets an agent do more than before is a widening. Munitas compares every new version with the one before it and puts the widest change first. A tool whose name the platform does not know is treated as one that may act outside the platform, and a tool that is not on the organisation's list of tools approved in advance is decided by people, one version at a time.
The clinic wants the agent to be able to send a confirmation to the person who asked for the appointment, so Devi lists a second tool next to the first. Nothing in the platform says what a tool called send_confirmation does, and it is not on the approved list. Because the agent is held at High, this version cannot simply be deployed.
Sealed means finished and closed for good, so the version can never be edited. The new version is listed above the old one. Version 1 is still the one that runs, so nothing changes for anybody until the new version is approved and deployed. The reason it waits is on the page, in the same words as for the first version.
The card says exactly which change makes the version a widening, and why the platform cannot judge it for itself. Hartley writes the department's reason, which says that the clinic's own system, not the agent, is to send confirmations, and approves.
Okafor sees the department's approval first, with its reason, and then writes the officer's reason. Okafor approves it for a trial on made-up requests only, and says so. Approval does not deploy the version: it only allows Devi to.
The Approved filter lists the version with both decisions under it. Each decision names the person, the date and time, and the reason in that person's own words. Version 1 of the same agent, below it, shows the same two decisions from the first half of this page.
The explanation that was under the button has gone, and the button is blue. Nothing has been deployed yet, which means that version 2 has not been made the running version: the decision to put it to work is Devi's, made when the clinic is ready, and until then the agent keeps running as version 1.
The earlier flag, No sponsor, is gone. The registry now shows the active version and the tool it may call, and raises a different flag: a newer version, version 2, has been approved and not deployed. A flag is a prompt for a person to look, not a fault.
