Why Long-Running AI Work Needs Governance

An AI can produce a polished, logical and persuasive answer and still be wrong in a more important way: it may be working from a source, decision or version that no longer has the authority to govern the work.

The problem may not be visible in the output. The language can be clear. The reasoning can appear coherent. The recommendation may even be technically sensible.

Yet the AI may have mistaken a draft for an approved position, relied on a superseded document, separated an approval from its conditions, or carried an old instruction into a new situation. The result is not governed work. It is a convincing output built on the wrong authority state.

This risk rarely becomes obvious in a five-minute interaction. It emerges when AI participates in work that continues across days, weeks or months: strategy development, policy design, research, standards, product planning, transformation programmes, operating models, software delivery and other knowledge-intensive initiatives.

The TAHA Framework — Traceable AI. Human Authority. is my developing response to that problem. TAHA proposes an authority-centred governance architecture for long-running AI-enabled work. It is designed to keep context, AI contribution, human decisions, approval, operational activation, bounded execution, verification and accountability connected as work moves across conversations, tools, repositories, teams and time.

Conversation advances the work. Governed records preserve the accepted position. Human Authority determines what becomes operationally real.

Publication note: This article originated as an early public introduction to the TAHA Framework. White Paper — Publication 1 was published on 17 August 2026 and is available through its official DOI record. This article remains an introduction and does not reproduce the complete framework, its detailed controls or a conformity method.

From AGAG Model to the TAHA Framework

An earlier version of this article was first published on LinkedIn while the framework was being developed under the former working name AGAG Model — Authority-Grounded AI Governance Model.

The framework is now called the TAHA Framework, expressed through the phrase Traceable AI. Human Authority. The change established a clearer public identity and positioning. It did not replace the underlying authority-and-context architecture developed under the AGAG name.

Historical references to AGAG therefore refer to an earlier development identity of the same framework, not a separate model.

When conversation stops being enough

AI conversation is an excellent working medium. It helps people explore ideas, test assumptions, compare alternatives, analyse evidence and turn incomplete thinking into useful material.

The problem begins when conversation is treated as both the working space and the durable governing record.

Long-running work accumulates more than text. It accumulates decisions, evidence, assumptions, conditions, versions, exceptions, dependencies, implementation limits, execution records and unresolved risks. One document may be current. Another may be approved for future use but not yet active. A third may remain available only as historical evidence. A decision may apply to one workstream but not another. An approval may permit internal use without authorising implementation or publication.

An AI system does not automatically understand these relationships merely because the relevant files are accessible. It may retrieve an older source because its wording matches the prompt more closely. It may treat the newest file as authoritative even though it has not been activated. It may repeat retired terminology because it appears frequently in earlier material. It may remember a recommendation as a decision, or a decision as permission to execute.

As work grows, several failure patterns become common:

earlier decisions become buried inside long conversation histories;
a new session receives documents without the authority hierarchy behind them;
drafts, approved records and historical versions remain searchable together;
an approval loses the conditions, purpose or limits attached to it;
AI fills a missing governance link with an assumption;
planning is reported as completed execution without evidence;
future work begins from conversational memory instead of the current authorised position.

None of this means AI is unsuitable for serious work. It means conversational memory is the wrong control mechanism for work that must remain reliable over time.

The governance problem TAHA addresses

TAHA does not attempt to govern every casual use of AI. It focuses on material AI-enabled work: work in which an AI contribution, decision or action could affect an outcome that requires identifiable authority, accountability or evidence.

Materiality depends on context. Relevant factors may include consequence, reach, reversibility, autonomy, sensitivity, legal or financial effect, affected stakeholders, uncertainty and precedent-setting impact.

Routine grammar correction or private brainstorming may require only normal human ownership and review. A public policy, investment decision, production deployment, contractual acceptance, high-autonomy agent action or material programme recommendation requires stronger governance.

TAHA focuses on the relationship among:

the context and evidence used;
what the AI analysed, generated or recommended;
who possessed the legitimate decision right;
what was approved and under which conditions;
when the approval became operationally effective;
what a person, agent or automated workflow was permitted to execute;
what evidence shows what actually happened; and
who remained accountable for the outcome.

The framework’s core thesis is:

AI-enabled work cannot be governed only by controlling the model, prompt, data or context. Reliable governance requires a continuous and verifiable chain connecting governed context, AI contribution, Human Authority, authorised action, execution evidence and accountability.

TAHA expresses that chain as:

Context and Evidence → AI Contribution → Recommendation → Human Decision → Approval → Activation → Bounded Execution → Verification → Accountable Outcome

Low-risk workflows may combine some of these events. Their governance meanings should not disappear.

Traceability means more than logging

The word traceable in TAHA does not mean that every internal model process must be exposed. It does not depend on access to private model chain-of-thought, and it does not assume that technical logs alone create governance.

Traceability means being able to connect the material elements of a governed outcome:

which context and evidence were eligible and relied upon;
what the AI contributed;
which human or human-governed body held the decision right;
what decision was made;
what conditions and limits applied;
when the decision became active;
what was executed and verified;
who remained accountable; and
what must be reassessed if the context or authority later changes.

A technically complete activity log can still be governance-poor if it cannot show why an action was authorised. A well-written approval is also insufficient if no one can determine which evidence informed it or whether execution stayed within its limits.

TAHA therefore treats decision traceability and execution traceability as parts of the same authority chain.

Human Authority is more than a human in the loop

The phrase human in the loop is often used as though the presence of a human reviewer automatically creates adequate control. TAHA rejects that assumption.

A person may be present without holding the relevant decision right. A reviewer may lack the information, competence, independence or time needed to challenge the AI. An interface may offer an approval button but no meaningful ability to reject, modify, defer or escalate. Repeated confirmation requests can turn oversight into ceremony.

TAHA uses Human Authority to identify legitimate human or human-governed institutional decision power.

The Human Authority Holder is the identifiable person or formally constituted human body that possesses the applicable decision right. The Accountable Owner is the human or recognised organisation that remains answerable for the governed outcome. These roles may be held by the same person, but they are not automatically identical.

AI may prepare evidence, compare options, identify conflicts, draft recommendations and support execution. It does not acquire legitimate organisational authority because it performed most of the work.

For a material decision, the governance record should make clear what was proposed, which evidence basis applied, what the AI contributed, what risks and limitations were considered, who had the right to decide, what decision was made, what conditions remained, what became active, what was executed and who remained accountable.

TAHA states the distinction plainly:

Access is not authority. Capability is not authority. Permission is not approval. Recommendation is not decision.

Governed context is a condition of reliable authority

Human approval cannot be meaningful when the information influencing the decision is unidentified, stale, conflicted, inapplicable or silently altered.

TAHA therefore includes a bounded Context Governance Kernel. It is not intended to become a complete knowledge-management system. It defines minimum conditions under which information may legitimately influence a material decision or authorised AI action.

Proportionate to risk, material context should preserve:

Identity and accountability — the information can be distinguished from other records and has an accountable human owner, authorised issuing body or recognised external authority.
Provenance and derivation — original sources, human interpretation and AI-generated or transformed material remain distinguishable.
Authority, purpose and applicability — status, approved purpose, scope, period and applicable authority are identifiable.
Version and decision baseline — the edition applicable to a material decision can be reconstructed.
Integrity and controlled change — amendments, withdrawal and supersession do not silently overwrite history.
Conflict, restriction and admissibility — significant uncertainty, missing evidence, restrictions and unresolved conflicts are surfaced before reliance.
Use and impact traceability — affected decisions can be identified when relied-upon context is later withdrawn or shown to be defective.

These outcomes can be supported through controlled documents, content-management systems, Git, workflow platforms, knowledge graphs, retrieval systems or other technologies. TAHA governs the meaning and relationships that must survive; it does not prescribe one repository or product.

The Authority Context Baseline

One of TAHA’s central proposed mechanisms is the Authority Context Baseline.

An Authority Context Baseline is the purpose-scoped set of governing context, decision evidence, assumptions, limitations and applicable versions recognised as the information basis for a specific exercise of Human Authority.

It is not a copy of every available file. Its value comes from connecting a material decision to the principal information state that informed it.

A programme decision, for example, may depend on a current architecture baseline, a risk assessment, a policy interpretation, selected technical evidence, known assumptions and unresolved limitations. If a relied-upon source is later withdrawn or corrected, the baseline helps identify which decisions and executions may require reassessment.

TAHA also distinguishes Context Reliance States:

Available — the information existed in an accessible environment.
Eligible — it satisfied the conditions for possible use.
Supplied — it was presented to the AI system or human.
Cited — the output or decision explicitly referred to it.
Relied upon — it materially influenced the analysis, decision or action.
Governing — it possessed authority to constrain or determine the permitted outcome.

The distinction matters because access does not prove influence, and influence does not automatically create governing authority.

AI-generated content does not become authoritative through repetition

AI-generated or materially AI-transformed content should initially be treated as working or derived material.

It does not become authoritative merely because it was generated from approved sources, stored in a controlled folder, repeatedly reused, written persuasively or produced by an advanced model.

Promotion to authoritative use requires a human-controlled process proportionate to the importance and risk of the decision.

This protects against a subtle failure: an AI summary may gradually replace the source it summarised even though no authorised person approved that summary as the governing position.

AI should remain free to challenge current authority, propose alternatives and identify outdated decisions. The restriction is not on challenge. It is on silent replacement.

Approval is not activation

One of TAHA’s most important distinctions is the separation between approval and activation.

Approval records the authorised decision. Activation makes that decision operationally effective.

They may occur together when all conditions are satisfied and the risk permits immediate effect. They should remain distinguishable when the decision is approved for future use, readiness conditions remain outstanding, another authority domain must provide clearance, migration or validation is incomplete, or the effective date has not arrived.

This prevents a common governance error: treating an accepted design, recommendation or baseline as permission to implement, publish or operate immediately.

A document can be accepted for internal use without being authorised for public release. A design can be approved without authorising deployment. A successor can be accepted but remain inactive until migration and verification are complete.

One approval does not authorise everything that follows.

Authority-Bounded Execution

As AI moves from generating recommendations to taking actions, governance must connect human decisions to operational limits.

TAHA defines Authority-Bounded Execution as the condition under which a human delegate, AI agent or automated workflow may execute only within explicit limits derived from valid prior Human Authority.

A proportionate execution arrangement may define:

the authorised person or agent identity;
the approved purpose and action classes;
permitted tools, systems, context and data;
financial, transaction, time, frequency or risk limits;
prohibited actions;
retained Human Authority;
required confirmation points;
escalation conditions; and
monitoring, suspension and revocation methods.

Technical permission profiles, workflow policies, identity controls or agent-authorisation mechanisms may implement parts of this arrangement. They do not replace the organisational authority that created, approved and remains accountable for the action boundary.

A system with technical access may still lack legitimate authority. A capable agent may still be prohibited from acting. When a case falls outside the approved boundary, the system should stop, escalate or request new Human Authority rather than infer permission to expand its own scope.

AI must not approve its own recommendation, exception, governing-rule change, authority expansion or execution request.

Planning, execution and evidence must remain distinct

An AI conversation may develop an implementation plan, generate a script, design a repository structure or prepare instructions for another tool. That does not prove the action occurred.

Files were not moved merely because a migration plan was written. A script did not succeed merely because its code looks correct. A repository was not updated merely because an AI stated that the next step was complete.

Where execution is required, it should be authorised, bounded and evidenced. Evidence may include logs, inventories, manifests, file paths, checksums, change records, screenshots, validation results and exception reports.

The result should be reviewed before it is accepted as complete. This remains important even where one platform can both reason and act. Convenience should not collapse authorisation, execution and verification into one unsupported claim.

Meaningful Human Authority

A human approval step is protective only when the person can genuinely exercise authority.

TAHA’s proposed Meaningful Human Authority assessment considers whether the arrangement provides:

an identifiable decision-maker with legitimate decision rights;
relevant competence and adequate information;
visibility into material uncertainty and alternatives;
sufficient time and organisational independence;
a real ability to approve, reject, modify, defer or escalate;
operational effect, so the human decision changes what the system may do; and
preserved accountability and evidence.

A reviewer who lacks time, authority or practical ability to refuse is not exercising meaningful control. A person who approves nearly every recommendation under pressure may be present in the workflow while absent from the real decision.

TAHA therefore focuses not on whether a human touched the process, but on whether legitimate Human Authority shaped the outcome.

Retrospective impact and correction

A difficult governance problem occurs when a decision was legitimately authorised using the evidence available at the time, but a relied-upon source is later found to be materially defective.

The authority event and evidence quality are connected, but they are not identical.

TAHA therefore proposes retrospective impact: the ability to identify affected context baselines, decisions, approvals and executions and determine whether review, correction, suspension, reapproval, rollback or notification is necessary.

This avoids two misleading conclusions. The earlier decision does not automatically become unauthorised if it was made by the correct Human Authority. But a valid approval also does not permanently protect the resulting action from reassessment when its evidence basis changes materially.

Traceability makes correction possible without rewriting history.

Provider-neutral continuity

The authority of a decision should not disappear when an organisation changes its AI model, repository, collaboration platform or workflow tool.

Platforms provide storage, search, permissions, automation and version history. They do not create authority merely by holding a file.

TAHA therefore treats provider-neutral continuity as an architectural quality. Governance identity and meaning should remain interpretable across reasonable changes in tools, models, file locations and providers.

A successful migration is not proved merely because files were copied. The relationships among context, versions, decisions, authority records, execution evidence and historical status must remain intelligible.

A new AI system does not need the private memory of the previous session. It needs a current, controlled and understandable authority context.

Governance should be proportionate

TAHA is not an argument for turning every prompt into a formal approval process.

Governance depth should match the consequence of error, significance of the decision and autonomy of the system. Routine assistance may require only normal human ownership and a clear distinction between draft and final output. Material decisions need stronger context and decision traceability. Controlled implementation or publication may require separate approval, activation and verification. Bounded automated execution requires explicit purpose, limits, escalation and revocation.

The objective is controlled agility: enough governance to preserve authority and accountability without making ordinary work unmanageable.

TAHA complements established disciplines

TAHA is not intended to replace corporate governance, law, identity and access management, cybersecurity, records management, project and programme management, data protection or responsible-AI frameworks.

Those disciplines already establish essential controls.

TAHA addresses a narrower integration problem: how to preserve a traceable chain from governed decision context through AI contribution, legitimate Human Authority, approval, activation, bounded execution, verification and accountable outcome.

An organisation may implement parts of TAHA through existing governance boards, programme gates, content systems, IAM controls, workflow platforms, risk processes and agent-governance tools. TAHA is designed to connect their authority meanings rather than reproduce them as a parallel management system.

A practical cycle for governed human–AI work

In practice, TAHA can be applied as a repeating cycle:

Define the objective, scope, materiality and applicable decision rights.
Identify the current governing context and supporting evidence.
Establish the mandate and limits for the AI contribution.
Allow the AI to analyse, compare, draft, challenge and recommend.
Surface conflicts, uncertainty, assumptions and proposed changes.
Obtain the decision of the legitimate Human Authority Holder.
Record the decision, conditions, retained authority and activation status.
Execute only within the approved authority boundary.
Collect and verify evidence of what occurred.
Update the relevant authority, context and historical records.
Begin the next cycle from the updated authority state rather than conversational memory.

This keeps AI useful. It can continue to explore, reason, challenge and create. The boundary is that it cannot silently redefine the governing position, expand its own authority or approve its own work.

What TAHA does not yet claim

TAHA is a developing governance proposition. It is not currently presented as a final public standard, certification scheme, legal compliance method or guarantee of safe and effective AI use.

Its individual building blocks have foundations in established governance, human oversight, programme management, information governance, security, delegated authorisation and responsible-AI practice.

The proposed contribution is the integrated, provider-neutral authority-and-context lifecycle for long-running AI-enabled work, not the claim that every underlying control was invented by TAHA.

The current work does not establish:

universal originality;
operational effectiveness in live organisations;
legal or regulatory sufficiency;
guaranteed prevention of unauthorised action;
reduced incidents, cost, ambiguity or audit effort; or
conformity or certification.

Those outcomes require continued framework development, external review, practical implementation and evidence from real use.

The wider lesson

Most organisations begin AI adoption with individual productivity: drafting emails, summarising meetings, preparing presentations and accelerating analysis.

The governance challenge becomes more serious when AI begins influencing business cases, programme priorities, policies, designs, customer decisions, financial actions, production systems and autonomous workflows.

At that point, prompting skill is not enough.

Organisations need to know:

Which records define the current governing position?
What information was actually relied upon?
Who possessed the relevant decision right?
What did the AI contribute, and what did the human decide?
Was the decision proposed, approved or active?
What was the system permitted to execute?
What evidence proves what happened?
How are conflicts, revocation and later corrections handled?
Who remains accountable?
Can the next AI session reconstruct the correct authority state?

These questions sit at the intersection of governance, information quality, organisational authority, programme delivery and human–AI collaboration.

Conclusion

Long-running AI work cannot depend on conversational memory alone.

Conversation is valuable because it is flexible, interactive and fast. Those same qualities make it unsuitable as the only durable record of authority.

TAHA proposes a different foundation: governed context, explicit Human Authority, distinct approval and activation, bounded execution, verifiable evidence, retrospective traceability and provider-neutral continuity.

AI can analyse evidence, prepare recommendations, generate documents and support execution. It should not approve its own work, silently rewrite the governing position or override accountable Human Authority.

The future of AI-enabled delivery is not simply more automation. It is governed collaboration between human judgement and machine capability.

Traceable AI. Human Authority.

Author’s note

This article presents the TAHA Framework as a developing governance architecture and research proposition. It does not constitute legal, regulatory, security, compliance, audit, certification or other professional advice.

An earlier version was published on LinkedIn under the framework’s former working name, AGAG Model — Authority-Grounded AI Governance Model. This website edition has been substantively revised to reflect the TAHA identity, terminology, architecture and controlled public-claims position.

TAHA Framework
AI Governance
Human Authority
Responsible AI
Agentic AI
Programme Governance