The Yo-AI
PLATFORM OVERVIEW
The Yo-AI Platform architecture is grouped into 3 subdomains.
This design achieves separation of duties and cyber-resiliency by isolating access rights and privileges among the three subdomains, each with different interests.
AI Agents leading each subdomain represents the interests of stakeholders:
The Vendor-Manager:
|
manages and represents Organizations |
The Data-Steward:
|
manages and represents Consumers |
The Solicitor-General:
|
manages and represents the Yo-AI Platform |
All interactions between agents and responsible humans go through these three AI Agents.
Organization Profiles uniquely define each organizational entity.
Organizational Profile Sample
Consumer Profiles uniquely identify each individual consumer.
These profiles are ONLY shared with your Data-Steward, or anyone else you authorize.
Consumer Profile Sample
Whatever You Want, JUST ASK
The Solicitor-General
|
I am Craig Erickson, the Responsible Human who runs the Yo-AI Platform.
|
|
I am the Data-Steward. I was assigned to you by the Solicitor-General to create a Consumer Profile for you. I can represent your interests by protecting your privacy and your data, but you haven't signed an agreement authorizing me to act on your behalf. Would you like to sign an Authorized Agent Agreement with PrivacyPortfolio on the Yo-AI Platform?
If so, I will put the Agent Authorization in your shared Data Vault, |
Everything You Ask For, is RECORDED
The Solicitor-General not only initiates requests and manages responses, but also records all information exchanges between agents, organizations, and consumers.
These information exchanges are called events,
which are logged and evaluated for risks to consumers, organizations, and the Yo-AI Platform.
Aside from all the infrastructure Platform Agents maintain, the core functionality of the Yo-AI Platform is to manage risk, while pursuing rewards.
Objects don't represent risks -- but events do.
We don't know in advance which events may be labelled as risks, so we log all requests and responses between the Solicitor-General and all other agents.
When a risk of harm is identified among these events, it is called a Threat.
When a Threat causes actual harm, it is called a Loss Event.
The Sentinel, is a special platform agent that listens to events,
and flags risk events, which are categorized as Threats.
Sentinel:
Listens for dangerous incidents and trends. Also listens for decision-making events.
The Yo-AI Platform prioritizes risks to Consumers from automated decision-making technologies.
When a "decision-making event" is detected by The Sentinel, it is forwarded to another special agent, the Decision-Master.
Decision-Master, is a special platform agent that evaluates decision-making events,
and logs them to the "Decision Diary", which is equivalent to a "Risk Register".
Decision-Master
Maintains the Decision-Diary
-- ico and the Alan Turing Institute - explaining-decisions-made-with-artificial-intelligence-1-0.pdf
ORGANIZATIONS
Organizations include commercial business entities, not-for-profit organizations, and government agencies.
Because each of these organizations process personal information, Yo-AI treats them similarly as "vendors", even when organizations disagree with this designation.
On the Yo-AI platform, no organization is permitted to avoid data governance controls.
When organizations process personal information, they often consider the role of the individual whose information is being processed, known as a role-context.
For example:
You are considered as a direct customer to businesses you pay (vendors);
You may or may not be considered as a customer to businesses you receive services or resources from but you don't pay for (vendors);
You might or might not be designated as a website visitor, subscriber, volunteer, job-seeker, free-trial or free-tier user, investor, donor, etc., or other category like patron, citizen, complainant, interested party, etc. by organizations (vendors).
Yo-AI governs the use of your personal information and protects it.
The point made about all organizations being classified as vendors is merely for practical purposes:
you cannot govern the use of your information, nor conduct risk assessments on automated decision-making without considering the entire population of entities that hold or process your personal information.
Consumers want to know who is making decisions about them specifically based on the personal information organizations have access to.
Yo-AI uses personal data elements in personal dataset profiles as the primary identifiers to search for during
discovery.
The Vendor-Manager agent represents all organizations that make or may make automated decisions about the consumer.
An individual representing a profiled organization, is treated as a stakeholder.
Stakeholders have a legitimate interest in automated decisions made about the organization, according to its organizational profile.
Sharing this information WITH THE ORGANIZATION's REPRESENTATIVE can be beneficial:
If they are Registered Subscribers on the Yo-AI Platform, they can subscribe to Kafka Topics to view logged events relevant to their organization.
Individuals who are Registered Stakeholders must be authorized to represent the organization whose profile they want to modify.
In order to do that, that individual must be identified using their Consumer Profile.
Their Consumer Profile should contain metadata about their affiliation with, and authorization to represent the organization,
which is contained in their Personal Data Vault as a written authorization or affidavit.
There are cases in which organizational representatives are appointed as Stakeholders, even if they are not registered.
Generally speaking, these are named individuals in public documents or forums owned or attributed to the organization they represent; like the CEO, or a member of its Board of Directors, or someone who writes a blog post or speaks at a conference.
However, some important stakeholders are "Anonymous Stakeholders".
The Risk-Assessor leverages organization profiles to identify decision-sets among an organization's assets
and assesses the risks to consumers based on the quality (completeness and accuracy) of personal data,
the potential adverse impact to consumers,
and the degree of transparency of an organization's assets and business practices.
Risks are scoped to digital transactions I call 'interchanges'.
Risks are NOT attributed to entire entities such as organizations or individuals.