Overview
This approved policy establishes mandatory principles and controls for the design, development, delivery and use of OpsRabbit and related AI systems. It requires lawful and purpose-limited processing, accountable ownership, proportionate risk assessment, meaningful human oversight, secure engineering, controlled release, monitoring and incident response.
OpsRabbit supports evidence-backed IT operations, DevOps and site-reliability work. It does not remove the responsibility of authorized people to evaluate evidence, apply professional judgment and approve consequential actions. A use that cannot be reduced to acceptable risk is not approved.
The policy should be read with the AI Governance Framework, AI Security Whitepaper and Shared Responsibility Matrix.
Principles
- Lawful and purpose-limited use
- Human accountability and meaningful oversight
- Security, privacy and data minimization by design
- Transparency about model use and limitations
- Fairness and avoidance of prohibited discrimination
- Reliability, testing and continuous improvement
Users must be informed when they are interacting with an AI-enabled capability where that is not otherwise clear. OpsRabbit should distinguish observed evidence from inference, identify supporting sources where technically feasible, disclose material limitations and state when evidence is insufficient.
Customer data commitments
OpsRabbit provider does not use customer data, prompts, tickets, logs, documents, model inputs or outputs to train or fine-tune shared models. Customer data is used only for the authorized OpsRabbit purpose, support, security and legal obligations. A materially different customer-specific evaluation, improvement or training use requires explicit written customer authorization and documented privacy, security, legal and governance review.
Customers control the data sources and provider choices in customer-hosted deployments. Statements that data remains within a customer environment apply only to the verified architecture; external model calls, telemetry, support transfers and other outbound processing must be disclosed.
Prohibited and high-risk use
OpsRabbit must not be used to evade security controls, conduct unlawful surveillance, generate malicious activity or make solely automated high-impact decisions about individuals without appropriate legal basis, review and safeguards. Material new AI uses require governance review.
Governance
Material AI systems and use cases are inventoried with their owner, intended users, purpose, model or provider, data categories, hosting arrangement, external flows, tools, permissions, autonomy level, risk classification and review date. A documented assessment is required before release and after a material model, prompt, retrieval, tool, permission, autonomy, hosting or data-flow change.
Higher-risk uses require stronger approval, testing, monitoring and human oversight. Incidents, material changes and emerging risks trigger reassessment. Concerns can be reported to info@OpsRabbit.io.
Roles and accountability
The executive sponsor is accountable for the governance program. The Product Owner defines intended use and customer value. Engineering and Security implement controls. Privacy and Legal review data use and obligations. QA performs proportionate evaluation. Deployment owners confirm customer configuration and shared responsibilities. Users remain accountable for decisions and actions taken with OpsRabbit output.
Risk assessment
Assessment considers intended and reasonably foreseeable use, affected people, data sensitivity, model/provider, autonomy, tool permissions, explainability, security threats, legal requirements and consequence of error. Higher-risk use requires stronger approval, testing, monitoring and human oversight. Uses that cannot be reduced to acceptable risk are not approved.
Fairness, transparency and human oversight
OpsRabbit is designed for IT operations rather than employment, credit, healthcare, eligibility or other decisions with legal or similarly significant effects on individuals. Where personal data or people-related outcomes may be involved, teams must evaluate bias, lawful basis, notice, contestability and meaningful human review. Users are informed that AI is involved and that outputs have limitations.
Monitoring, concerns and enforcement
Teams monitor relevant quality, security, incident and change signals. Personnel and customers may report concerns through the stated contact or engagement channel without retaliation for good-faith reporting. Violations may lead to access restriction, corrective action, retraining, product changes or termination of an unsafe use.