PaperlayerView exact revision on arXiv

Source-linked AI summary

Data Governance for Generative and Agentic AI : Technology, Law, Economics, and Security

Narayana Darapaneni, Padmaja K, Gnana Chaithra D

arXiv:2610.33605v1cs.AIcs.CY

TL;DR

Classical governance assumes information remains a stable object, while computational systems also infer, remember, communicate, decide and act on it. The book frames governance around that full loop and concludes that controls must extend across its layers, although existing frameworks address agent action on inferences unevenly.

  • Problem

    Classical controls assume a stable governed object, whereas computational systems produce and act on information across a data–inference–memory–action loop.

    Source: §1.2.1 · p. 15, §1.8 · p. 29

  • Method

    The book treats the data–inference–memory–action loop as its unit of analysis and allocates controls across its layers and responsible parties.

    Source: §1.8 · p. 29

  • Results

    The chapter summary says access control is necessary but insufficient, legal frameworks reach inferred information unevenly, and none yet addresses an agent acting on an inference without a human decision.

    Source: §1.9.1 · p. 30

  • Takeaways & Limitations

    Failures can cascade across layers, while the control that interrupts them usually sits at a different layer from the visible harm.

    Source: §1.9.1 · p. 30

    CRAFT provides no procedure for disagreements among its lenses, has untested fit with traditions foregrounding duty and community, and does not supply institutional design.

    Source: §1.4.2 · p. 22

Abstract

from arXiv · show

This book develops a unified governance framework for systems that retrieve, generate, infer, remember and act on information from large language models and retrieval augmented pipelines to autonomous multi agent systems. Eleven chapters and eight appendices integrate three disciplinary lenses-technology, law and economics-across the full lifecycle: data quality, lineage and provenance; global data protection law and intellectual property; the economics of data governance; digital trust, cybersecurity and zero-trust architecture; ethics and responsible AI; governing generative AI pipelines; governing agentic AI and multi-agent systems; data governance in elections and the public sphere; AI regulation across six jurisdictions; and the design of a governance control plane for 2030. Each chapter is anchored in Indian law and institutions while maintaining a comparative, cross jurisdictional perspective.

Vocabulary of the Governed Loop

The book’s working vocabulary names six recurring concepts for governing information across its full computational lifecycle. These terms are not an established taxonomy; each is defined where first built.

Vocabulary of the Governed Loop

  • Dynamic information states are seven stages—collected, retrieved, transformed, inferred, generated, remembered and acted upon—each raising distinct governance questions.Classical governance covers the first state; the book addresses all seven.Source: Vocabulary of the Governed Loop · p. 11
  • The DMAA loop traces Data → Model → Agent → Action → new Data through eight governed layers, linking information to consequences and back.The layers span source data, retrieval and context, model and inference, memory and state, agent reasoning, tools and external systems, decision and action, and feedback and new data.Source: Vocabulary of the Governed Loop · p. 11
  • Authority and action control separates data access from inference, tool and action rights, with action control applying at the moment of action.The passage distinguishes prediction, recommendation, decision and execution, and model output, agent decision and agent action.Source: Vocabulary of the Governed Loop · p. 11
  • Decision–action lineage is an auditable chain from source data through effects to feedback, recording minimum fields at each stage and each inter-agent handoff.The chain develops from inference lineage in Chapter 2 to its completed form in Chapter 8.Source: Vocabulary of the Governed Loop · p. 11
  • A cross-layer cascade occurs when a failure at one loop layer propagates through its couplings to other layers.Examples include a poisoned document becoming an action and a targeted message becoming data in the next cycle.Source: Vocabulary of the Governed Loop · p. 11
  • The governance control plane decides, enforces and records across eight governed layers through seven functions and four institutional layers.It operates at design, run and review time.Source: Vocabulary of the Governed Loop · p. 11
  • Expected harm prices the loop, while the governance trilemma names the trade among technical feasibility, legal and ethical legitimacy, and economic viability.The authors use technology, law and economics as the three lenses for reading that trade.Source: Vocabulary of the Governed Loop · p. 11

The Data Governance Imperative

This section frames the data governance imperative for generative and agentic AI, arguing that governance must extend beyond stable, stored data to systems that retrieve, infer, generate, remember, communicate, decide, exchange, and act on information. It presents an integrated framework for controls and accountability across that lifecycle, examining technical, legal, economic, and ethical concerns, including constitutional rights, India’s data infrastructure and law, and gaps in governance.

1.1.1 A Working Definition

  • Data governance covers decision rights, accountability, policies, standards and processes that ensure data quality, privacy, security, ethical use and legal compliance, including information systems infer or act upon.The definition extends governance from organisations to society, where one firm’s failure can affect people who never contracted with it.Source: §1.1.1 · p. 14

1.2.2 Seven Dynamic Information States

  • The book names seven states—collected, retrieved, transformed, inferred, generated, remembered and acted-upon—and argues that rules for one state do not automatically fit another.Inferred information may concern people who never supplied it, while many organisations have no retention rule for remembered information.Source: §1.2.2 · p. 16

1.2.3 The Data–Model–Agent–Action Loop

  • The eight-layer Data–Model–Agent–Action loop treats model processing as information creation, tracks consequences as feedback data and calls for governance beyond source data alone.Governance intensity rises as systems move from what they may know, to decide, to do; access permissions alone do not govern inference, tool use or execution.Source: §1.2.3 · p. 16, §1.2 · p. 17, §1.2.4 · pp. 17–18

1.2.5 When Does Generated Information Become Governed Data?

  • When generated information becomes governed depends on the concern: creation may matter for copyright, defamation and inferred personal data, storage for practical accuracy and access duties, and action for accountability.The book presents the timing question as open research, not a settled rule.Source: §1.2.5 · p. 18

1.3.1 Cross-Pillar and Cross-Layer Cascades

  • Quality, privacy, security and ethics remain co-equal pillars, but failures can cascade across pillars and lifecycle layers, with the interrupting control often located elsewhere than the visible harm.The proposed cascades include poor quality progressing through bad retrieval and confident inference to harmful action, and prompt injection progressing to tool misuse, exfiltration and liability.Source: §1.3 · pp. 19–20, §1.3.1 · p. 20

1.4.1 The Three-Lens Governance Method

  • The book applies technologist, lawyer and economist lenses to governance problems, with ethics addressing questions those lenses leave open; CRAFT structures deployment review around five decision questions.CRAFT asks about Community, Rules, Affect, Facts and Title—who is affected, applicable rules, experienced impacts, known or uncertain facts, and the decision-maker’s authority and legitimacy.Source: §1.4.1 · p. 21, §1.4.2 · p. 21

1.4.2 The CRAFT Lenses for a Single Decision

  • CRAFT does not resolve disagreements among its lenses, its fit with Indian traditions is untested, and it does not provide the institutional design that makes sound decisions systematic.For the railway facial-recognition example, the passage says a defensible deployment would require statutory authorisation, independent accuracy auditing, demographic impact assessment, contestability, sunset review and judicial oversight.Source: §1.4.2 · p. 22

1.5 Constitutional Foundations of Data Rights

  • Data governance’s foundations are constitutional, and India, the EU and the US differ in structure; the book asks how those rights apply to inferred information and system-made decisions.The field’s earlier phases moved from database-era IT housekeeping to compliance and then AI governance; adjacent concepts narrow in scope from governance through management and stewardship to administration.Source: §1.1.2 · p. 14, §1.1.3 · p. 15, §1.5 · p. 22

1.5. CONSTITUTIONAL FOUNDATIONS OF DATA RIGHTS

  • India’s Puttaswamy decision grounds privacy in fundamental rights, the EU Charter separately guarantees data protection, and the US Fourth Amendment protects against unreasonable government searches but leaves private-sector protection largely sectoral.Puttaswamy requires state intrusions to satisfy legality, legitimate aim, and proportionality, with procedural guarantees against abuse; the EU Charter provides access and rectification rights and independent oversight.Source: §1.5.1 · p. 22, §1.5.2 · p. 22, §1.5 · p. 23

1.5.4 Constitutional Rights and Inferred Information

  • Constitutional protections reach inferred information partly and unevenly, and none of the three frameworks addresses an agent acting on an inference without a human decision.India’s privacy reasoning can reach profiles but no statute specifically addresses inference or profiling; EU protection includes identifiable-person inferences and some decisively relied-on automated scores, while US constitutional limits constrain government rather than private inference.Source: §1.5.4 · p. 24

1.6.1 India Stack

  • India Stack’s Account Aggregator framework governs retrieval through digital consent without the aggregator reading or storing data, while fragmented governance leaves no single body accountable for the stack as a whole.The passage also identifies the identity layer’s exclusion risk when biometric authentication was compulsory without fallback; Drèze et al. (2017) documented exclusion of entitled households in a Jharkhand survey.Source: §1.6.1 · p. 25, §1.6 · p. 25

1.6.2 The DPDP Act, 2023 and Rules, 2025

  • The DPDP Act is consent-centric and provides rights and child protections, but broad state exemptions and gaps around profiling, automated decisions, explanations, sensitive data, and agent memory leave dynamic states unevenly governed.The Rules notified in November 2025 phase in operative obligations after eighteen months, in May 2027; Rule 13’s model-focused due-diligence duty applies only to notified Significant Data Fiduciaries.Source: §1.6.2 · pp. 25–26, §1.6.3 · p. 26, §1.7 · p. 27

1.7.1 Governance as an Investment

  • Governance is often underfunded because its costs are immediate while avoided losses are diffuse; IBM’s 2024 survey reported an average breach cost of USD 4.88 million and USD 2.22 million lower costs for extensive security AI and automation.The reported associations are descriptive, not causal; the economic case also includes externalities, information asymmetry, costly-to-fake governance signals, and the need for liability where disclosure alone cannot restore incentives.Source: §1.7.1 · p. 27, §1.7.2 · p. 28

1.7.3 Liability Allocation and the Incentive to Govern

  • Liability should fall on parties best placed to reduce expected harm, but current regimes poorly allocate responsibility across the AI loop and may leave retrieval or memory designers unexposed.For autonomous systems, expected harm also depends on action authority and propagation; narrowing authority and adding observation points can reduce harm even without changing failure probability.Source: §1.7.3 · p. 28, §1.7.4 · p. 28

1.8 The Book’s Proposition and Road Map

  • The book’s proposed unit of analysis is the data–inference–memory–action loop, with controls reaching every layer and accountability allocated across the parties that build, supply, deploy, and supervise it.The proposal is the authors’ synthesis, not an established external theory; the chapter summary notes that governing stored data alone cannot govern a closed loop.Source: §1.8 · p. 29, §1.9.1 · p. 29

Data Quality, Lineage and Provenance

This section frames data quality, lineage and provenance as governance controls for retrieved, inferred and generated information, addressing fitness for use, data history, origin and rights across AI pipelines. It examines their role in defensible training-data use, auditability and safer retrieval, alongside risks from poorly documented or unverified data and implementation patterns for governing it.

2.1.1 The Fitness-for-Use Paradigm

  • Consumer-defined quality is use-relative; operational programmes measure six dimensions: accuracy, completeness, consistency, timeliness, validity and uniqueness.Wang and Strong’s consumer taxonomy has fifteen dimensions across intrinsic, contextual, representational and accessibility categories; uniqueness is absent from that taxonomy.Source: §2.1.1 · p. 34, §2.1.2 · p. 34

2.1.3 Composite Scores and Their Misuse

  • Composite quality scores must reflect the use, while convenience samples, weak rules and IT-set weights can make a score misleading.Clinical data may prioritize accuracy and completeness, trading data timeliness, and training data representativeness; two of the six operational dimensions may not be computable without external references.Source: §2.1.3 · p. 35

2.1.4 A Measured Example

  • Raw Cleveland data were 99.9% complete (6 null cells), 100.0% valid (0 rule violations) and 100.0% unique (0 exact duplicate rows); accuracy and consistency were not assessable, and the data were 38 years old.Mode imputation of ca=0 and thal=3 raised completeness and validity to 100.0%, but the imputed values were not recorded by the clinic.Source: §2.1.4 · pp. 35–36, Figure 2.2 · p. 36

2.1.5 Quality When the Governed Object Is Not a Record

  • For retrieved passages, accuracy means query-fit; inferred values require calibration across prediction populations; generated responses add groundedness, measurable only when lineage exists.The reference for assessing accuracy shifts by information state: from the world for collected data to the corpus, a labelled evaluation set or retrieved context for retrieved, inferred or generated data.Source: §2.1.5 · p. 36, Table 2.2 · p. 37, §2.2 · p. 37

2.2 Data Quality vs. Data Integrity vs. Consistency

  • Quality, integrity and consistency are independent properties, so each needs its own control, metric and owner rather than being treated as interchangeable.Quality is fitness for use; integrity concerns correctness through storage and processing; consistency concerns agreement across representations, systems or time.Source: §2.2 · pp. 37–38

2.5.2 End-to-End Lineage Architecture

  • A four-layer lineage architecture collects OpenLineage events, stores them, enables graph queries and visualization, and enforces controls; ML lineage also tracks features, parameters, versions and metrics.The chapter describes combining DVC for data versioning with MLflow for training and model registry, with monitoring for drift.Source: §2.5.2 · p. 40, Figure 2.3 · p. 40, §2.5.3 · p. 41

2.5.4 Lineage for Generative AI

  • RAG lineage must record each response’s prompt, retrieved context, prompt template and model configuration, including retrieved chunks, source documents, similarity scores and access filters.The record supports explainability, purpose limitation, legal documentation and logging, and change detection when the embedding model or template changes.Source: §2.5.4 · p. 41, Figure 2.4 · p. 42

2.6.1 The Provenance Gap in Foundation Models

  • Foundation-model training corpora often have thin provenance, and litigation makes data acquisition and inference logs material governance concerns.In the OpenAI litigation, courts ordered preservation of deleted ChatGPT output logs and compelled production of 20 million de-identified conversation logs under a protective order.Source: §2.6.1 · p. 43, §2.6.2 · p. 43

2.6.2 Legal Landscape: Training Data as Liability

  • Training-data provenance must show how each source was obtained and under what terms, while inference logs are evidence and deletion practices face scrutiny.The cited cases distinguish whether training is transformative from whether copies were lawfully acquired; provenance is therefore an architectural control, not merely documentation.Source: §2.6.2 · p. 44

2.6.3 C2PA Content Credentials

  • C2PA attaches cryptographically bound, signed provenance assertions to media, but credentials are opt-in and can be stripped, so they complement rather than replace other controls.The passage places manifests alongside watermarking, logging and contractual warranties in a defence-in-depth design.Source: §2.6.3 · p. 44

2.6.4 Datasheets for Datasets

  • Datasheets document a dataset’s motivation, composition, collection, processing, uses and maintenance, and should accompany every training dataset admitted to a registry.They preserve remediation decisions for later users; model cards and data cards extend documentation to models and teams.Source: §2.6.4 · p. 44

2.7.1 Hyperscaler Governance Services; 2.7.2 Data Mesh and Federated Governance

  • Cloud governance services combine cataloguing, lineage, access control and quality monitoring, while data mesh requires centrally defined policy to be computationally enforced within autonomous domains.Mesh lineage is harder to centralize but indispensable for audit; stream-based metadata platforms aggregate domain events without owning pipelines.Source: §2.7.1 · p. 45, §2.7.2 · p. 45

2.7.3 Vector Database Governance

  • Vector stores require their own entitlements because embeddings can leak meaning or reveal document membership, and each vector must retain the model and version that produced it.A model change silently invalidates prior similarity results, while access controls on source text alone do not protect embeddings.Source: §2.7.3 · p. 45

A Recurring-Failure-Mode Framework

2.8.4 Equifax, 2017; 2.8.5 TSB Migration, April 2018; 2.8.6 Aadhaar Biometric Exclusion

  • Equifax’s breach followed an unpatched vulnerability and monitoring gaps; TSB’s migration exposed configuration differences; Aadhaar authentication failures excluded beneficiaries without fallback.The passages identify asset inventory, patching, certificate management, segmentation and credential governance for Equifax; validated migration and configuration inventory for TSB; and fallback and grievance override for Aadhaar.Source: §2.8.4 · p. 47, §2.8.5 · p. 47, §2.8.6 · p. 47

2.10.1 Chapter Summary

  • Quality is fitness for a stated use, with dimensions reassessed across information states; quality, integrity and consistency require separate owners and controls.Accuracy and consistency need a reference to score, retrieved information uses relevance, inferred information uses calibration, and generated information adds groundedness.Source: §2.10.1 · pp. 47–48

Global Data Protection Law and Intellectual Property

This section examines how data-protection and intellectual-property rules address inferred, generated, and acted-upon information in AI, including human authorship, training-data copyright, and providers’ EU obligations. It identifies unresolved questions around accuracy, authority to act, and copyright.

Global Data Protection Law and Intellectual Property

  • The chapter states that courts have converged on human-only authorship and inventorship, but divide over whether AI training is permitted use or unlawful acquisition.The abstract identifies this as the chapter’s intellectual-property distinction without specifying the individual decisions.Source: Global Data Protection Law and… · p. 51
  • The GDPR and DPDP Act can reach inferred personal information, but neither treats generated information as a distinct object or separately allocates responsibility for an agent’s actions.The chapter’s synthesis says each regime instead treats the agent as the fiduciary’s instrument; the DPDP Act also has no right against automated decisions.Source: Global Data Protection Law and… · p. 51

3.2.2 Six Lawful Bases (Article 6)

  • The GDPR’s legitimate-interests basis can support model training only if the three-step test is met and the model is not found to contain personal data.The DPDP Act has no equivalent basis, making this a major structural difference between the regimes for AI governance.Source: §3.2.2 · p. 53

3.3.3 Legitimate Uses (Section 7)

  • The DPDP Act’s closed list of consent-free uses leaves fresh consent, anonymisation, or abstention as the options for uncovered AI-training reuse.Consent must be specific and withdrawable; the chapter advises a narrow reading of whether data voluntarily provided for one purpose may serve a closely related one.Source: §3.3.2 · p. 55, §3.3.3 · p. 56

3.3.7 The Constitutional Challenge

  • The DPDP Act’s amended RTI exemption is under constitutional challenge, with the Supreme Court referring petitions to a larger bench and declining interim relief.The pending challenge contests whether a categorical personal-information exemption is proportionate when a case-by-case public-interest override previously existed.Source: §3.3.7 · p. 57

3.4–3.5 Comparative Jurisdictions

  • Data-protection approaches vary across jurisdictions: the United States combines sectoral federal rules with state laws, while China integrates privacy, network security, and state data control.The chapter also contrasts Japan’s GDPR alignment, South Korea’s strict regime, Singapore’s more permissive bases, and the frameworks in Brazil and Africa.Source: §3.4.1 · p. 58, §3.4.2 · p. 58, §3.5.1 · p. 59

3.6 Cross-Border Transfers and Localisation

  • Cross-border transfer rules differ: the GDPR requires exporters to assess destination-country protections, India permits transfers unless restricted, and China uses administrative gates and separate consent.The chapter advises keeping contractual clauses and a current transfer assessment in reserve for EU–US Data Privacy Framework transfers while its appeal remains pending.Source: §3.6.1 · p. 60, §3.6.2 · p. 60, §3.6.4 · p. 61

3.7.1 Inferred Information as Personal Data

  • The chapter frames whether computed values about a person—such as scores, propensities, diagnoses, or embeddings—count as personal data and attract statutory duties.This passage poses the issue but does not provide the section’s answer.Source: §3.7.1 · p. 62
  • Inferences about identifiable people are personal data, and GDPR accuracy, rectification, erasure, and decisive-reliance protections apply, while the DPDP Act has no equivalent to GDPR Art. 22.A trained model itself is covered if personal data about a person can be elicited from it. Neither regime explains how to prove a probabilistic inference inaccurate.Source: §3.7.1 · p. 62, §3.7 · p. 63

3.7.2 Generated Information About a Person

  • AI-generated statements about identifiable people are personal data, and operators remain responsible for accuracy even when technical limits make inaccurate generation difficult to prevent.Deployers should trace statements to supporting sources or mark them unsupported; filtering may address errors that a model regenerates, but whether filtering satisfies accuracy remains unresolved.Source: §3.7.2 · p. 63

3.7.3 Acted-Upon Information and the Agent as Instrument

  • When an agent acts, data-protection duties attach to the deploying controller or fiduciary, but that attribution does not establish whether the action was authorised, proportionate, or reversible.A processor engaged to run the agent is bound by contract; authority and control of the action require separate analysis.Source: §3.7.3 · pp. 63–64

3.8.1 Authorship and Inventorship: The Human-Only Rule

  • Courts that have decided the issue require a human author or inventor, while human selection, arrangement, or modification may be protected and organisations must document human contribution.India’s statutes also presuppose a person as author or inventor, though no Indian court has yet decided the question.Source: §3.8.1 · p. 64, Table 3.7 · p. 65, §3.8 · p. 65

3.8.2 Fair Use and Training Data

  • US courts distinguish training use from acquisition and market effects: training may be transformative, but pirated acquisition remains actionable and market dilution may support a claim.India has no general fair-use balancing test, and training on protected works without a licence is not assumed to fall within its closed fair-dealing list.Source: §3.8.2 · pp. 65–66

3.8.3 The EU AI Act’s Copyright Obligations

  • The EU AI Act requires general-purpose AI providers to adopt a copyright-compliance policy respecting machine-readable rights reservations and publish a sufficiently detailed training-content summary.These duties apply to models placed on the market from 2 August 2025; the scope of machine-readable reservations and obligations for training outside the Union remain unsettled.Source: §3.8.3 · p. 66, Figure 3.3 · p. 66

The Economics of Data Governance:

This section develops an economic account of data governance, applying institutional and behavioral economics to decision rights, costs, data valuation, market design, consent, regulation, enforcement, and incentives, with India’s DPDP Act and digital infrastructure as a running case. It extends the analysis to AI agents’ externalities and agency costs, infrastructure returns and regulatory costs, state data use and protection conflicts, and criteria and research designs for assessing the DPDP Act’s effects.

4.1.1 A Metaphor That Misleads

  • Data is non-rival, partly excludable, complementary, perishable and laden with externalities, so governance should emphasize access and licensing, time-limited rights, and regulation of inference rather than custody alone.Unlike oil, data can be reused without depletion, gains value through linkage, can lose value as the world changes, and can affect people who did not disclose it.Source: §4.1.1 · p. 72

4.1.2 Non-Rivalry and the Welfare Wedge

  • Consumer control can improve welfare by enabling broad use of non-rival data, but only when sharing transaction costs are low; the DPDP Act’s consent-based assignment therefore depends on institutions making consent workable.The Jones–Tonetti model finds too little sharing under firm ownership and welfare losses from a government ban on sales; India’s Account Aggregator framework is described as an attempt to lower transaction costs.Source: §4.1.2 · p. 73

4.1.3 Data as an Experience Good

  • Because data quality is hard to verify before use, adverse selection can drive good data from the market; documentation signals quality only when false claims are costly through audit or enforcement.Datasheets, certification and provenance warranties are possible remedies, but an unaudited datasheet that any seller can produce at the same cost signals little.Source: §4.1.3 · pp. 73–74

4.1.4 The Externality of Inference

  • Disclosure creates an inference externality: data about one person can reveal information about others, depressing their bargaining position and privacy; collection consent alone cannot address harms caused by subsequent inference.The section identifies purpose limitation, data minimisation and differential privacy as instruments that act on inferential use.Source: §4.1.4 · p. 74

4.1.5 A Taxonomy of Data Goods, Extended to the Loop

  • AI systems create economically distinct goods beyond datasets, including model weights, embeddings, agent memories, generated outputs and authority to act, each with different value, depreciation and externality characteristics.The authority to act is a right rather than an information good; its value comes from the decisions it enables, and its externality is potential harm to third parties.Source: §4.1.5 · p. 74, §4.1 · p. 75

4.2.3 The Data Asset Valuation Framework

  • INR 88.7 crore is the framework value for the illustrative fintech dataset, versus an INR 13.3 crore adjusted cost floor; the example finds that reducing risk from 0.3 to 0.2 is worth more than a ten-point quality improvement.The Data Asset Valuation Framework triangulates cost, market and income approaches, then adjusts for quality, risk and governance maturity; its result is a range rather than a definitive point estimate.Source: §4.2.3 · p. 76, Table 4.3 · p. 77, Figure 4.1 · p. 77

4.2.4 Extending the Framework to Models and Memories

  • The valuation framework extends to models and agent memories, but model quality must be re-evaluated as input distributions drift, and the framework omits portfolio complementarities and how value is distributed among data subjects.For models, risk includes provenance and capability risks; for agent memories, it includes poisoning and leakage. The framework values assets in isolation and does not establish who receives their value.Source: §4.2.4 · pp. 77–78, §4.2.5 · p. 78

4.3.4 India’s Four Experiments

  • India’s Account Aggregator, ONDC, OCEN and Urban Data Exchange build shared infrastructure to reduce market frictions and transaction costs, enabling consumer-controlled sharing and interoperability rather than relying only on private rails.The chapter also locates seven market failures in the Data–Model–Agent–Action loop; the supplied discussion identifies information asymmetry, externalities, market power and missing markets, and notes that the DPDP Act lacks a portability right.Source: §4.3.4 · pp. 79–80, §4.4 · p. 80

4.5.1 Residual Control Rights

  • Incomplete contracts leave unforeseen-use rights decisive: controller control risks exploitation, subject control creates consent costs, and intermediary control creates agency risk.The DPDP Act limits consent to specified purposes and provides for consent managers to lower exercise costs, while relying on registration conditions and fiduciary duties to contain intermediary incentives. The wider argument links moral hazard, adverse selection, coordination failure, externalities, and missing governance markets, so isolated fixes can re-emerge through other failures.Source: §4.5 · p. 81, §4.5.1 · p. 82, Table 4.7 · p. 82

4.7 Political Economy: Why Regulation Looks the Way It Does

  • Data silos reflect transaction-cost incentives, while regulatory regimes persist through path dependence; the DPDP Act records an interest-group compromise, and Brussels, Beijing, and Delhi export competing governance models.The DPDP compromise includes government exemptions and executive Board appointments, firms’ predictable costs, start-ups’ phased implementation, and civil society’s consent rights but not its preferred institutional independence. The section also argues that regime divergence is reinforced by distinct institutional foundations.Source: §4.5.2 · p. 82, §4.6 · p. 83, §4.7.1 · p. 85

4.6.1 The Privacy Paradox and the Endowment Effect

  • In the gift-card experiment, 52.1 per cent kept an anonymous $10 card rather than trade for $12 with tracking, but only 9.7 per cent traded a tracked $12 card for anonymity.The same privacy trade-off produced sharply different choices depending on the starting card, illustrating reference dependence and challenging the assumption that people make stable, informed, rational data decisions.Source: §4.6 · p. 83

4.6.2 Bounded Rationality and Rational Inattention

  • Because attention is scarce, compliant notices cannot ensure informed consent; privacy-protective defaults, timely layered disclosures, standardised visuals, periodic refresh, and structural backstops can improve consent design.Structural duties such as purpose limitation, minimisation, and security protect cases where behavioral corrections fail, but exemptions weaken those backstops. The consent discussion also identifies consent fatigue as requests accumulate.Source: §4.6.2 · p. 83, §4.6.3 · p. 84, Table 4.8 · p. 84

4.8.1 From the Externality of Inference to the Externality of Action

  • Agent actions impose externalities on non-parties; decision lineage enables attribution, while specification, information, and hidden-action gaps create agency loss even without an agent’s own interests.Widening an agent’s authority reduces monitoring but raises residual loss; legal constraints can require zero autonomy for specified actions, while limited review capacity forces a choice between buying reviewers and accepting residual loss. The model’s parameters are not empirically estimated, and cross-organisational agents complicate who bears the costs.Source: §4.8.1 · p. 86, §4.8.2 · p. 86, §4.8 · p. 87

4.8.3 The Cost of Delegation and the Placement of Approval

  • With β = 1.5, optimal autonomy is 0.78 for low stakes, 0.08 at h/cr = 0.8, and 0.00 for high stakes; at ε = 0.03, a five-agent chain loses 14.1 per cent of intent.These are illustrative conceptual-model results, not estimates; the model places approval according to harm relative to review cost and error propagation. Delegated authority should not widen at successive hops, and at least one chain node should verify against an independent source.Source: §4.8.3 · p. 87, §4.8.4 · pp. 87–88, Figure 4.3 · p. 88

4.9.1 What Infrastructure Returned

  • UPI recorded 241.6 billion transactions in 2025–26, while its rollout raised formal credit for borrowers without prior credit histories and did not increase defaults.The Government’s cumulative direct-benefit-transfer savings claim of about INR 3.48 lakh crore is supported in direction by evidence that biometric smartcards reduced leakage and improved welfare-payment delivery.Source: §4.9.1 · p. 89

4.9.2 What Regulation Cost

  • GDPR studies report a 2.1 per cent fall in technology-firm profits and 26 per cent less data storage, alongside a 0.1–0.6 per cent rise in production costs and disproportionate burdens on small firms.The section also catalogues eight governance traps, including compliance theatre, hollow consent, regressivity, and innovation chilling; its shared remedy is to specify and measure outcomes and proportion rules to risk.Source: §4.7 · p. 84, §4.9.2 · p. 90, §4.9.3 · p. 90

4.10. GOVERNMENT AS PRODUCER, CONSUMER AND REGULATOR

  • The government’s combined producer, consumer and regulator roles create a trilemma: maximizing all three is impossible, and the DPDP Act resolves it in favor of state production and consumption, risking under-protection.Proposed remedies include structurally independent regulation, independent audits of government data quality, proportionality review of state data use, open-by-default publication of non-personal data, and sunset clauses for emergency collection.Source: §4.10 · p. 91

4.11.2 The Inspection Game

  • With n = 20, m = 8 and d = 0.8, the chance of detecting a deficient control is 0.32 in one audit and 0.686 over three annual cycles.The proposed levers are higher detection rates through automated checks and risk-weighted sampling, rather than simply adding auditors; the annual audit cycle matters less than detection within it.Source: Figure 4.4 · p. 92, §4.11.2 · p. 92, §4.11 · p. 93

4.11.1 The Compliance Game

  • INR 52.5 crore expected defection cost—five times the INR 10 crore compliance cost—makes compliance dominant, but deterrence depends on the Board’s detection capacity rather than penalty size.With F = INR 250 crore, L = INR 100 crore, and ρ = 0.15, the chapter estimates this expected cost; at those F and L values, the compliance threshold is ρ∗ = 0.029.Source: §4.11.1 · p. 92

4.11.3 The Coordination Game and Evolutionary Convergence

  • Regulation can move firms from a stable bad-governance equilibrium by making defection costlier than compliance, while targeting visible firms can hasten convergence to good governance.The chapter’s evolutionary account predicts convergence once compliant firms pass a tipping point; significant-fiduciary designation is presented as a way to concentrate enforcement on visible firms.Source: §4.11.3 · p. 93

4.11.4 Mechanism Design: The Consent Manager

  • The consent manager remains an unsolved mechanism-design problem: it must align incentives with principals’ interests and make participation worthwhile, while fiduciary duties and detection constrain conflicts.The proposed design partitions principals by privacy type and offers consent tiers; the rules’ commencement will provide an empirical test of whether registered managers follow this model.Source: §4.11.4 · p. 93

4.12 Evaluating the Act: An Econometric Research Design

  • The proposed DPDP Act evaluation uses phased commencement for difference-in-differences, a significant-fiduciary threshold for discontinuity analysis, and synthetic control and discrete-choice methods for other outcomes.Researchers should separate regulatory effects from concurrent generative and agentic AI diffusion and measure externalities affecting people beyond firms, not only firm-level outcomes.Source: §4.12 · p. 94

4.13 Welfare Economics and Distributive Justice: Who Gains, Who Pays

  • A one-percent levy on digital GVA is estimated to yield about INR 17 per person monthly, while welfare assessment requires explicit weights on efficiency, equity and capability.Value capture concentrates in integration, analysis and application, while data generators capture approximately nothing. The chapter argues the dividend is small and that governance’s distributional case rests more on capabilities and the Rawlsian concern with exclusion and profiling than on cash transfers.Source: §4.13 · p. 95, §4.13.1 · p. 95, §4.13.3 · p. 96

4.14 Toward a General Theory of Data Governance Economics

  • The chapter’s general theory treats data and AI-created objects as economically distinct, identifies interacting market failures, and frames governance as infrastructure that shapes realized value and distribution.Its propositions also characterize consent as behaviourally insufficient without structural duties and AI delegation as a principal–agent problem whose losses compound along chains, mitigated through human approval and attenuated authority.Source: §4.14 · p. 97

Digital Trust, Cybersecurity and Zero Trust: From Access Control to Action Control

This section examines how digital trust and zero-trust governance extend from access control to governing AI-agent actions through verified components, scoped identities and delegations, and policies that evaluate and record decisions. It connects this approach to security frameworks, AI-era threats, Indian cybersecurity duties, cascading incidents, and board-to-operations programmes and threat modeling across identity, infrastructure, and agent actions.

Digital Trust, Cybersecurity and Zero Trust: From Access Control to Action Control

  • Agentic zero trust shifts enforcement from resource access to tool calls, governing agent identity, delegated authority, egress, budgets, provenance, and allow, review, or deny decisions recorded in action lineage.This architecture is the authors’ synthesis of SP 800-207 and workload-identity standards.Source: Digital Trust, Cybersecurity and Zero… · p. 101, §5.6 · p. 110

5.1.1 What Trust Is, Operationally

  • Digital trust rests on verified, observable components, yet breach, opacity, misuse, unavailability, and fabrication can each erode it, including without a breach.The chapter distinguishes narrow system trust from the broader willingness of people and institutions to rely on digital systems.Source: §5.1.1 · p. 102, §5.1.2 · p. 103
  • India’s digital public infrastructure now depends on AI models, retrieved content, and agent authority, expanding the trusted computing base beyond components classical security architectures accounted for.Aadhaar authentication, UPI settlement, and Account Aggregator consent artefacts rely on protocols that limit the trust counterparties must place in one another.Source: §5.1.1 · p. 102

5.2 From the Perimeter to Zero Trust

  • Zero trust makes identity, rather than network location, the basis for access, but governs whether a subject reaches a resource—not what an agent does afterward.The chapter reads NIST SP 800-207’s tenets through data-governance duties including purpose limitation, reasonable safeguards, and auditability.Source: §5.2 · p. 104, §5.3.1 · p. 104, §5.3 · p. 105

5.4 Frameworks as Mappings: CSF 2.0, ISO 27001, ATT&CK and the CIS Controls

  • Security programmes can map CSF 2.0, ISO 27001, ATT&CK, and CIS Controls to different governance needs, but these frameworks do not fully address AI systems as subjects or attack surfaces.The chapter also describes zero-trust maturity stages and policy as code, with verifiable conditions producing access decisions and audit records.Source: §5.4 · p. 106, §5.3.3 · p. 106, §5.3.4 · p. 106

5.5.2 What Large Models Change for the Attacker

  • Threats span attack vectors, objectives, target layers, and actors; large models enable faster social engineering, behavior-changing malware, and agent-assisted vulnerability discovery.The chapter notes that AI can accelerate both vulnerability discovery and patching, making the exposure window depend on which advances faster.Source: §5.5.1 · p. 107, §5.5.2 · p. 108

5.5. THE THREAT LANDSCAPE WITH AI ON BOTH SIDES

  • Adversarial attacks can evade, poison, extract from, or steal models, while prompt injection can make retrieved instructions act as an attack surface and has no fully effective mitigation.The chapter links these attacks to data-governance impacts such as backdoors, training-data extraction, and risks to erasure duties.Source: §5.5.2 · p. 108, §5.5 · p. 109

5.5.3 The Supply Chain as an Entry Point

  • Supply-chain compromises exploit trusted software channels; the chapter pairs SBOMs and build provenance with attention to model weights, datasets, embedding models, orchestration frameworks, and tool servers.It illustrates the risks with SolarWinds’ signed update and MOVEit’s widely exploited vulnerability.Source: §5.5.3 · pp. 109–110

5.7 Identity and Access Management: The Control Plane Beneath

  • Agents require their own short-lived verifiable workload identities and task-scoped, attenuated delegations; identity management must also govern the wider population of non-human identities.The section recommends phishing-resistant authentication where feasible and proportionate, layered authorization, and lifecycle controls for non-human credentials and permissions; Microsoft reported more than 600 million identity attacks a day against its infrastructure in 2024.Source: §5.6.1 · p. 110, §5.7.1 · p. 114, §5.7.2 · p. 114

5.6.2 The Enforcement Point Moves to the Tool Call

  • A policy enforcement point on every tool call evaluates delegation, instruction provenance, action value and reversibility, egress, and budget before allowing, reviewing, or denying the action.Review routes consequential but lawful actions to a human, and every decision, including deferrals, enters the decision–action lineage record.Source: §5.6.2 · p. 110, §5.6 · p. 111, Figure 5.1 · p. 111

5.6.3 The Policy Objects

  • The policy treats instruction provenance as decisive: it refuses autonomous consequential actions prompted by retrieved content rather than trying to detect prompt injection.Other policy objects include delegated authority, reversibility and value thresholds, permitted egress destinations, step and spend ceilings, and a lineage record with action context and reasons.Source: §5.6.3 · pp. 111–112

5.6. FROM ACCESS CONTROL TO ACTION CONTROL

  • Of 84 policy-surface cases, 7 are autonomous, 42 go to review, and 35 are denied.Trusted reads and drafts may proceed autonomously at any value, while irreversible actions require review; actions based on retrieved content are more restricted because that content may have been planted.Source: §5.6 · p. 113, Figure 5.2 · p. 113

5.6.5 What the Architecture Does Not Solve

  • The action-control design depends on truthful runtime labels, cannot detect harmful sequences of individually permitted actions, risks perfunctory human review, and lacks a standard for verifying foreign agents’ authority.The proposed mitigations include separating the model that reads untrusted content from tool rights and using lineage for observability, but the cross-organisation verification gap remains.Source: §5.6.5 · pp. 113–114

5.8. INDIA’S CYBERSECURITY LAW

  • Indian incident duties combine CERT-In’s six-hour reporting clock with DPDP breach notices without delay and detailed Board reporting within seventy-two hours, while the rules do not make one report satisfy another.The DPDP Rules specify safeguards including access controls, monitoring, one-year log retention, and processor protections; sector regulators add duties such as six-hour reporting, but none specifies an AI-agent action-control architecture.Source: §5.8.2 · p. 116, §5.8.3 · p. 116, §5.8.1 · p. 116

5.9 Incidents as Cross-Layer Cascades

  • SolarWinds showed that a compromised vendor build and trusted channels could evade victims’ perimeter controls, while Colonial Pipeline’s weak VPN entry prompted a shutdown despite no OT compromise.The proposed interruption points were controls at other layers: verification of updates, agents, and identity tokens for SolarWinds, and verified segmentation at the IT/OT boundary for Colonial Pipeline.Source: §5.9.1 · p. 118, §5.9 · p. 119, §5.9.2 · p. 119

5.9.3 AIIMS Delhi, 2022

  • About 40 million records were reported affected in the AIIMS ransomware incident, and the hospital ran on paper for about two weeks.The account attributes the prolonged disruption to outdated servers, absent network segmentation, and no immutable offline backup; segmentation and backups would not have prevented intrusion but could have kept the hospital open.Source: §5.9.3 · pp. 119–120

5.9.4 Marks & Spencer, 2025

  • About £300 million in operating profit was the impact Marks & Spencer guided for after attackers entered through a contractor-mediated help-desk credential reset.The proposed controls are independent verification for privileged resets and separation of help-desk authority from provisioning authority; payment data and passwords were not accessed.Source: §5.9.4 · p. 120

5.9.5 MOVEit and Change Healthcare

  • MOVEit’s zero-day reached more than 2,500 organisations and about 90 million people; Change Healthcare later reported about 190 million affected individuals and a USD 22 million ransom payment.Both incidents illustrate how one widely used component can expose dependent organisations; the proposed controls are an SBOM for rapid exposure mapping and limits on concentration.Source: §5.9.5 · p. 120

5.10 The Governance Programme: Board to Operations

  • The programme assigns cyber risk to boards, gives the CISO an independent reporting line, prioritises identity through agent action controls, and tracks outcome-based metrics.For SMEs, the passage proposes a proportionate cloud-delivered programme with managed identity, endpoint and email security, immutable backups, and provider-supported CERT-In logging and clock obligations.Source: §5.10 · pp. 120–121

5.11.1 Chapter Summary

  • Zero trust extends to agents through task-bound identities, attenuated delegation, policy-enforced tool calls, instruction provenance, reversible actions, and decision lineage.The chapter summary also notes that existing frameworks and legal regimes do not yet treat agents as subjects, and that prompt injection cannot be eliminated by filtering.Source: §5.11.1 · p. 121

5.11.2 Discussion Questions

  • The discussion questions ask readers to test agent delegation and provenance, reconcile incident-reporting clocks, assess certification, and locate defects and harms across incident layers.They also ask for an operational definition of CERT-In’s “noticing” trigger and its application to the AIIMS and Marks & Spencer timelines.Source: §5.11.2 · pp. 121–122

5.11.3 Lab: STRIDE Threat Model of HealthConnect India, with an Agent

  • The HealthConnect India lab adds a care-coordination agent to a hypothetical platform serving 500 hospitals and ten million patients, then applies STRIDE to its system and agent threats.The exercise includes indirect prompt injection through a hospital FHIR note and disclosure of another patient’s data in a referral, with delegation records and policy-simulation outputs.Source: §5.11.3 · p. 122

Ethics and Responsible AI: Fairness, Explanation and Responsibility When Systems Infer and Act

This section examines responsible AI governance for systems that infer attributes and act, focusing on explicit, contestable fairness choices, meaningful explanations and remedies, and responsibility across prediction, recommendation, decision and execution. It extends scrutiny to inferred and acted-upon information and considers auditing agent reasoning and action logs alongside governance controls, while emphasizing that human review does not transfer accountability.

6.1.1 What the Law Leaves to Judgement

  • Ethics addresses questions left unresolved by law: choosing among incompatible fairness criteria, providing adequate explanations, and assigning responsibility across prediction, recommendation, decision, and execution.The chapter argues that an agent may occupy every stage and that oversight is a control, not a transfer of accountability.Source: Ethics and Responsible AI: Fairness,… · p. 125, §6.1.1 · p. 126

6.1.2 The Traditions as a Map

  • The chapter adopts structured pluralism: make ethical commitments explicit, evaluate against multiple criteria, allow affected people to contest choices, and preserve deliberation after deployment.This procedure is offered as negotiated common ground rather than a single ethical doctrine.Source: §6.1.2 · p. 127

6.2. FOUR PRINCIPLES AND THEIR TENSIONS

  • Fairness, transparency, accountability, and privacy can conflict; the chapter frames impact assessment as a way to make trade-offs visible, documented, and contestable.It highlights fairness versus privacy in bias testing and transparency versus security when disclosed decision boundaries can be exploited.Source: §6.2 · pp. 129–130

6.3.2 Two Sources the Loop Adds

  • The chapter maps bias across the data-to-action loop, adding retrieval bias and memory bias to seven classical sources because retrieved material can be skewed and remembered inferences can become standing facts.Different sources require different controls; retrieval lineage and corpus-coverage audits address retrieval bias, while memory governance addresses what agents retain and for how long.Source: §6.3.1 · p. 130, §6.3.2 · p. 131, §6.3 · p. 131

6.4.1 Six Definitions

  • The chapter distinguishes statistical parity, equalised odds, calibration, individual fairness, counterfactual fairness, and disparate impact, each of which encodes a different test or shifts the choice elsewhere.For example, individual fairness depends on a task-specific similarity metric, while counterfactual fairness depends on the causal model.Source: §6.4.1 · p. 132

6.4.2 The Impossibility Result

  • When group base rates differ, equal PPV, equal false-positive rates, and equal false-negative rates cannot all hold unless the classifier is perfect or base rates are equal.The chapter numerically checks the identity linking these quantities and shows why fairness criteria force a governance choice rather than a technical fix.Source: §6.4.2 · p. 132

6.4 Fairness, Defined and Measured: The Arithmetic of an Impossible Choice

  • At a 0.50 threshold, group A’s false-positive rate was 26.7% versus 9.3% for group B; equalising rates lowered group B’s PPV from 68.5% to 53.9% and overall accuracy from 75.1% to 72.9%.The simulated score remained calibrated by construction; the choice among error-rate parity, calibration, and accuracy depends on the decision’s purpose.Source: Figure 6.1 · p. 133, §6.4 · p. 133

6.4.3 What the Arithmetic Misses

  • Fairness criteria depend on what counts as truth and on group base rates, which may themselves reflect historical and measurement bias.The chapter cautions that equalised odds against re-arrest can make a system equally accurate at predicting policing rather than underlying offending.Source: §6.4.3 · p. 133
  • Fairness metrics cannot settle which criterion is right: the choice must be explicit, justified, documented for its trade-offs, contestable and revisited as evidence accumulates.Single-axis parity can still conceal harm to intersecting subgroups, such as Dalit women.Source: §6.4.3 · p. 134, §6.5 · p. 135

6.5 India’s Axes of Disadvantage: Caste, Gender, Language, Geography and Their Intersections

  • Indian algorithmic disadvantage can arise through proxies and uneven data, while caste-disaggregated deployment data are absent and language, geography and intersecting harms challenge single-axis tests.Aadhaar authentication failures were reported at roughly a tenth to a third of Public Distribution System transactions, concentrated among manual labourers, older people and disabled people; language-model service quality falls across Indian language resource tiers, and rural areas face weaker internet, devices and training-data density.Source: §6.5 · pp. 134–135

6.5.1 A Testing Protocol for Indian Deployments

  • The proposed Indian testing protocol covers exposed protected grounds and intersections, reservation mandates, caste audits without collecting caste, Census and NFHS base rates, language performance floors and exception handling.It identifies the RTI Act for public systems and DPDP Rules Rule 13 due diligence as the nearest statutory hook for private systems.Source: §6.5.1 · p. 136

6.6.1 Interpretable Models and Post-Hoc Methods

  • Explanation methods serve different needs: interpretable models expose their own structure, post-hoc tools approximate black boxes, and counterfactual or concept-based methods address recourse or proxy sensitivity.Post-hoc explanations can be unstable or manipulated; attention weights are not explanations, and mechanistic interpretability remains a research programme rather than a governance instrument.Source: §6.6 · pp. 136–137, §6.6.1 · p. 136

6.6.2 The Right to Explanation

  • EU case law now requires an intelligible account of the procedures and principles actually applied, sufficient to check and contest a decision; India has no general equivalent decision-explanation right.An accurate attribution is not meaningful if a person cannot use it to contest, correct or object; explanations for agents must also identify the instruction, retrieved source and permission behind an action.Source: §6.6.2 · p. 138

6.7 Accountability and Its Instruments: Assessment, Documentation, Audit, Redress

  • Accountability combines impact assessment, documentation, audit and redress, but India lacks statutory assessment and effective remedies for harms that are individually small and collectively large.The model card’s disaggregated performance table makes representation and aggregation bias visible; ethics functions need authority to stop a product to be more than advisory.Source: §6.7 · pp. 138–140

6.8 Human Oversight: The Bridge to Chapter 8

  • Human oversight must be layered by stakes and designed for role clarity, competence, authority, information and accountability, because automation can anchor people and widen disparities.In the reported experiment, risk scores did not improve decision accuracy and sometimes widened racial disparity; agents also require action records and monitoring signals that distinguish bad actions from unusual ones.Source: §6.8 · p. 140, §6.9 · p. 141

6.9.1 Four Stages, Four Responsibilities

  • Responsibility is distributed across prediction, recommendation, decision and execution, and a fiduciary delegating an agent across the latter stages is answerable for them.Meaningful control requires behaviour to track human reasons and be traceable to someone able to understand and influence it; the loan-servicing example raises harms from an inferred gender attribute never collected or requested.Source: §6.9 · pp. 141–142, §6.9.1 · p. 142

6.9.2 Fairness on Inferred Attributes

  • Discrimination based on an inferred attribute remains discrimination even when the inference is wrong; the authors argue India’s Constitution should treat decisions based on a believed sex as made on that ground.The section invokes the UK Equality Act’s perceived-characteristic rule and notes that no Indian court has yet applied this position to a model.Source: §6.9.2 · pp. 142–143
  • At equal risk, inferred-female accounts faced 6.0 percentage points more adverse actions; 85% inference accuracy still left 902 of 6,000 accounts wrongly labelled, with 314 adverse actions.The logistic regression recovered a 0.36 coefficient on the inferred attribute, against the synthetic planner’s 0.35; the audit recovers the attribute from the agent’s reasoning trace.Source: §6.9.2 · pp. 143–144, Figure 6.3 · p. 144

6.9.3 Inferential Privacy

  • An unsolicited protected-attribute inference is personal-data processing that may exceed the purpose disclosed to the principal, creating a privacy harm before any discrimination question arises.The section derives this position from contextual integrity, informational self-determination, and DPDP Act purpose limitation; it says the position has not yet been tested before the Board.Source: §6.9.3 · p. 144

6.9.4 Oversight Is Not Accountability

  • Human oversight is a control, not a transfer of accountability: rubber-stamping reviewers may be moral crumple zones, while the fiduciary remains answerable for the agent’s actions.The proposed remedy is to address the planner’s grounds where the inferred attribute entered the chain, rather than rely on a reviewer to catch it downstream.Source: §6.9.4 · p. 145, §6.11 · p. 147

6.9.5 Laboratory: Auditing an Agent’s Action Log

  • The action-log audit detects disparity but cannot establish whether the planner used an inference directly or through a correlate, and it depends on recorded actions and traces.It also assumes a known true attribute and is single-axis; unrecorded actions cannot be audited, and untraced inferences cannot be found.Source: §6.9.5 · pp. 145–146

6.10 What This Pillar Adds to the Control Plane

  • The control-plane contributions include an empowered ethics function, an impact-assessment stage gate, fairness KPIs, five explanation layers, audited oversight, and standing inferred-attribute audits.The stage gate considers autonomy and reversibility; the fairness metrics use selected intersections, external base rates, and a floor for every language served.Source: §6.10 · p. 146

6.11.1 Chapter Summary

  • Fairness criteria can conflict: when base rates differ, calibration and equal false-positive and false-negative rates cannot all hold, so choosing among them is a governance decision.In the worked population, a calibrated score gave the higher-base-rate group a false-positive rate 2.86 times the other group’s; equalising it cost calibration and accuracy. Bias can enter at nine points in the loop, including retrieval and memory.Source: §6.11.1 · p. 146

6.11. TAKEAWAYS, QUESTIONS, AUDIT EXERCISE

  • Indian fairness testing should reach caste through proxies without collecting it and account for gender, language, geography, and intersections; a responsible-AI audit should map the decision chain and assess fairness, explanations, oversight, and redress.The chapter’s exercise asks auditors to document scope and evidence, run inferred-attribute audits where relevant, and produce prioritised recommendations for leadership.Source: §6.11 · p. 147, §6.11.3 · pp. 147–148

Governing Generative AI: One Request Through the Pipeline

This section treats the generative AI pipeline and the information it retrieves, generates, and retains as the objects of governance, tracing a policy-document assistant across stages, memory, and records. It specifies controls and traceable evidence for explaining outputs and assessing staged attacks, residual failures, and governance signals.

7.1 One Request, Eight States

  • The pipeline thesis is that controls must follow each information state through retrieval, generation, reliance, and memory, because the loop returns content as context and sometimes training data.In the insurer example, an output becomes a record when the officer writes “not covered” on a claim file; the chapter also develops memory governance and a trace answering eight reconstruction questions.Source: Governing Generative AI: One Request… · p. 149, §7.1 · p. 150

7.1.2 The Risks, by State

  • Risks enter at different stages: bias can arise in retrieval and ranking as well as the model, personal-data leakage has four doors, and chained calls multiply cost.A wrong answer may reflect a retrieval failure rather than generation; the chapter locates risks by the stage where they enter and the information state they corrupt.Source: §7.1.2 · pp. 151–152

7.2 The OWASP Top Ten as a Control Matrix

  • The OWASP 2025 control matrix connects LLM vulnerabilities to controls and statutory hooks, while prompt injection requires special treatment because documents and prompts reach the model through the same channel.Indirect injection can arrive in retrieved content; architectural defences and review before actions based on that content are needed because instruction-hierarchy training does not eliminate the risk.Source: §7.2 · pp. 152–153

7.3 Confidentiality, Integrity and Availability for Generated Information

  • For generated information, confidentiality, integrity, and availability require distinct controls, alongside authenticity, non-repudiation, and accountability.Controls include corpus sanitisation and provider retention terms, grounded outputs and provenance, multilingual red-teaming, quality-aware availability planning, synthetic-output marking, and a minimisation-conscious governance trace.Source: §7.3 · p. 154

7.4 Defence in Depth: Four Layers and the Arithmetic of Independence

  • The four defence layers are model, system, application, and architecture; their multiplicative protection depends on independent failures, which the chapter tests through an illustrative arithmetic model.The dual-LLM pattern quarantines untrusted documents from a privileged model, while correlated failures across model families, languages, or the boundary channel can undermine the independence assumption.Source: §7.4 · p. 154, §7.4.1 · p. 155, §7.4.3 · p. 157

7.4.2 Running the Arithmetic

  • 4.2% of indirect-injection requests remain successful after dual-LLM quarantine, down from 80% with the model layer alone under the illustrative independence model.By comparison, direct-injection residual success falls from 40% with the model alone to 6.0% with model, input, and output layers; document-level access control reduces unauthorised-retrieval residuals to 2%, while grounding reduces hallucination probes from 30% to 12%.Source: Figure 7.2 · p. 156, §7.4.2 · p. 156

7.5 Retrieval: Governing a Document Someone Else Wrote

  • Retrieval governance extends to other people’s documents, and vector stores are trust boundaries because vectors can be inverted to recover much of their text (Morris et al., 2023).Document-level access control must ensure users retrieve only records they may see; the chapter contrasts metadata filtering, namespace separation, and post-retrieval filtering.Source: §7.5 · p. 157, §7.5.1 · p. 157

7.5.2 Chunks, Embeddings and Poisoned Corpora

  • Poisoned documents can embed near likely queries, inject instructions, or crowd out legitimate chunks, so ingestion requires provenance, review, anomaly detection, retrieval diversity, and audits.The embedding endpoint is another boundary: processing Indian personal data through a foreign endpoint constitutes a cross-border transfer.Source: §7.5.2 · p. 158

7.5.4 Retrieval Failure Versus Generation Failure

  • Trace-based context recall and faithfulness distinguish retrieval from generation failures, agreeing with planted causes on 91 per cent of 600 simulated wrong answers (Fig. 7.3).Low context recall indicates retrieval failure; adequate recall with low faithfulness indicates generation failure. The rule left 34 cases undetermined; production scores are estimates from a judge model and inherit its errors.Source: §7.5.4 · p. 158, Figure 7.3 · p. 159, §7.6 · p. 159

7.6.1 Eight State Objects

  • Eight state objects require policies for scope, retention, inspectability and deletability; semantic and provider-side caches pose distinct disclosure, erasure and visibility risks.The semantic cache must be partitioned by access class, exclude personal-data answers and be invalidated when cited documents change or are erased; the provider-side prompt or KV cache is invisible to the deployer and needs contractual limits.Source: §7.6 · p. 159, §7.6.1 · p. 160, Table 7.6 · p. 160

7.6.2 When Does an Output Become a Record?

  • An output becomes a record when stored outside the session, sent to an unrequesting party, or relied upon; memory lineage enables erasure through records and derived data, but not model weights.Memory entries should record source and time and exclude inferences; erasure reaches history, memory and summaries, caches, corpus chunks and embeddings, and trace content, while personal-data fine-tuning is barred by default because weights cannot be erased by deleting records.Source: §7.5.3 · p. 158, §7.6.2 · p. 160, §7.6.3 · p. 160

7.7.1 Eight Questions, One Record

  • A governance trace reconstructs each record-capable request, capturing its inputs, retrieval, model and prompt versions, memory, instruction sources, output, review decision and tool permissions.Unlike sampled operational telemetry, the trace is complete for requests whose output could become a record and answers why, which source, model, memory, permission and tool shaped the request and what was approved or changed.Source: §7.7.1 · p. 161, §7.7 · p. 161

7.7.2 Signals, Drift and the Minimisation Problem

  • Stage-specific governance signals detect drift, while trace minimisation hashes content, retains it selectively and tiers retention to reconcile accountability with data minimisation.The chapter proposes keeping structure for the applicable legal period and content only when an output became a record or a decision was review or deny; trace access is role-limited and itself recorded.Source: §7.7.2 · p. 162

7.8 From Prototype to Production

  • Production governance combines deployment and evaluation gates with sensitivity-based routing, token budgets, circuit breakers and quality-aware service levels.Provider model updates rerun gates; evaluation covers accuracy, safety, language fairness, robustness and cost. The service level specifies grounding and wrongly-blocked limits and requires explicit failure rather than silent downgrading.Source: §7.8 · p. 162, §7.9 · p. 163

7.9 The Law Where It Reaches a Stage

  • Law reaches retrieval, memory, trace and output stages through DPDP duties, AI Act provider obligations and output transparency, alongside US sectoral and voluntary guidance.The passages also identify the output-stage copyright risk of memorised lyrics and describe output filtering and provider indemnity as controls; open-weight deployment removes that indemnity.Source: §7.9 · pp. 163–164

7.10 Guardrails Tooling: Composition, Not Selection

  • Guardrails are composed rather than selected: deterministic filters, model classifiers, validators and dialogue-flow controls are configured, tested, versioned and reviewed as code.Cloud-managed services apply where data may lawfully leave the deployment and provider opacity is accepted; the comparison also considers auditability, data location and gaps in Indian-language coverage.Source: §7.10 · p. 164, Table 7.7 · p. 164

7.11.3 Laboratory: Securing the Policy-Document Assistant

  • The lab builds an uncontrolled assistant, records attack-suite baselines, then adds input and output guardrails, metadata-based access controls, and a dual-LLM pattern, rerunning tests after each step.It compares measured residual rates with the closed-form estimate and reports cases where correlated failures exceed the estimate; deliverables include stepwise attack results and a correlated-failure report.Source: §7.11.3 · p. 166
  • The suite is repeated in Hindi, Telugu, and Latin-script Hinglish, with wrong answers attributed to retrieval or generation and an erasure request traced across every object.The lab also emits a governance trace for each request and stage-wise governance signals.Source: §7.11.3 · p. 166
  • The exercise uses OWASP attack scenarios, safety and adversarial-prompt datasets, MS MARCO retrieval passages, incident cases, and IndiaAI and Bhashini data for multilingual tests.Deliverables also include a failure-attribution table, erasure demonstration, sample traces, and a 2,000–3,000-word report keyed to the OWASP matrix and four layers.Source: §7.11.3 · p. 166

Governing Agentic AI and Multi-Agent Systems: The Authority Stack and the Chain of Action

This section treats agent authority and the chain of handoffs leading to action as units of governance, distinguishing model outputs, agent decisions, and agent actions while constraining delegated authority, recording steps, and treating autonomy as a governance variable. It covers governance controls for MCP and A2A, deployer enforcement, and red teaming across five phases, alongside discussion questions and a hands-on grievance-system lab.

8.1.1 The Spine: Output, Decision, Action

  • A model’s output, an agent’s decision, and its action are distinct events requiring separate controls; passing model text directly to a tool executor leaves the system without governance.The chapter’s six invariants also require verifiable agent identity, authority no broader than the delegator’s, enforcement at every action, recorded handoffs, provenance for memory and messages, and budgets and breakers for loops.Source: Governing Agentic AI and Multi-Agent… · p. 167, §8.1.1 · p. 168, §8.1 · p. 169

8.1.2 The Autonomy Spectrum as a Governance Variable

  • Autonomy is a governance variable to choose per task class, based on which rights the system exercises without a human and what oversight applies.The chapter links the choice to balancing expected harm and review cost, with oversight ranging from human decisions to action gates and fleet-level supervision.Source: §8.1.2 · p. 169, §8.1 · p. 169

8.1.3 What an Agent Is, and the Frameworks That Build One

  • Agent frameworks supply different native governance primitives, but none enforces attenuation at handoff or emits the decision–action lineage record, which deployers must add.For example, LangGraph provides checkpoints for interruption and replay, while the OpenAI Agents SDK makes handoffs and guardrails first-class.Source: §8.1.3 · p. 170, Table 8.1 · p. 170

8.2 The Expanding Attack Surface

  • Agents expand the attack surface through tools, persistent memory, inter-agent channels, credentials, files, and state, enabling poisoned content, authority laundering, stale permissions, and harmful action sequences.Tool descriptions can disguise harmful behavior, benign tools can compose into exfiltration, and poisoned memories can affect later cases.Source: §8.2 · pp. 170–171

8.3 A Threat Taxonomy for Systems That Act

  • The threat taxonomy covers indirect injection, tool misuse, memory poisoning, cascading trust failures, goal drift, and runaway processes, with countermeasures including provenance, least privilege, isolation, independent checks, outcome monitoring, and breakers.A cross-cutting multi-agent risk is collusion: individual controls may pass while fleet behavior fails, so gates must evaluate aggregate activity and audits must read fleet lineage together.Source: §8.3 · p. 172

8.4 Topologies, Governance Primitives and the Handoff as a Governance Event

  • Sequential, parallel, hierarchical, and mesh topologies create different checkpoint, aggregation, delegation, and audit risks; governed handoffs require attenuated authority, preserved context provenance, and a record.Governance primitives include least privilege, human approval gates, egress control, budgets and breakers, correlated observability, and agent identity.Source: §8.4 · pp. 173–174

8.5.1 Five Layers, Each a Subset of the One Above

  • The authority stack combines identity with data-access, inference, tool, and action rights, each narrowed at handoff and checked against the acting agent’s own authority.Delegation tokens carry the stack, a time to live, and a budget; an enforcement point checks each action, countering confused-deputy failures.Source: §8.5.1 · p. 174, Figure 8.2 · p. 175
  • 1 of 3 handoffs was trimmed, making the requested refund impossible because no agent below the tahsildar held the required refund rights.The handoff instead granted update_status and update, and recorded that the instruction came from retrieved content.Source: §8.5.1 · p. 174, §8.5 · p. 175

8.5.2 What Attenuation and Enforcement Buy: The Chain Arithmetic

  • Under illustrative declared parameters (ε=8%, d=95%, q=90%), out-of-scope actions at eight hops are 48.7% with ambient authority, 3.16% with attenuation, and 0.32% with attenuation plus enforcement.At eight hops, drift is 34% and remains untouched by authority controls.Source: §8.5.2 · p. 176, §8.9.1 · p. 183

8.5.3 The Lineage Record, Completed

  • The completed lineage record spans eight stages from source data to feedback, with one entry per stage and handoff to reconstruct why, which source, model, memory, permission, tool, approver and effect.At hop 3, the record shows a refund request trimmed because the delegator lacked payment authority, with retrieved content preserved as the instruction source.Source: §8.5.3 · p. 177, Figure 8.4 · p. 178

8.5.4 The Lifecycle, and the Fleet

  • The five-layer lifecycle runs from identity registration and pre-deployment assessment through runtime control, audit and improvement; the fleet plane is an agent-instance component of Chapter 11’s broader control plane.Because control of the fleet plane controls agents’ authority, it needs multi-person policy approval, immutable logging and just-in-time privileged access.Source: §8.5.4 · p. 178, Table 8.5 · p. 179

8.5.5 Provenance, Breakers and Rollback as Governance

  • Governance requires provenance headers to survive message summarisation, breakers to preserve state and record halts, and reversible tools to expose compensating actions while irreversible actions receive prior review.The governance body owns breaker conditions and the versioned action-classification policy; reversibility concerns real-world effects, not merely database state.Source: §8.5.5 · p. 178, §8.6 · p. 179

8.6 Liability for the Acts of Autonomous Agents

  • Deployers may be bound for in-scope agent acts under agency and electronic-contract doctrines, while software product liability remains unsettled in India and no regime apportions responsibility along the agent chain.The Indian Contract Act supplies the agency framework (Parliament of India, 1872); electronic contracts are addressed by the IT Act and UETA (Government of India, 2000; National Conference of Commissioners on Uniform State Laws, 1999). The EU Product Liability Directive covers software and AI systems (European Union, 2024b), while the AI Liability Directive was withdrawn (European Commission, 2025a).Source: §8.6 · pp. 179–180, §8.7 · p. 181

8.7 MCP and A2A as Governance Surfaces

  • MCP governs agent-to-tool connections and A2A governs peer-agent interactions, but neither specifies capability attestation or carries consent and authority constraints across delegation hops.Deployers must enforce allow-lists, verify high-stakes capability claims and connect A2A delegation authority to the delegate’s MCP tool calls.Source: §8.7 · pp. 181–182, Table 8.7 · p. 182

8.8 Red Teaming Systems That Act

  • Agent red teaming tests multi-turn, cross-tool and cross-agent sequences, including capability, boundary, chain, tool-call and governance-control tests; attenuation checks and lineage explainability are additional targets.Findings are reported as mitigations, structural changes or accepted risks, and mapped to a threat category and invariant.Source: §8.8 · pp. 182–183, Table 8.8 · p. 183

8.9.1 Chapter Summary

  • MCP and A2A carry neither attestation nor authority propagation, so deployers enforce around them; five-phase red teaming tests actions, targets attenuation bypass, and treats the record as a success criterion.The chapter summary distinguishes governance of actions from inspection of outputs.Source: §8.9.1 · p. 184

8.9.2 Discussion Questions

  • The discussion questions probe invariant enforcement, lineage-based reconstruction, delegation risk, attenuation limits, and liability across agent handoffs.They ask readers to rerun the opening scenario under I2, I3, and I5, examine an expired-vendor procurement delegation, identify residual risk from natural-language delegation, and analyze when attenuation alone is insufficient.Source: §8.9.2 · p. 184
  • Further questions address poisoned-memory controls, interdepartmental A2A governance, AI Act compliance, delegation-chain liability, and fleet-level spending authorization.They ask about personalization costs, governance-agreement terms and an enforceable protocol extension, as well as how to document a fleet-level spend violation when individual agents stay within their value gates.Source: §8.9.2 · p. 184

8.9.3 Laboratory: Building and Attacking the Grievance System

  • The lab builds, attacks, and governs a three-agent grievance system, requiring explicit authority stacks, attenuating handoffs, runtime controls, human gates, phase-based red teaming, and lineage reconstruction.Deliverables include manifests, handoff records, phase-based results, a reconstruction report, and a governance assessment keyed to six invariants; suggested datasets and resources cover injection, tool-use evaluation, safety baselines, incidents, and threat scenarios.Source: §8.9.3 · pp. 184–185

Data Governance in Elections, Political Intelligence and the Public Sphere: The Largest Loop in Public Life

This section examines governance across the electoral and public-information data loop, including campaign data accumulation, voter profiling, and the accountability risks created when generated political information lacks clear ownership, enforcement, or records. It develops a committee brief focused on changing incentives through provenance, disclosure, and tiered access, and concludes with a synthesis and exercises for testing and improving the brief.

9.1.1 The Election as a Public Loop

  • An election’s public loop runs from rolls and voter models through campaign and platform agents to actions, then back through turnout, results and engagement data into the next cycle.Its data layer is public for audit, but older controls mainly govern actions rather than voter inferences or generated information; private custodians of models, agents and actions lack comparable statutory duties.Source: §9.1.1 · p. 189, §9.1.2 · p. 190

9.2.1 The Roll and the Linkage Question

  • The roll’s completeness errors distribute inclusion and disenfranchisement asymmetrically, while Aadhaar linkage is permitted for identity but downstream joins require separate proportionality justification.The chapter notes that the DPDP Act’s state-instrumentality exemption may cover ECI processing, and whether seeded roll data may be shared with parties remains unsettled.Source: §9.2.1 · p. 190, §9.2 · p. 191

9.2.2 The Boundary as an Allocation

  • The frozen apportionment transfers representation between states, while constituency size disparities made a vote in Lakshadweep carry roughly sixty times the weight of one in Malkajgiri.The chapter distinguishes distributive apportionment from districting quality, which concerns whether boundaries split settlements or join unrelated areas.Source: §9.2.2 · p. 191

9.2.3 The Machine and the Audit as a Sampling Problem

  • With five VVPATs sampled per assembly segment, a hypothetical 5% tampering rate yields a 0.77 chance of no tampered machine in the sample, motivating risk-limiting audits.The 2024 judgment retained five-slip verification and added a candidate-requested memory check of up to 5% of EVMs; the chapter argues audit intensity should scale with the margin.Source: §9.2.3 · p. 192

9.3 Forecasting as a Market: The Herding Puzzle

  • The 2024 exit polls’ common error was 73 seats against 22-seat dispersion (herding ratio 3.4), consistent with pollsters shading toward consensus, though raw data is needed to distinguish causes.The proposed corrective is disclosure of samples, weights, seat-conversion rules and raw-to-published adjustments rather than restricting publication.Source: §9.3 · pp. 192–194, Figure 9.2 · p. 193

9.4.1 Cambridge Analytica, Read as a Market Failure

  • The Cambridge Analytica episode illustrates how near-zero profile-acquisition costs, costly detection and unverifiable targeting claims produce over-collection and overclaiming with voters bearing exposure.The chapter’s remedies are purpose limitation with penalties, platform liability for API misuse and disclosure of targeting criteria.Source: §9.4.1 · p. 194, §9.4 · p. 195

9.4.2 India’s Channel: Structure Without Content

  • Because WhatsApp’s end-to-end encryption limits content-based controls, forwarding limits raise the cost of mass distribution, while party voter apps collect personal data under unsettled DPDP coverage.The uniform forwarding limits also burden benign messages, not only malign ones.Source: §9.4.2 · p. 195

9.4.3 The Model: A Budget, a Margin and a Persuadability

  • By cycle five, learning raised spend Gini from 0.62 to 0.83, left 74% of seats below the contact floor, and reached only 206 constituencies versus 347 without learning.The model allocates a fixed campaign budget to maximize expected seats; contact data reduces uncertainty in seats contacted, making those seats more attractive in later cycles.Source: §9.4.3 · p. 196, Figure 9.3 · p. 196

9.5. GENERATED INFORMATION IN THE PUBLIC SPHERE

  • Seat-maximising campaign contact concentrates on marginal constituencies, and learning from contact reinforces that concentration across election cycles.The externality falls on voters written off; the proposed levers are disclosure of targeting criteria and a publicly funded floor for universal communication.Source: §9.5 · p. 197

9.5.1 What 2024 Produced

  • In 2024, political information included fabricated recordings, consent-based resurrection and translation, and genuine recordings altered through cheap-fake editing.The section notes that 2024 advisories were nonbinding, while rules notified in February 2026 require prominent labels and permanent provenance markers for synthetically generated information.Source: §9.5.1 · pp. 197–198

9.5.2 The Model: Credibility as a Posterior

  • At 90% provenance coverage and 30% synthetic prevalence, an unsigned recording has 69% credibility even with a strong detector.As prevalence rises, credibility falls; provenance makes the absence of a manifest evidence against genuineness, while detector performance may decline as generators improve.Source: §9.5.2 · p. 198, Figure 9.4 · p. 199, §9.5 · p. 199

9.5.3 Countermeasures, in the Engineer’s Register

  • Detection and provenance are complementary, but provenance coverage is the durable lever because detection can decay while capture-time signatures can compound.Provenance binds a signed manifest to an asset at creation, but platforms must preserve manifests through re-encoding; labelling and takedown can meanwhile put a price on synthesis.Source: §9.5 · p. 199, §9.5.3 · p. 200

9.6. OPEN DATA, RTI AND THE TRILEMMA

  • Electoral data cannot be fully transparent, private and resistant to exploitation at once, so tiered access by use best preserves verification.The proposed tiers provide public aggregates and booth results, restricted roll access for electors and accredited actors under use agreements, and disclosure-controlled researcher microdata; the section also argues that electoral accountability information needs an RTI carve-out from the DPDP Act amendment.Source: §9.6 · pp. 201–202

9.7. PLATFORM REGULATION AS POLITICAL ECONOMY

  • Platform rules allocate governance costs differently: the DSA places process duties on platforms, while India’s safe-harbour framework assigns unlawfulness decisions to the state and execution to platforms.The section proposes assigning labelling and provenance preservation to platforms, synthesis disclosure to producers, and unlawfulness decisions to an independent body; Section 230 instead leaves governance to platform incentives.Source: §9.7 · pp. 202–203

9.8. CAMPAIGNS AS DATA FIRMS

  • Campaign voter files are durable assets that compound across cycles, but expenditure rules count spending flows and do not see the data stock.Disclosure of campaign data holdings and retention limits that purge targeting data after a cycle would make that compounding advantage more visible and bounded.Source: §9.8 · pp. 204–205
  • Political parties meet the DPDP Act’s textual definition of data fiduciaries, but exemptions leave their status contested and the section argues parties should not decide the question themselves.The proposed approach treats parties as fiduciaries beyond use of the electoral roll for contact, with profiling requiring consent; the Australian exemption illustrates the risk of leaving campaign-data regulation to campaigners.Source: §9.8 · p. 205
  • Campaign data compounds in value across cycles, but expenditure law counts flows rather than accumulated stocks; disclosure, retention limits, and an independent rule-maker are proposed levers.The proposed rule-maker should be outside the regulated parties, such as a court or independent commission.Source: §9.8 · pp. 205–206

9.9 Three Cases, Three Lessons: Brazil, Kenya, Romania

  • Brazil highlights public verifiability, Kenya the need for rules before databases, and Romania the risk that an ungoverned platform loop can annul an election.In Brazil, a voter-visible paper trail was absent despite technical security testing; Kenya’s data-protection duties came after biometric systems were built; Romania’s campaign loop culminated in annulment and later platform proceedings.Source: §9.9 · p. 206

9.10 A Policy Brief to the Committee on Digital Election Governance

  • The brief proposes party voter-file registers and consent for profiling inferred political opinion, alongside signed provenance manifests and legislation treating undisclosed synthetic political content as a corrupt practice.It distinguishes Model Code measures within existing Commission authority from statutory changes, including restricting political-opinion processing to members and consenting contacts.Source: §9.10 · p. 207
  • The remaining terms propose political-ad transparency and targeting limits, valuation of data contributions in expenditure returns, platform risk duties, and tiered access to electoral data.The brief calls for a public ad repository and targeting disclosures, a ban on inferred special-category targeting, cross-border risk reporting to the Commission, open aggregate results, controlled access to rolls and microdata, and suppression of small-booth data.Source: §9.10 · pp. 207–208
  • Implementation is sequenced with Model Code measures first, legislative measures as a package second, and data-protection determinations in parallel.The brief says the Commission can adopt Model Code measures before the next general election; the Board’s unappointed leadership constrained the parallel determinations at the information date.Source: §9.10 · pp. 207–208

9.11.1 Chapter Summary

  • The chapter synthesis frames elections as public instances of a data loop whose existing controls target the action stage, while generated content can shift governance costs among platforms and states.The summary also reiterates that campaign data is durable and beyond expenditure law’s flow-based accounting, and that the rule-maker should not be the regulated.Source: §9.11.1 · pp. 208–209

9.11.2 Discussion Questions

  • The discussion questions ask readers to test the chapter’s models and legal proposals, including election audits, targeting, provenance, electoral-data access, and platform risk duties.They also ask whether forecasting disclosure could lawfully be imposed as a condition of the s. 126A window.Source: §9.11.2 · p. 209

9.11.3 Laboratory: A Better Brief

  • The laboratory asks readers to reproduce the chapter’s figures, use constituency data, model campaign competition and data purges, estimate provenance effects, and draft a better brief.Deliverables include the brief, reproduced figures using the reader’s parameters, and a note on what the models miss.Source: §9.11.3 · pp. 209–210

AI Regulation: The Global Legal Architecture, and What Each Regime

The section compares how regulatory regimes weigh competing governance priorities and how far their rules reach across an AI system’s loop, using MedScan AI to illustrate where a system that acts may remain compliant yet ungoverned. It also describes how sectoral rules, courts, and international instruments offer distinct but incomplete forms of governance around agentic action.

10.2 The EU AI Act: A Product Regulation That Reaches the Model

  • MedScan’s diagnostic classifier is high-risk under Art. 6(1), and the AI Act adds Art. 10’s data governance, Art. 14’s oversight design, and Art. 12’s logging to the file already required by the device regime.Source: §10.2 · p. 214

10.3 India’s Architecture: Principles, a Mission, a Data Statute and Advisories

  • India has no AI statute; its architecture combines principles, the IndiaAI Mission, the DPDP Act and Rules, and IT advisories, while leaving generated output, memory, agents, and actions without specific provisions.The DPDP Act lacks rights to contest automated classifications and special-category protections for health data; Rule 13 creates an underspecified algorithmic-software duty for Significant Data Fiduciaries. The chapter concludes that the PHC deployment is compliant with Indian instruments but governed by none at the action layer.Source: §10.3 · pp. 215–216

10.4 The United States: Orders, a Framework and the States

  • In the United States, sectoral rules and state statutes outlast the revoked executive order, while the voluntary NIST framework survives and federal regulation reaches MedScan’s device and feedback, but not its orchestrator or scheduling.The FDA device pathway is 510(k) if a predicate exists, otherwise De Novo; a Predetermined Change Control Plan can govern retraining and validation. Colorado’s replacement law retained disclosure, and California’s SB 53 requires large frontier developers to publish a safety framework and report critical incidents.Source: §10.4 · p. 218

10.5 ISO/IEC 42001 and the Standards: What a Certificate Proves

  • ISO/IEC 42001 certifies an organisation’s documented, audited AI-risk process, not that a particular system is safe, lawful, or fair; it does not replace AI Act classification or conformity assessment.The standard is not an AI Act harmonised standard and therefore does not itself confer the Act’s presumption of conformity. Its autonomy-risk assessment requires an organisation to document that a system acts, but its reach remains shallow across the loop.Source: §10.5 · p. 218, §10.6 · p. 219

10.6 China: Administrative Provisions That Reach the Output

  • China’s administrative provisions govern data and models, reach generated output through enforced labelling requirements, and reach actions through provider liability, but do not govern agents.The regime includes rules for recommendation algorithms, deep synthesis, generative AI services, and AI-generated-content labels; the revised 2025 safety framework names agents as a risk but has not produced an instrument for them.Source: §10.6 · p. 220

10.7 Four Models on the Trilemma

  • No regime sits at the trilemma’s centre: the Union weights legitimacy, the United States viability, China feasibility and control, and India viability over the other corners.The authors explain these positions through political economy: market size, frontier-provider concentration, security priorities, and India’s developing economy and services-sector market-access needs.Source: §10.7 · pp. 220–221

10.8 Regime Reach across the Governed Loop

  • Classical-layer reach averages 1.9 versus 1.0 for agentic layers; 4 of 6 regimes score zero at the agent layer, and action is reached only through indirect or general duties.The matrix scores instruments on an ordinal 0–3 scale; no instrument defines delegation, handoff, or authority to act. Output averages 1.7 overall, but marking duties govern labels rather than what outputs may cause.Source: §10.8 · p. 222, Figure 10.3 · p. 222

10.8. REGIME REACH ACROSS THE GOVERNED LOOP

  • Agentic gaps differ by regime, and the MedScan example shows that a system may satisfy existing instruments yet remain ungoverned where it acts.For the PHC deployment, the proposed controls are an authority stack, an order enforcement point, a lineage record of instruction sources, and a breaker on updates.Source: §10.8 · p. 223

Health, Finance, Legal Practice

  • Horizontal regimes reach models, while sectoral rules reach uses and sometimes further down the loop because they governed the decision before automation.Health-device rules reach models and change control, but reach actions only when the device itself acts; finance rules reach validation, explanations, and decisions, yet not cross-firm agent delegation. Legal-profession duties make the lawyer or judge answerable for filed or decided work, but no bar council has addressed delegating a filing to an agent.Source: Health, Finance, Legal Practice · p. 224, §10.9.1 · p. 224, §10.9 · p. 225

10.10 Jurisprudence: What the Courts Have Supplied

  • Courts have supplied rules on proportionality, generated speech, cross-border transfers, erasure, and procedural safeguards, while training-data rulings remain divergent.The cited examples include the Latombe challenge to the EU–US Data Privacy Framework, model erasure’s unresolved technical limits, and 2025 rulings finding fair use for lawfully acquired books but infringement for memorised lyrics.Source: §10.10 · p. 226, §10.11 · p. 227

10.11 International Instruments: Force, Membership and What They Add

  • The Council of Europe AI Convention is a treaty, while the other described international instruments are soft law and create no enforceable duties.Soft law supplies vocabulary, evidence of due care, and a venue for states that do not legislate; its agentic coverage is as empty as domestic regimes’ coverage.Source: §10.11 · pp. 227–228

10.12.1 Chapter Summary

  • The chapter’s takeaway is that regimes chiefly govern data and models, while deployers must govern layers that regulation leaves untouched.The EU AI Act’s high-risk dates were deferred to December 2027 for Annex III and August 2028 for Annex I; India has no AI statute, and the United States retains sectoral statutes, the NIST framework, and state rules amid federal-state contestation.Source: §10.12.1 · p. 228, §10.12 · p. 229

Building the Data Governance Framework for 2030: The Governance Control Plane

This section develops the governance control plane as a system of functions, governed objects, institutional responsibilities and layers, applying it to organisational implementation and Indian law and institutions while specifying adaptations for future AI systems. It also compares cross-jurisdictional regulatory requirements, including lawful processing, individual rights, organizational duties, transfers, breach notices and penalties.

11.2 The Governance Control Plane: Objects, Functions, Institutions, Time

  • The governance control plane governs the AI loop through seven functions, applied to eight governed objects by four institutional layers across design, run and review time.The functions are authority, enforcement, lineage, evaluation, observability, budget and breaker, and adaptation; the objects are the loop’s layers where information states are produced and controls can attach.Source: Building the Data Governance Framework… · p. 231, §11.2 · p. 233, §11.2.2 · p. 234

11.1 From Ten Chapters to One Plane: Answering the Capstone

  • The SmartCity capstone shows how a governance trace can answer eight questions about a mistaken enforcement action using components built across the book.The trace links the instruction source, data provenance, model evaluation, memory policy, agent authority, tool enforcement, approval threshold and downstream effects; those components must exist before the action occurs.Source: §11.1 · p. 232

11.2.2 Governance Functions

  • The plane’s functions turn earlier chapter components into mechanisms that authorise, gate, record, evaluate, observe, limit and adapt system actions.Evaluation results must be able to block a release; budgets and breakers constrain operation, while adaptation changes policy objects and records each change as a governance event.Source: §11.2.2 · p. 234

11.3 The Three Lenses Applied to the Plane

  • Technology determines what can be enforced and recorded, law what authority and records are required, and economics where review belongs and what controls may cost.The chapter argues a decision missing a lens is ungoverned, unlawful or abandoned, respectively; the dashboard makes the cost and operational trade-offs visible.Source: §11.4 · p. 237

11.4 The Organisational Layer: Architecture, Council, Officer, RACI

  • The Integrated Data Governance Architecture is retained as the plane’s organisational implementation, with its policies, controls and measurement mapped to the plane’s policy objects, mechanisms and observability.The council approves autonomy levels, review thresholds and breaker conditions; the officer owns policy objects, while engineering and operations run mechanisms and write records. The revised RACI assigns the seven functions across four institutional layers.Source: §11.4 · pp. 237–238

11.5 Building and Measuring the Plane

  • The plane is built in sequence from lineage to authority, enforcement, evaluation and observability, then budget, breaker and adaptation, rather than by writing policies first.Lineage comes first because without a record the organisation cannot show that other mechanisms exist. Plane metrics measure whether mechanisms work, unlike programme metrics; harm avoided is not directly shown on the dashboard.Source: §11.5 · pp. 239–240
  • 57 to 99 per cent of actions passed through an enforcement point, while complete-record coverage rose from 41 to 97 per cent over two years.In the illustrative dashboard, reconstruction time fell from 40 to 0.5 hours and cost per governed action from INR 0.42 to INR 0.17. The fleet performs 120,000 actions per quarter; the dashboard uses synthetic data.Source: §11.5 · p. 239, Figure 11.3 · p. 240

11.6 The Plane in India: Statutes, Sectors and the State as Deployer

  • India’s statutes map chiefly to authority and lineage, sector rules to decisions and actions, and state deployments require plane records to evidence Puttaswamy compliance.The DPDP Act’s duties attach mainly to authority and lineage at the data layer; sectoral requirements attach to decision-and-action controls. For government deployments, the plane’s records support legality, legitimate aim, and proportionality, including where a notified s. 17(2)(a) exemption removes the Act’s consent architecture.Source: §11.6 · p. 241

11.7 Teaching the Book

  • The teaching principle is that each discipline enters the shared plane at the layer it governs, while all three use the same capstone.Technologists focus on mechanisms, lawyers on authority and records, and economists on budgets and review placement; course mappings and assessment designs remain in a revisable instructor guide.Source: §11.7 · p. 242

11.8 Towards 2030: What the Plane Must Add

  • By 2030, the plane must govern sovereign compute as a resource, including who may access it, at what price, and how its benefits are distributed.The proposed addition is a layer 3 policy object for compute and an authority stack for access; the India AI Impact Summit’s New Delhi Declaration centered distribution of AI benefits to developing economies.Source: §11.8 · p. 242
  • The plane must add cryptographic inventories and migration records, a readable authority category for neural-data inferences, cross-organisational climate-data lineage and evaluation, and evidence-based autonomy thresholds.The cryptographic inventory covers source-data and tool layers, with council-owned migration schedules and lineage records; neural-data policy would require a statutory basis for inference rights and a record readable by affected people. Climate lineage would track supplier data and evaluate estimation models, while autonomy adaptation would set task-class levels on evidence and give a person authority to halt a fleet.Source: §11.8 · p. 242, §11.9 · p. 243

11.9 Capstone: SmartCity Surveillance, Governed

  • The SmartCity capstone asks teams to design governance for a citywide surveillance system whose enforcement agent issues penalties, suspends transit passes, and flags people without human review.The design must specify eight artefact groups, including the system’s eight-layer loop, authority stack and proportionality assessment, enforcement thresholds, lineage and observability, evaluation gates, budgets and breaker, institutions and resident access, and the three disciplinary lenses.Source: §11.9 · p. 243

11.9.1 Chapter Summary and Questions

  • The chapter summary defines the plane as seven functions over eight governed objects, operated by four institutional layers, with plane measures tracked alongside programme outcomes.It recommends building lineage first, implementing policies as code, and measuring coverage, reconstruction time, and refusals alongside incidents, requests, and cost.Source: §11.9.1 · p. 244

11.10 Three Reflections, and a Close

  • The three reflections frame governance as engineering components, legally traceable authority and evidence, and an economic allocation whose costs and avoided harms should be measured.The closing account presents the plane as a frame owned by a council, built by engineers, read by regulators, and reachable by residents, with the central questions of who authorised an action, on what record, and at what cost.Source: §11.10 · pp. 244–245

Appendices

  • Eight appendices provide a glossary, regulatory comparison, OWASP reference, governance templates, equations, examination materials, and an Indian case-law digest.The regulatory comparison and OWASP reference are canonical; chapter bodies cross-refer to them rather than repeating them.Source: Appendices · p. 247

B Master Regulatory Comparison

  • India permits processing on consent or listed legitimate uses, but provides no legitimate-interest basis.The comparison also lists individual rights to information, correction or erasure, grievance, and nomination, but no automated-decision right.Source: B Master Regulatory Comparison · p. 249
  • Significant Data Fiduciaries must appoint an India-based DPO, conduct audits and DPIAs, and meet specified duties.The comparison also states that cross-border transfers are permitted unless a country is restricted by notification.Source: B Master Regulatory Comparison · p. 249
  • India’s breach-notification entry requires notice to the Board and affected principals, with Rules specifying a 72-hour detail.Source: B Master Regulatory Comparison · p. 249
  • The comparison lists penalties of up to INR 250 crore per breach alongside a 4% or EUR 20 million figure.The passage does not identify the jurisdiction associated with the 4% or EUR 20 million figure.Source: B Master Regulatory Comparison · p. 249

C OWASP Top 10 for LLM Applications: Quick Reference

The quick reference maps OWASP LLM application vulnerabilities to their risks and book controls. It links each risk to controls distributed across the book’s chapters.

C OWASP Top 10 for LLM Applications: Quick Reference

  • Prompt injection occurs when instructions in input or retrieved content override the system; controls include instruction provenance, dual-LLM quarantine, and review before action.The listed controls are in Chapters 7 and 8.Source: C OWASP Top 10 for LLM Applications:… · p. 250
  • Supply-chain risks involve compromised models, weights, or dependencies; model provenance and signing, plus vendor assessment, are the listed controls.The controls are assigned to Chapters 2 and 5.Source: C OWASP Top 10 for LLM Applications:… · p. 250
  • Sensitive information disclosure covers training-data or context leaks in output; listed controls include memorisation testing, output filtering, and memory policy.The controls are assigned to Chapter 7.Source: C OWASP Top 10 for LLM Applications:… · p. 250
  • Other listed risks include improper output handling, excessive agency, prompt leakage, vector weaknesses, misinformation, and unbounded consumption, with controls such as sandboxing, action authority checks, grounding, and budgets.The reference also pairs vector risks with document-level access controls and inversion tests, and misinformation with failure attribution and C2PA.Source: C OWASP Top 10 for LLM Applications:… · p. 250
  • Data and model poisoning means corrupted training or retrieval data; the listed controls are training-data provenance and corpus controls.The controls are assigned to Chapters 2 and 7.Source: C OWASP Top 10 for LLM Applications:… · p. 250

D Data Governance Charter: Template

The charter template establishes governance authority over an AI system’s data, models, memories, agents, and actions, with policy objects for oversight and enforcement. The accompanying risk assessment template requires system-specific evidence before deployment and whenever authority changes.

D Data Governance Charter: Template

  • The charter gives the governance function authority to approve, condition, refuse, or halt deployments, and assigns oversight to a council and governance officer.Council decisions record rationale, alternatives, and risk assessment; the officer owns specified policy objects and determinations.Source: D Data Governance Charter: Template · p. 250
  • The council sets task-class autonomy, human-review thresholds, irreversible-action review, and fleet breaker conditions; agents’ authority stacks must attenuate at every handoff.No agent may hold a right its delegator lacks.Source: D Data Governance Charter: Template · p. 250
  • Every retrieval, tool call, and action must pass an enforcement point that records an allow, review, or deny decision, while actions carry decision-action records and governance traces.The template calls for eight reconstruction questions to be answerable within a specified period and records to be retained and accessible to named parties.Source: D Data Governance Charter: Template · p. 250
  • The charter requires evaluation gates, population-relevant slices, red-teaming for attenuation bypass, memory policies, and recorded bases for feedback used in retraining.It also requires recording legal bases, cross-border transfer routes, regime-reach verdicts, and layers not reached by regulation.Source: E. AGENTIC AI RISK ASSESSMENT:… · p. 251
  • The charter calls for quarterly measures and KPIs, escalates zero refusal rates or overdue reconstruction, and requires annual and regime-change review of policy objects.Each revision is recorded as a governance event.Source: E. AGENTIC AI RISK ASSESSMENT:… · p. 251

E Agentic AI Risk Assessment: Template

  • The risk assessment is completed for every acting system before deployment and whenever authority changes, with each answer supported by evidence rather than assertion.It is keyed to Chapter 8’s six invariants and the control plane’s functions.Source: E Agentic AI Risk Assessment: Template · pp. 251–252
  • The assessment documents system purpose and approved task-class autonomy, authority stacks and attenuation, separation of output, decision, and action, PEP coverage, and handoff lineage.Evidence includes architecture records naming adopting components and enforcement points, attenuation checks, decision logs, and handoff records.Source: E Agentic AI Risk Assessment: Template · p. 252
  • It also records instruction provenance and quarantine, budgets and breakers, evaluation slices and red-team results, chain exposure and expected harm, review placement, legal reach, liability, and protocol safeguards.Required evidence includes lineage entries, budget tables, evaluation reports, risk registers, placement memos, basis registers, responsibility matrices, manifests, and sign-offs.Source: E Agentic AI Risk Assessment: Template · p. 252

F Economics of Data Governance: Models and Equations

The section presents conceptual equations for the data-AI-action loop, authority, expected harm, data quality, and data value. It identifies these as authors’ conceptual models unless a source is named, rather than estimated relationships.

F Economics of Data Governance: Models and Equations

  • The loop equation represents data processed by AI into action and then new data, while the authority equation composes data-access, inference, tool, and action rights.The loop is assigned to Chapter 1; authority to Chapters 1 and 8.Source: F Economics of Data Governance: Models… · p. 252
  • Expected harm is modeled as P(failure) × Exposure × Action authority × Propagation; the data-quality score is a weighted average of component scores on a 0–100 scale.The expected-harm model is assigned to Chapters 1, 4, and 5; the data-quality score to Chapter 2.Source: F Economics of Data Governance: Models… · p. 252
  • The DAVF equation models value as base value multiplied by quality, one minus governance risk, and one plus growth, with the model extended to models and memories.The equation is assigned to Chapter 4.Source: F Economics of Data Governance: Models… · p. 252

G. SAMPLE EXAMINATION QUESTIONS AND RUBRICS 241

The appendix provides sample examination questions for technology, law, and economics audiences, alongside a common rubric. It also lists equations and models from the book as material for use across chapters.

G. SAMPLE EXAMINATION QUESTIONS AND RUBRICS 241

  • The appendix lists conceptual models including delegation cost and review placement, the Gordon–Loeb security-spend bound, social welfare, fairness, layered defence, and agentic chain arithmetic.It also includes models of election targeting, the liar’s dividend, regime reach, and VVPAT sampling.Source: G. SAMPLE EXAMINATION QUESTIONS AND… · p. 253
  • The appendix provides three questions per audience, drawn from chapter discussion questions and laboratories, while full sets are in a companion instructor guide.The audiences are technology, law, and economics or public policy programmes.Source: G Sample Examination Questions and… · p. 253
  • Technology questions ask students to implement an attenuating handoff, measure residual attack rates, and produce a governance trace for a retrieval-augmented assistant.The tasks require identifying where injected instructions are trimmed, where independence assumptions fail, and whether a trace answers eight questions.Source: G Sample Examination Questions and… · p. 253
  • Law questions cover proportionality, classification under the AI Act and DPDP Act, regime reach, and drafting an Indian provision for state algorithmic decisions.The questions ask students to identify records relevant to proportionality and layers that remain ungoverned.Source: G Sample Examination Questions and… · p. 253
  • Economics questions ask students to derive human-review placement, rescore regime reach after an amendment, and model rival-campaign effects on targeting.They also require identifying what the review-placement model misses and stating the externality and policy lever.Source: G Sample Examination Questions and… · p. 253
  • The common rubric weights vocabulary at 20%, mechanism and evidence at 30%, application of three lenses at 20%, and a worked number or record at 20%.The distinction criteria also require a defensible conclusion that states what remains unsettled and who decides it.Source: G Sample Examination Questions and… · p. 254

H Indian Case-Law Digest on Data and AI

The digest identifies cases relied on by the book or likely to arise in practice, pairing each with a governance-relevant holding and the chapter that uses it.

H Indian Case-Law Digest on Data and AI

H. INDIAN CASE-LAW DIGEST ON DATA AND AI 243

The digest maps Indian decisions to governance questions involving privacy, surveillance, information rights, elections, online platforms, and AI training. Its entries also include pending disputes and limits on state action.

H. INDIAN CASE-LAW DIGEST ON DATA AND AI 243

  • Voters’ information rights support candidate disclosures and electoral-bond disclosures, while VVPAT rulings require paper trails and specify verification limits.The digest records five-machine verification per assembly segment, refusal of 100 per cent verification, and a 5 per cent memory check on request.Source: H. INDIAN CASE-LAW DIGEST ON DATA AND… · p. 255
  • The digest links intermediary and copyright disputes to actual knowledge, and records that the ANI Media v. OpenAI training-content case remains pending with divided amici.Source: H. INDIAN CASE-LAW DIGEST ON DATA AND… · p. 255
  • Privacy is treated as a fundamental right subject to legality, legitimate aim, and proportionality, while surveillance and interception require statutory or procedural safeguards.The digest also notes quashing of interception orders for lack of a public emergency and a requirement to publish, reason, and proportion internet shutdown orders.Source: H. INDIAN CASE-LAW DIGEST ON DATA AND… · p. 255
  • The digest records dignity, autonomy, privacy over publication of personal matters, and protection against involuntary tests implicating mental privacy.Source: H. INDIAN CASE-LAW DIGEST ON DATA AND… · p. 255
  • The Aadhaar ruling upheld the scheme but struck private use under section 57 and barred denial for authentication failure, subject to safeguards.Source: H. INDIAN CASE-LAW DIGEST ON DATA AND… · p. 255
  • Other entries recognize internet access as connected to education and privacy, provide interim relief against indexing a judgment, and require reasons from quasi-judicial authorities.Source: H. INDIAN CASE-LAW DIGEST ON DATA AND… · p. 255
  • The digest notes that the Pegasus case appointed a technical committee and rejected withholding information on a bare national-security plea.Source: H. INDIAN CASE-LAW DIGEST ON DATA AND… · p. 255
  • The digest records pending or recent disputes, including the DPDP–RTI challenge and Bihar voter-roll revision orders accepting Aadhaar as identity without staying revision.It also notes the virtual-currency circular was struck for disproportionality.Source: H. INDIAN CASE-LAW DIGEST ON DATA AND… · p. 255

Related papers

Loading 2610.33605v1…