Framework · Ethotechnics

Before an AI system may influence care

Name the decision it may inform, the person responsible for it, and the route for challenging and correcting it.

Worked example

A model recommends a treatment change. At every state, the authorization is a dated record that can be superseded — never a permission granted once.

Proposed stages of approval for the treatment-change recommendation
State	Evidence required	What may happen
State 0Not authorized	Defined clinical or operational decision Named deployment and escalation owners Specified affected population and exclusions Stated assumptions and a plan for evaluating them	Nothing. The proposed use cannot influence care or workflow.
State 1Observed	Silent or retrospective evaluation Error taxonomy and exception review Baseline comparison against current practice	Nothing to care or workflow. Outputs are captured for evaluation.
State 2Constrained use	Prospective workflow validation Documented override and escalation paths Monitored safety, equity, and operational indicators	Recommendations into one narrow workflow, within limited population scope and predefined stop conditions.
State 3Routine use	Stable prospective performance Independent evaluation sized to the risk of the use Operational readiness for correction and rollback	Routine use within the defined scope, watched for change and reviewed on a schedule.

A new safety signal reopens the authorization from whichever state it had reached, and triage decides whether it is suspended while the review runs. The clinical safety lead opens the review and makes the decision. The review follows the six steps below.

Inspection guide

Use this record before constrained use, and keep the review route available afterward.

1 · Three tests a deployment must pass

Explainable: The people relying on a deployment can inspect the basis for its current authorization: intended use, evidence, assumptions, known limits, and accountable owner.
Challengeable: A clinician, operator, patient advocate, or reviewer can contest a result or deployment condition through a defined route that does not depend on informal access or personal discretion.
Correctable: When evidence, policy, performance, or operating conditions change, the institution can review the deployment, make a new decision, and carry the correction to every workflow it affects.

2 · The authorization record

Eight lines a reviewer should be able to read off one record before a deployment enters State 2 (Constrained use), the first state in which it can influence care. If any line is unanswerable, it goes no further than State 1 (Observed), regardless of model performance. Observation needs less: the decision, the population, the owners, and a plan for testing the assumptions.

The decision or workflow being supported
Authorized users, population, setting, and exclusions
Current model, prompt, policy, data, and integration versions
Evidence and assumptions that justify using it
Known limitations and required human checks
Named deployment, clinical, and escalation owners
Effective date, review date, and superseded authorization
Stop conditions and rollback route

3 · When the facts change

Before authorizing, confirm each step of the review loop has a named owner and propagation route, not just an assumption that someone will notice.

The six steps as one loop: each step works from what the one before it produced, and once a correction has propagated, the loop goes back to watching for the next change.

Detect — Change signal: Notice a change that could matter — in the evidence, the model’s behavior, policy, the data, the workflow, the people it is used on, or the outcomes being observed.
Connect — Map of everything that depends on it: Trace which of the approval’s assumptions, which people, which workflows, and which later decisions the change could affect.
Triage — Review priority and interim controls: Judge how much it matters, how urgent it is, whether it can be undone, how many people it reaches, and whether the system can keep running while the review happens.
Review — Case for review: Put five things in front of whoever may decide: the change, traced to its source; the original reasoning; how the system has performed; any objections; and what is still unknown.
Decide — Recorded decision: Make the decision and write it down: keep, caveat, narrow, expand, monitor, escalate, suspend, or retire.
Propagate — Everything that relied on it, corrected: Update the approval record, and every workflow, instruction, screen, monitoring rule, and person that relied on the old decision.

4 · What the contract must carry

The blocks above inspect a deployment before it is trusted. These are the purchase terms that keep it inspectable after the vendor has been paid.

A screen that stops a task names the person who owns it and the clock it must move on — a status that only says “pending” is a defect, not an answer.
Every output that changes a record links to what it was based on, so correcting the source can find everything that relied on it.
The workaround a nurse or clerk builds to route around the product is logged as a product failure, counted the way an outage is.
Acceptance is demonstrated on the buyer’s own messy data, not on a demo prepared for the sale.

Full standards

Ethotechnics publishes proposed standards, each numbered and versioned. I mapped them to NIST AI RMF, ISO/IEC 42001, and the EU AI Act; those bodies have not endorsed the mapping, and no outside institution has adopted a standard yet.

The shared record format is STD-07, the Revisable Delegation Record. Its conformance checker checks the record’s structure, not whether its evidence is true or its approval wise.

Case studiesThe decisions and records behind the healthcare products.
Current workWhat is built, what can be inspected, and what remains untested.

Revised 8 October 2026