ProDefence research · AI governance · Calculator v1.2.0 · Framework v1.5
The HumanAI and OrgAI calculator: how it works, layer by layer
What the tool does, in what order and where it stops: six layers, from the single-file architecture to the exported record. Select a layer or a module for its formulas and dependencies; further down, four computations you can run yourself.
How it computes
Four mechanisms reproduced with the same rules as in the tool. The starting values are the illustrative example the calculator opens with, not data from any organisation.
The gap between access and validation
The OrgAI threshold: declared vs documented
| Criterion | State | Evidence reference | Effective |
|---|
The strict chain M0 → M5
When the record can leave
The problematic-configuration detector
Ten predicates that read the configuration as a whole, not the results one by one: eight patterns from the conceptual framework and two internal consistency checks. A flag changes no result and is not summed into a risk indicator.
The full specification, layer by layer
The same content as the diagram, as text: every layer from the bottom up, with each module’s formula, role and connections.
P0Architecture
One HTML file · state · pure computation · 4 components
The foundation: the whole tool is a single file that runs locally. State, computation and display are kept apart, so every result can be reproduced from the same state.
SState S
S = { metadata, classification, counts, evidence, thresholds, … }A single object held in memory. It is the only source of truth: every result, on screen, in the report or in the JSON, derives from it.
- No localStorage, no cookies, no database.
- A JSON import rebuilds exactly this object.
Receives: —
Feeds: —
compute()compute()
R = compute(S) // pure function, no I/O
All computation goes through one pure function: the same state always gives the same results. The logic is delimited by two markers in the code.
- 29 automated tests extract the formulas from the shipped file, between the two markers, so they cannot drift from it.
- A passing test is a statement about the file you have, not about a lab version.
Receives: —
Feeds: 01 Epistemic decoupling
update()update()
update() → rebuilds the outputs only
Display computes nothing. On every change the results are recomputed in full and only the output area is rebuilt.
Receives: —
Feeds: —
HTMLA single HTML file
index.html · 507 KB · 0 dependencies
No framework, no build step, no runtime dependencies. Fonts are embedded, so it also works on an isolated network.
- Zero network requests; a restrictive CSP with connect-src ‘none’ in the locally hosted variant.
- Light, dark and system themes.
Receives: —
Feeds: —
P1Inputs
Metadata · classification · counts · evidence · 7 components
What the assessor declares. Nothing on this layer is verified by the tool; everything remains a claim until it is tied to an evidence reference.
METAReporting metadata
metaComplete ⇔ 9/9 required fields
The framework’s minimum reporting convention, turned into an operating condition: unit, task, error consequence, AI configuration, period, validation method, accountability boundary and assessor, plus the record identifier.
- While anything is missing, results are marked provisional and export is blocked.
- The modules keep computing, so work can continue, but no record can claim more than is known.
Receives: —
Feeds: Gate 2 · Export
CLASClassification test
10 questions × (state, reference) + 5 exclusion cases
The membership test: it establishes whether the situation is a HumanAI case and whether it meets the conditions for OrgAI. Each question has three states: demonstrated, unmet, unknown.
- “Unknown” never counts as demonstrated.
- Excluded cases include an ignored suggestion, automation with no AI component, and several licences used independently.
Receives: —
Feeds: Gate 1 · Classification
n kA kVObserved counts
n, kA, kV ∈ ℕ · 0 ≤ kV, kA ≤ n
Whole numbers, not percentages: how many tasks are in the declared set, for how many the AI gave a usable answer, for how many the accountable person produced a verified justification.
- “About 90%” cannot be checked; “126 of 140” can.
- Only counts allow a confidence interval to be computed.
Receives: —
Feeds: 01 Epistemic decoupling
EVIDENCEEvidence
evidence = (reference, type)
For every claim: a reference and its type, for example measurement, permission test, audit. The type matters: a “yes” for security (S) that does not rest on a permission test raises a flag.
Receives: —
Feeds: documented
θₓDeclared thresholds
θₓ per dimension · thresholds for the risk gates
Declared by the user, not by the tool, before the results. If a threshold changes after results have been entered, the change goes into the record.
- A risk gate with no declared threshold stays unmet.
- The tool does not calibrate thresholds.
Receives: —
Feeds: 04 Material contribution profile, 05 Synergy test
JSONJSON import
schema v2 · v1 migrated
Reloads an existing record. Records from versions 1.0.0 and 1.1.0 are migrated, with an explicit note on what could not be recovered.
- It is the end of the re-assessment loop: the same unit, another period, counts redone.
Receives: —
Feeds: —
MODEWorking mode
explore ∈ {true, false}Explore: values move freely, evidence is not required, results are marked illustrative and export is disabled. Assess: the tool becomes demanding.
- The explicit split prevents results that look like an assessment without being one.
Receives: —
Feeds: requireEvidence, Gate 2 · Export
P2Evidence rule and Gate 1
A “yes” without a reference becomes “unknown” · 4 components
The layer that turns claims into effective states and stops the record if the situation is not a HumanAI case.
REQrequireEvidence
requireEvidence = !explore
In assessment mode, every claim must have an evidence reference.
Receives: MODE Working mode
Feeds: documented, documented
DOCdocumented
documented = !requireEvidence
|| ref ≠ ''A claim is documented if evidence is not required (explore) or if it has a reference filled in.
Receives: Evidence, requireEvidence, requireEvidence
Feeds: Effective state, Effective state
EFFEffective state
effective = (state='yes' ∧ documented) ? 'yes' : (state='no') ? 'no' : 'unknown'
All thresholds and chains are computed on the effective state, not the declared one. A “yes” without a reference becomes “unknown”, and “unknown” never counts as demonstrated.
- This is where the “declared · documented” pair in module 03 comes from.
Receives: documented, documented
Feeds: 03 OrgAI threshold, F5 Undocumented compliance
GATE 1Gate 1 · Classification
material contribution unmet ⇒ STOP
If the AI makes no material contribution, the situation is not a HumanAI case for that episode and the measurement modules no longer apply. The record stops here.
- The first question is not “how much” but “what are we assessing”.
Receives: Classification test
Feeds: 01 Epistemic decoupling, 04 Material contribution profile
P3Computation engine
Modules 01–07 · a sequence, not a menu · 7 components
Seven modules in order: 02 consumes the result of 01, 06 depends on 03, 07 checks coherence against 01 and 02. No module aggregates the results into a score.
01Epistemic decoupling
Δepi = A − V A = kA/n V = kV/n CI: Wilson on A and V; the difference by the Newcombe method
The gap between the range of answers AI makes accessible and the accountable actor’s demonstrated capacity to validate them. When access grows faster than validation, the organisation produces claims it cannot support, and then reuses them.
- If the interval includes zero, the verdict is “not demonstrated at this task volume”, not “no gap”.
- 0.22 on 140 tasks → [0.13; 0.31], demonstrated. 0.25 on 12 tasks → [−0.08; 0.53], not demonstrated.
- A positive gap opens the list of seven mitigation measures; whatever is ticked feeds module 02.
Receives: n kA kV Observed counts, Gate 1 · Classification, compute()
Feeds: F9 Below threshold, 02 Propagation exposure, 07 OrgAI profile
02Propagation exposure
Ωprop = max(0, Δepi) · ρ · κ
An unvalidated error is amplified through reuse. The module computes two states on the same scale, now and after the declared controls, and shows the percentage reduction.
- A conceptual ordering indicator, not a probability; without local calibration it predicts nothing.
- It flags separately the case where the target reduces exposure by cutting access instead of raising validation: both lower the figure, but they are entirely different decisions.
Receives: 01 Epistemic decoupling
Feeds: 07 OrgAI profile
03OrgAI threshold
Iorg = 1[Korg ∧ P ∧ R ∧ G ∧ S ∧ T]
Six constitutive conditions, all on the effective state: authorised knowledge, processes, roles and authority, governance, security, traceability. All six, or the threshold is not demonstrated.
- Each criterion has three fields: state, evidence reference and its type.
- The counter becomes a pair: “5/6 declared · 4/6 documented”; the second one counts.
- L, validated learning, is the seventh component and does not enter the threshold: it conditions M5 only.
Receives: Effective state
Feeds: F2 Memory without governance, F8 Unclarified authority, 06 Maturity per domain
04Material contribution profile
Y := ⟨Q, τ, E, C, A, L, Ω⟩ material ⇔ ∃x relevant: |dₓ| ≥ θₓ
The AI contribution assessed on seven dimensions at once: quality, time, error, calibration, autonomy, learning, risk exposure. The result is a profile, never a score.
- The threshold is declared before the results, otherwise classification becomes opportunistic.
- A dimension that cannot be measured credibly does not get a zero; it stays out of the decision.
- The verdict reads, for example: “material on 3 of 5 relevant dimensions”, with the direction of each.
Receives: Gate 1 · Classification, θₓ Declared thresholds
Feeds: F6 Single dimension, 05 Synergy test
05Synergy test
margin = Q* − max(comparators) synergy ⇔ margin > 0 ∧ every risk gate satisfied
Synergy is not assumed and it is not a maturity level: it is demonstrated on the same task, against every relevant comparator, with every declared risk threshold respected.
- Four risk gates, each with a declared threshold and an observed value; a gate with no threshold blocks synergy just like a failed one.
- The result names the comparator that binds the conclusion, for example “margin +0.06 over Human + AI (0.76)”.
Receives: θₓ Declared thresholds, 04 Material contribution profile
Feeds: F4 Weak comparators
06Maturity per domain
M0 → M1 → M2 → M3 → M4 → M5 (per domain)
The level is assigned to a bounded domain and a process, not to an organisation. A strict chain: a level is reached only if every earlier level is demonstrated.
- M0 Exploratory · M1 Episodic · M2 Managed · M3 Connected · M4 Governed · M5 Cumulative.
- L conditions M5 only. Limits: M3 – connectivity does not demonstrate governance; M4 – learning may remain manual; M5 – adaptation does not demonstrate synergy.
- A domain where AI is prohibited appears with no level, not as M0.
Receives: 03 OrgAI threshold
Feeds: —
07OrgAI profile
9 evaluation dimensions · no aggregation
The threshold says the architecture exists; this module says what it produces: nine organisational evaluation dimensions, each with its value and its evidence.
- Coherence checks: the validation dimension against V from 01, propagation against Ωprop from 02.
- A large difference between them is a finding in itself: it points to a merely formal check.
Receives: 01 Epistemic decoupling, 02 Propagation exposure
Feeds: SCREEN Working screen
P4Detector and Gate 2
10 predicates · the export condition · 11 components
The detector reads the configuration as a whole and looks for contradictions between what was declared in one place and what was measured in another. Gate 2 decides whether the record can be exported.
F1Licences without architecture
“connected” = yes ∧ ≥2 criteria unknown
A detector predicate. When it fires, the flag shows the concrete values that triggered it and the correction the framework prescribes; it can be annotated, and the annotation goes into the record.
Receives: —
Feeds: —
F2Memory without governance
validated learning = yes ∧ G ≠ yes
A detector predicate. When it fires, the flag shows the concrete values that triggered it and the correction the framework prescribes; it can be annotated, and the annotation goes into the record.
Receives: 03 OrgAI threshold
Feeds: —
F3Nominal governance
G = yes ∧ validation < 50%
A detector predicate. When it fires, the flag shows the concrete values that triggered it and the correction the framework prescribes; it can be annotated, and the annotation goes into the record.
Receives: —
Feeds: —
F4Weak comparators
existing process = weakest benchmark
A detector predicate. When it fires, the flag shows the concrete values that triggered it and the correction the framework prescribes; it can be annotated, and the annotation goes into the record.
Receives: 05 Synergy test
Feeds: —
F5Undocumented compliance
“yes” claims with no evidence reference
A detector predicate. When it fires, the flag shows the concrete values that triggered it and the correction the framework prescribes; it can be annotated, and the annotation goes into the record.
Receives: Effective state
Feeds: SCREEN Working screen
F6Single dimension
only one relevant domain declared
A detector predicate. When it fires, the flag shows the concrete values that triggered it and the correction the framework prescribes; it can be annotated, and the annotation goes into the record.
Receives: 04 Material contribution profile
Feeds: —
F7Irreversible without a test
S = yes ∧ evidence ≠ permission test
A detector predicate. When it fires, the flag shows the concrete values that triggered it and the correction the framework prescribes; it can be annotated, and the annotation goes into the record.
Receives: —
Feeds: —
F8Unclarified authority
role unknown ∧ Org threshold met
A detector predicate. When it fires, the flag shows the concrete values that triggered it and the correction the framework prescribes; it can be annotated, and the annotation goes into the record.
Receives: 03 OrgAI threshold
Feeds: —
F9Below threshold
Δepi ≤ 0.05 ∧ at least 3 signals
A detector predicate. When it fires, the flag shows the concrete values that triggered it and the correction the framework prescribes; it can be annotated, and the annotation goes into the record. Δepi comes from module 01.
Receives: 01 Epistemic decoupling
Feeds: —
F10Threshold without result
Org demonstrated ∧ no relevant dimension
A detector predicate. When it fires, the flag shows the concrete values that triggered it and the correction the framework prescribes; it can be annotated, and the annotation goes into the record.
Receives: —
Feeds: —
GATE 2Gate 2 · Export
canExport = !explore ∧ metaComplete ∧ !notClassified
The record can be exported only in assessment mode, with complete metadata and with the situation classified. Possible states: complete, incomplete, not classified.
Receives: META Reporting metadata, MODE Working mode
Feeds: JSON record
P5Outputs
Screen · printed report · JSON · 4 components
One state, three forms. Nothing on screen can be missing from the printed report, and the JSON record can be reloaded for re-assessment.
SCREENWorking screen
verdicts · intervals · profiles · flags
Verdicts, confidence intervals, per-dimension profiles and diagnostic flags, recomputed in full on every change. The results strip keeps four figures in view: epistemic gap, propagation exposure, organisational threshold and maturity.
Receives: 07 OrgAI profile, F5 Undocumented compliance
Feeds: —
PRINTPrinted report
same state S → ~17 A4 pages
The document an auditor or client receives: a header with the nine fields, the identifier, status and date, then every module with its values rendered as text. Nothing on screen can be missing from it.
Receives: —
Feeds: —
JSONJSON record
schema v2 · reloadable · stable id
It holds the tool and framework versions with their DOIs, all inputs, the computed values, evidence references, flags with annotations, the identifier, the generation time and the limits statement. It is copied to the clipboard, not downloaded.
- Two records sharing an identifier form a comparable series.
Receives: Gate 2 · Export
Feeds: —
✕What it does not do
does not verify · calibrate · estimate · aggregate · store · certify
The limits stay permanently visible in the interface, not only in the documentation. Results are interpretive and cannot be the sole basis of a consequential decision.
Receives: —
Feeds: —
What the tool does not do
- It does not verify the data entered; every value remains the assessor’s claim until it is tied to the evidence indicated.
- It does not calibrate thresholds; θₓ is declared by the user.
- It does not estimate probabilities; Ωprop is a conceptual ordering indicator.
- It aggregates nothing into a composite score.
- It stores nothing and transmits nothing.
- It does not certify or determine conformity; it cannot be the sole basis of a consequential decision.
Notation
In the profile Y, A means autonomy and L learning. Do not confuse them with access A in module 01, or with L (validated learning) in the OrgAI architecture, although the two Ls are related.
Frequently asked questions
What does the HumanAI and OrgAI calculator compute?
It turns the relations in the HumanAI and OrgAI conceptual framework into an assessment record for a concrete situation: epistemic decoupling (Δepi = A − V) with a confidence interval, propagation exposure (Ωprop), the organisational threshold Iorg, the material contribution profile Y, the synergy test, maturity per domain M0–M5 and the OrgAI profile on nine dimensions.
Why does it ask for counts rather than percentages?
Only whole-number counts (n, kA, kV) allow a confidence interval to be computed. The tool uses the Wilson interval on each proportion and the Newcombe method for the difference. If the interval includes zero, the verdict is “not demonstrated at this task volume”, not “no gap”.
What is the evidence rule?
In assessment mode, a “yes” claim without an evidence reference becomes “unknown”, and “unknown” never counts as demonstrated. That is why the OrgAI threshold appears as a pair: how many conditions are declared and how many are documented.
Does the tool produce an overall score?
No. Each module keeps its own result; the AI contribution is a profile across dimensions, and maturity is assigned per domain. The ten-predicate detector flags contradictory configurations, but the flags are not summed into a risk indicator.
Where does it run, and what data does it send?
The tool is a single HTML file that runs locally, with no dependencies and no network requests. It stores nothing and transmits nothing; the record is exported as JSON copied to the clipboard.
Can it be used as proof of compliance?
No. Results are interpretive: the tool does not verify the data entered, does not calibrate thresholds and does not certify. It supports a documented assessment; it is not a determination of conformity.
Apply the framework in your organisation
We can help you settle the unit of assessment, the thresholds and the evidence before you measure, so the results hold up in front of management or an auditor.
