ProDefence research · AI governance · Conceptual and operational framework v1.5

The HumanAI and OrgAI framework, layer by layer

From theoretical foundations to governance and implementation: eight layers showing how a person–AI configuration becomes governed organisational capacity. Select a layer or a component for its definition, formula and connections; further down, four computations that apply the framework’s rules.

componentthreshold / conditionoutcome / profilelimit / exclusion– – dependency between levels
FIG. 1 — THE FRAMEWORK, FROM FOUNDATIONS TO GOVERNANCE · BOTTOM UP— — correction loop: access and rules withdrawn or corrected

The framework’s rules, applied

Four relationships from the whitepaper, reproduced so you can see how they behave. Starting values are illustrative, and the case-study values are explicitly hypothetical.

Membership test · Iorg · M0–M5

What is the configuration, really?

HumanAI ⇔ dₓ ≥ θₓ ∧ identifiable authority · Iorg = 1[Korg ∧ P ∧ R ∧ G ∧ S ∧ T]
120
Aorg components (effective state)
Epistemic decoupling · propagation

When access outruns validation

Δepi = A − V · Ωprop = max(0, Δepi) × ρ × κ
0.92
0.68
0.80
0.90

Ωprop is a conceptual ordering indicator, not a probability. In the case study, access was not reduced: validation rose through primary sources, adjudication and traceability.

The synergy condition

Synergy is demonstrated, not assumed

Q(H + OrgAI) > max{Q(H), Q(AI), Q(H + AI), Q(H + K), Q(Team)} ∧ risk thresholds
Declared risk thresholds, satisfied
The material contribution profile Yᵢ

A profile on seven dimensions, not a score

Yᵢ := ⟨Qᵢ, τᵢ, Eᵢ, Cᵢ, Aᵢ, Lᵢ, Ωᵢ⟩ · material ⇔ ∃x relevant: |dₓ| ≥ θₓ
dim.relevantmeasurabledₓθₓstate
Qᵢ quality
τᵢ time
Eᵢ error
Cᵢ calibration
Aᵢ autonomy
Lᵢ learning
Ωᵢ risk exposure

A dimension that cannot be measured credibly does not get a zero: it stays outside the decision.

The framework’s propositions

Eight propositions that can be tested separately. They are not presented as already demonstrated empirical findings.

P1empirical
The effect of AI depends on the configuration, not only on the model.The same model produces different profiles when task, expertise, interface or validation changes.
P2conceptual
HumanAI can produce both augmentation and degradation.Membership in the construct does not predict the direction of the effect.
P3conceptual
Aggregated use does not automatically produce OrgAI.More users without integration do not satisfy the membership test.
P4conceptual
Governance is constitutive of OrgAI.Removing authority, validation or traceability changes the category of the configuration.
P5empirical
Epistemic decoupling grows when access expands faster than validation.Δepi becomes positive on the same task set.
P6empirical
Reuse amplifies unvalidated error.The impact of an error increases with ρ and κ even when the initial error is local.
P7empirical
Organisational learning requires adjudicated feedback.Raw feedback written directly into memory increases contamination and self-confirmation.
P8empirical
Synergy must be demonstrated against the relevant comparator.Improvement over an unaided person may coexist with performance below the best person, AI or existing process.

The maturity model

Observable states of integration, assigned to a bounded domain and process. Synergistic OrgAI is an outcome label, not an M6 level.

LevelDescriptionMinimum evidenceBoundary
M0 Exploratoryoccasional use without stable practiceinventory of uses or experimentdoes not demonstrate stable HumanAI
M1 Episodic HumanAIAI materially changes bounded tasksartefacts and task comparatorthe effect is not institutionalised
M2 Managed HumanAIpractice is repeatable and governed locallyguidance, measurement, validation and ownermore users do not imply OrgAI
M3 Connected OrgAImodels access organisational sources and workflowssource catalogue, identities and integrationconnectivity does not demonstrate governance
M4 Governed OrgAIthe constitutive threshold is satisfiedroles, validation, audit, security and contestabilitylearning may remain manual
M5 Cumulative OrgAIadjudicated feedback updates controlled memorystaging, approvals, history, withdrawal and testingadaptation does not demonstrate synergy

Evaluation, metrics and evidence

What is measured at each level and what evidence supports the measurement.

The HumanAI evaluation profile

DimensionIndicatorEvidence
Qualityaccuracy, completeness, utility or expert scoretask set and evaluation rubric
Timemedian duration and execution variancecomparable timestamps
Errorerror rate and severityadjudicated error register
Detectionshare of AI errors identified by the usercontrolled tests with known errors
Calibrationgap between confidence and correctnessconfidence scores and validated outcomes
Autonomyability to continue or verify without AIunassisted tests and process interview
Learningretention and transfer after a delaydelayed test on new tasks
Vulnerabilityexposure to incorrect suggestions, manipulation or sensitive datanegative tests and incident records

The OrgAI evaluation profile

DimensionIndicatorEvidence
Knowledgecoverage, provenance and validitycatalogue, owners and history
Coordinationtransfer time, rework and role conflictworkflow logs and cases
Validationshare of outputs checked before useadjudication records
Traceabilityshare of reconstructible decisionsaudit evidence and sampling
Securityaccess, segregation and execution violationsnegative tests and security events
Resiliencetime to detect, correct and withdrawexercises, incidents and rollback
Diversityvariation in solutions and source independencesimilarity and provenance analysis
Learningrate of validated updates and withdrawalsorganisational memory register
Propagationscope and speed of error reusedependency and impact analysis

Governance: roles and threats

Roles and separation of duties

RolePrimary responsibilityIncompatible shortcut
Process ownerdefines purpose, scope and acceptance criteriadelegating purpose to the vendor or model
Knowledge ownerauthorises sources, validity and withdrawaltreating every accessible document as authoritative
User or operatorperforms the task and records interventionscopying output without review
Validatortests claims against criteria and evidencevalidating one’s own high-impact output without controls
Decision-makeraccepts consequences and authorises actionassigning responsibility to AI
Security and privacycontrols access, isolation, retention and incidentsrelying solely on vendor terms
Audit or oversighttests reconstruction, exceptions and effectivenesstreating policy existence as operating evidence

Threats and minimum controls

ThreatMechanismMinimum controls
Prompt injectionretrieved content manipulates model behaviourseparate instructions from data, sanitise, constrain tools, test adversarially
Unauthorised disclosureprompts, context or logs expose protected dataclassification, minimisation, access control, retention limits, redaction
Privilege confusionthe model acts with broader rights than the useridentity propagation, least privilege, target checks, deny by default
Hallucinated authorityplausible output is treated as an approved decisionsource verification, status labels, validator and decision-maker
Memory contaminationunverified feedback becomes institutional truthstaging, adjudication, provenance, rollback and withdrawal
Automation biashuman review becomes formal rather than effectiveerror-detection tests, time allocation, independent evidence, contestability
Common-mode failureone defect propagates across downstream usesdiverse sources, dependency mapping, monitoring and kill switch

The implementation pathway

Eight stages, each with an exit criterion. The starting principle: capacity and decision, not a product.

StageActivityExit criterion
1. Delimitationselect process, tasks and consequencesapproved scope, owner and exclusions
2. Baselinemeasure the process without the new configurationcomparator, thresholds and task set
3. Controlled HumanAIpilot with users, rules and validationdocumented material contribution and risk profile
4. Knowledgecatalogue and authorise sourcesowners, validity, access and withdrawal
5. OrgAI thresholdintegrate roles, workflow, audit and securityIorg test satisfied with evidence
6. Operational pilottest normal, boundary, adversarial and unavailable statesapproved acceptance criteria and residual risk
7. Controlled learningintroduce adjudicated feedback and withdrawalupdatable, auditable, reversible memory
8. Monitoringtrack profiles, changes and incidentsperiodic review and stop conditions

Design principles

  • Start from capacity and decision, not from a product.
  • Define the task and consequence of error before integration.
  • Keep authority and contestability real rather than declarative.
  • Separate generation, validation, approval, execution and learning.
  • Authorise sources and filter access before retrieval.
  • Keep the configuration reproducible and changes controlled.
  • Apply deny by default to actions and memory updates.
  • Measure autonomy, error detection and risk, not only speed.
  • Provide safe stopping, rollback and degraded operation.

Use scenarios and the case study

Explanatory applications, not empirical findings. The same pattern recurs in every domain: the HumanAI unit is easy to identify; the OrgAI threshold requires architecture.

ScenarioHumanᴬᴵ unitThreshold for OrgᴬᴵDominant risk
Analysis and researchanalyst, model, corpus and questioninstitutional sources and validationunverified citations and conclusions
Creation and communicationcreator, model, brief and audiencerights, approval and controlled feedbackconvergence and unauthorised use
Cybersecurityanalyst, telemetry and hypothesischain of custody, roles and auditincorrect execution and contamination
Complianceassessor, requirement and evidenceowners, periods and adjudicationapparent compliance
Organisational memoryuser, question and internal sourcesvalidity and validated learningpropagation of obsolete information

The demonstrative case study: assessing a potential cyber incident

  • HumanAI episode: the analyst asks the model for a timeline, hypotheses and validation steps, verifies events in primary sources and retains authority over classification. The configuration is HumanAI even when some suggestions are rejected.
  • Aggregated use: several analysts use the same model independently and copy its answers into tickets, with no source catalogue, configuration version, adjudication role or memory-update rule. Activity volume does not compensate for missing architecture.
  • Governed OrgAI: sources classified and filtered by analyst identity; retrieved content treated as untrusted data; hypotheses linked to primary events; a separate validator and a decision-maker for the response; commands denied by default; only adjudicated conclusions update case memory.
  • Illustrative calculation: initially A = 0.92, V = 0.68, Δepi = 0.24; after controls A = 0.92, V = 0.88, Δepi = 0.04. With ρ = 0.80 and κ = 0.90, Ωprop falls from 0.173 to 0.029.

The minimum classification worksheet

Answers must be supported by evidence, not by declarations alone. Any claim about HumanAI or OrgAI should identify the unit analysed, task, context, AI configuration, observation period, validation method and boundary of accountability.

QuestionExpected evidenceInterpretation
What are the task and context?purpose, inputs, outputs and consequenceswithout delimitation there is no unit of analysis
Who is the accountable person or role?identity, competence and authorityrequired for HumanAI and OrgAI
Which AI system and configuration are used?model, version, tools and settingssupports reproducibility and evaluation
Is the AI contribution material?comparator and threshold θₓif not, the episode is not classified as HumanAI
Are sources authorised and identifiable?catalogue, owners, provenance and validitycondition for OrgAI
Is validation independent?role, criteria and recordsreduces epistemic decoupling
Are process and decision traceable?log, approval and source linkscondition for governed OrgAI
Are access and execution controlled?permission tests, confirmations and rollbacksecurity condition
Does feedback update memory?staging, adjudication and withdrawaldistinguishes the cumulative form
Has synergy been demonstrated?comparators, outcomes and risk thresholdsoutcome label, not assumption

Anti-patterns and incorrect uses

Anti-patternWhy it is incorrectCorrection
AI as authorityoutput is treated as the decisionretain a decision-maker, validation and contestability
Nominal human in the loopa person approves without time, competence or evidence accessmeasure actual detection and intervention capacity
OrgAI by licence countaccount numbers are confused with integrationevaluate sources, roles, workflows and controls
Memory without adjudicationall feedback becomes institutional truthseparate raw feedback from approved updates
Single scoretrade-offs and risks are hiddenreport dimensional profiles and thresholds
Convenient comparatorgain is measured against a weak baselineinclude the best realistically available process
Irreversible automationa suggestion triggers action without controldeny by default, confirm, log and support rollback
Compliance labelthe concept is treated as legal or audit evidencedemonstrate obligations and control effectiveness separately

What the notations do not mean

  • HumanAI does not mean that a person becomes AI or that a system acquires human status.
  • HumanAI is not synonymous with success or positive augmentation.
  • OrgAI is not the name of a model, internal chatbot or enterprise package.
  • Access to an internal corpus does not demonstrate provenance, validation or authority.
  • Automation does not transfer accountability to AI.
  • Using the term OrgAI does not make an organisation mature, safe or compliant.

The full specification, layer by layer

The same content as the diagram, as text: every layer from the bottom up, with each component’s formula, role and connections.

P0

Foundations and epistemic status

Theoretical traditions · types of claims · 8 components

What the framework rests on and what kind of claims it makes. Definitions are stipulative, models are analytical, propositions are testable, scenarios are explanatory, and controls are risk-proportionate design requirements, not claims of compliance.

ENGIntellectual augmentation

Engelbart, 1962

The augmentation tradition treats the computer as part of a system through which people formulate, understand and solve more complex problems. HumanAI continues this perspective while adding the task, context, interface, validation and delegation to the unit of analysis.

  • A model in the abstract cannot explain a person’s performance or risk.

Depends on: —
Feeds: Iᵢ Interface and mode of interaction

DCDistributed cognition

Hollan, Hutchins and Kirsh, 2000

Cognitive activity can be distributed among people, artefacts and the environment. The framework takes up the idea but separates situated collaboration from institutional capacity.

Depends on: —
Feeds: X Task, context and constraints

HIHybrid intelligence

Dellermann et al., 2019

Configurations in which human and artificial contributions are complementary. Complementarity is not assumed: it is measured against comparators.

Depends on: —
Feeds: —

ORGOrganisation, authority and knowledge

Jarrahi, 2018 · Faraj et al., 2018 · Raisch and Krakowski, 2021 · Nonaka, 1994

At organisational level, AI changes roles, workflows, coordination and authority, not only individual productivity. Organisational knowledge is not an accumulation of documents: it requires ownership, context, validity, memory and mechanisms through which conclusions are validated before reuse.

Depends on: —
Feeds: Korg Authorised institutional knowledge

FRTPerformance, frontier and homogenisation

Vaccaro et al., 2024 · Brynjolfsson et al., 2025 · Dell'Acqua et al., 2026 · Doshi and Hauser, 2024 · Bommasani et al., 2021

Evidence on human–AI combinations is heterogeneous. Improvement over an unaided person does not demonstrate synergy over the best available comparator. Better individual generation may reduce collective diversity, and defects in a foundation model can propagate into downstream systems.

  • Evaluation targets the implemented configuration, not the reputation or benchmark scores of a model.

Depends on: —
Feeds: SYN The synergy condition

INFThe informational environment

Șcheau and Angheluș, 2025

Personalised feeds, synthetic media, persuasive conversational systems and emotion-aware targeting can affect source discrimination and perceptual autonomy. In the framework, these effects are outcome and risk variables.

  • Organisational controls require provenance, independent verification and monitoring of repeated narrative exposure.

Depends on: —
Feeds: SIG Observable signals

EPIThe status of claims

definitions · models · propositions · scenarios · controls

Definitions are stipulative and support consistent use of the notations. Analytical models describe operationalisable relationships, not universal laws. Propositions are testable or falsifiable. Scenarios are explanatory applications, not empirical findings. Controls are design requirements, not automatic claims of compliance.

  • The framework is judged by clarity, discriminatory power, operationalisability and utility, not by exclusivity of a graphical form.

Depends on: —
Feeds: P1–P8 The framework’s propositions

NOTThe notations and their documented uses

Duda Guerra, 2025 · ASFOR, 2026 · Devonport · Esparza, 2026

The HumanAI notation was used publicly before, in contexts associated with amplifying human–AI collaboration; these uses are acknowledged as antecedents, without a contest over priority. No datable use of the exact OrgAI notation with the meaning of governed organisational capacity was located, an observation limited to the sources consulted.

  • The ASCII forms HumanAI and OrgAI may appear in products or proper names; graphical identity does not imply conceptual identity.

Depends on: —
Feeds: —

P1

The HumanAI configuration

⟨Hᵢ, M, X, Iᵢ, Vᵢ, Dᵢ, Kᵢ, t⟩ · the individual unit · 10 components

The situated person–AI–task–context unit. The configuration is indexed by person i, task and context X, and time t. Outcome Yᵢ is a multidimensional profile, not a single value and not the definition of the construct.

HᵢThe person

Hᵢ — expertise, experience and state

The expertise, experience and state of person i, assessed relative to the domain and the task. The same model produces different profiles for different people.

Depends on: —
Feeds: —

MModel and AI configuration

M — model, tools, configuration

Includes version, parameters, sources and tools. At organisational level several systems appear, written Mⱼ.

  • Not to be confused with the maturity levels M0–M5.

Depends on: —
Feeds: —

XTask, context and constraints

X — the domain of validity

Defines the domain in which claims about the configuration are valid. Without a delimited task there is no unit of analysis.

Depends on: DC Distributed cognition
Feeds: —

IᵢInterface and mode of interaction

Iᵢ — prompts, feedback, explanations, friction

The concrete way the person interacts with the system. Friction, or its absence, shapes trust calibration.

Depends on: ENG Intellectual augmentation
Feeds: —

VᵢValidation and trust calibration

Vᵢ — validation practice

The practice through which the person checks outputs, in proportion to risk. It is not reducible to formal human acceptance.

  • It is the variable that links the individual configuration to epistemic decoupling.

Depends on: —
Feeds: Validation, Δepi Epistemic decoupling

DᵢDelegation and autonomy

Dᵢ — what AI may recommend, decide or execute

The rules that set the boundary between recommendation, decision and execution. The human role and decision authority must remain identifiable.

Depends on: —
Feeds: Authority

KᵢSources and knowledge available

Kᵢ — sources, provenance, use limitations

The sources the person can reach, with their provenance and use limitations. They are not yet authorised institutional knowledge (Korg).

Depends on: —
Feeds: Knowledge

tTime and period

t — the time index

HumanAI is episodic when it concerns a bounded task and stable when repeated use changes the person’s practice, trust, competence, autonomy or validation behaviour.

Depends on: —
Feeds: —

dₓ ≥ θₓThe material contribution condition

dₓ(YᵢAI, Yᵢ⁰) ≥ θₓ

Yᵢ⁰ is the reference outcome without AI contribution, YᵢAI the outcome in the evaluated configuration, dₓ a task-appropriate difference function, and θₓ the declared materiality threshold. The difference may concern quality, time, errors, range of options, learning, autonomy or risk.

  • The threshold is defined before evaluation, to prevent opportunistic classification.
  • The contribution may be positive, neutral or negative: dependence or skill erosion do not remove a case from the category, they describe its outcome profile.

Depends on: —
Feeds: AI contribution, MET H HumanAI metrics, Yᵢ The individual outcome profile

YᵢThe individual outcome profile

Yᵢ := ⟨Qᵢ, τᵢ, Eᵢ, Cᵢ, Aᵢ, Lᵢ, Ωᵢ⟩
Yᵢ(X,t) = F(Hᵢ, M, X, Iᵢ, Vᵢ, Dᵢ, Kᵢ, t)

Quality, time, error, calibration, autonomy, learning and risk exposure. The profile is not compressed automatically into a score.

  • Aᵢ here means autonomy and Lᵢ individual learning — not access A in Δepi and not L in Aorg.

Depends on: dₓ ≥ θₓ The material contribution condition
Feeds: Yorg The organisational outcome profile

P2

The membership test and its boundaries

7 criteria at two levels · 5 exclusions · 9 components

One set of criteria, read once for HumanAI and once for OrgAI. The test settles what is being assessed before any measurement and separates cases that resemble the constructs without satisfying them.

UNITIdentifiable unit

H: person, system, task, context
O: process, actors, systems, knowledge

For HumanAI, the person, system, task and context must be identified; for OrgAI, the organisational process, actors, systems and knowledge.

Depends on: —
Feeds: Processes and control points

AIAI contribution

H: materially changes execution or judgement
O: integrated into institutional capacity

At individual level, the contribution materially changes execution or judgement. At organisational level, it is integrated into institutional capacity.

Depends on: dₓ ≥ θₓ The material contribution condition
Feeds: —

AUTHAuthority

H: human role and decision can be attributed
O: roles, approvals and escalations defined

Authority remains attributable. A system-only decision without identifiable authority and accountability does not satisfy the governed framework.

Depends on: Dᵢ Delegation and autonomy
Feeds: Roles, rights and accountability

KNOWKnowledge

H: relevant sources can be delimited
O: sources authorised, versioned and owned

Access to an internal corpus does not demonstrate provenance, validation or authority.

Depends on: Kᵢ Sources and knowledge available
Feeds: Korg Authorised institutional knowledge

VALValidation

H: the person can verify in proportion to risk
O: validation independent and institutionalised

Validation is competent, reproducible, risk-proportionate checking, distinct from formal approval.

Depends on: Vᵢ Validation and trust calibration
Feeds: Governance, validation, contestability, audit

TRACETraceability

H: the episode can be reconstructed
O: workflow and decision can be audited

Reconstruction is proportionate to risk: the graver the consequence, the more complete the trail must be.

Depends on: —
Feeds: T Configuration and decision traceability

LEARNLearning

H: effects on the person can be tracked
O: validated feedback updates memory in a controlled manner

At organisational level, only adjudicated feedback may update memory; raw feedback written directly produces contamination and self-confirmation.

Depends on: —
Feeds: L Validated organisational learning

E/SEpisodic or stable

episodic: bounded task
stable: practice changes through repetition

The same person may have isolated HumanAI episodes or a stable configuration in which repeated use changes their practice, trust, competence, autonomy or validation.

Depends on: —
Feeds: —

✕Excluded cases

5 cases that do not satisfy the constructs

They resemble HumanAI or OrgAI but do not pass the test.

  • An ignored AI suggestion with no material effect does not constitute HumanAI in that episode.
  • A deterministic automation without an AI component is not included merely because it is complex.
  • Multiple independently used AI licences do not constitute OrgAI.
  • A chatbot connected to unverified documents does not demonstrate authorised organisational knowledge.
  • A system-only decision without identifiable authority and accountability does not satisfy the governed framework.

Depends on: —
Feeds: —

P3

Organisational architecture Aorg

⟨Korg, P, R, G, S, L, T⟩ · the Iorg threshold · 8 components

The architecture that selects, authorises, coordinates, validates and retains only the contributions that can become institutional capacity. Six components are constitutive; L is required only for the cumulative form.

KorgAuthorised institutional knowledge

Korg — owner, version, validity, access rules

The source has an owner, provenance, version, validity and access rules. It corresponds to the knowledge criterion of the membership test.

Depends on: Organisation, authority and knowledge, Knowledge
Feeds: —

PProcesses and control points

P — integration into the real workflow

Connects AI to actual work. It corresponds to workflow integration in the membership test.

  • Not to be confused with the propositions P1–P8.

Depends on: UNIT Identifiable unit
Feeds: —

RRoles, rights and accountability

R — decision-maker, validator, owner

Includes who decides, who validates and who owns the source or the process. It corresponds to authority and accountability.

Depends on: Authority
Feeds: Roles and separation of duties

GGovernance, validation, contestability, audit

G — rules, exceptions, oversight

Defines rules, exceptions and oversight. At the minimum threshold, feedback control is exercised through G.

Depends on: Validation
Feeds: —

SSecurity and data protection

S — identity, access, isolation, execution

Controls identity, access, isolation and execution.

Depends on: —
Feeds: THR The threat model

TConfiguration and decision traceability

T — reconstruction proportionate to risk

Supports reconstruction of the configuration and the decision.

  • Not to be confused with the task set T in Δepi(T;X,t).

Depends on: Traceability
Feeds: AUD Evidence and audit trail

LValidated organisational learning

L — raw feedback ≠ accepted updates

The seventh component of the architecture. It separates raw feedback from accepted updates and is required for the cumulative form, not for the minimum threshold.

Depends on: Learning
Feeds: 5 Memory update through adjudication, M0–M5 The maturity model

IorgThe constitutive OrgAI threshold

Aorg := ⟨Korg, P, R, G, S, L, T⟩
Iorg = 1[Korg ∧ P ∧ R ∧ G ∧ S ∧ T]

The indicator expresses the minimum conceptual threshold. If any constitutive component is missing, the configuration may represent connected or aggregated AI use, but it does not demonstrate governed OrgAI.

  • L does not enter the threshold: it is required for the cumulative form.

Depends on: —
Feeds: ≠ Σ OrgAI is not the sum of episodes, M0–M5 The maturity model

P4

OrgAI: organisational emergence

OrgAI ≠ Σ HumanAIᵢ · the six-step mechanism · 9 components

The relationship between levels is one of conditional integration: HumanAI episodes provide local contributions, and organisational architecture decides which of them become capacity. Synergy is a separately demonstrated outcome, not a consequence of the notation.

≠ ΣOrgAI is not the sum of episodes

OrgAI(X,t) := ⟨{HumanAIᵢ}, {Mⱼ}, Aorg, X, t⟩
OrgAI ≠ Σ HumanAIᵢ

OrgAI is not a product, model, agent or document repository; it is a property of the organisational configuration. More users without integration do not satisfy the test.

  • A licence count does not answer the question of which capacity has been created.

Depends on: Iorg The constitutive OrgAI threshold
Feeds: Yorg The organisational outcome profile

YorgThe organisational outcome profile

Yorg := ⟨Qorg, τorg, Kcov, Coord, Res, Div, Ωorg⟩
Yorg(X,t) = Φ({Yᵢ}, {Mⱼ}, Aorg, X, t)

Quality, time, knowledge coverage, coordination, resilience, diversity and systemic risk. Organisational outcomes depend on integration, coordination and control, not merely on individual outputs.

Depends on: Yᵢ The individual outcome profile, ≠ Σ OrgAI is not the sum of episodes
Feeds: —

SYNThe synergy condition

Q(H + OrgAI) > max{Q(H), Q(AI), Q(H + AI), Q(H + K), Q(Team)}

Synergy may be claimed only when performance exceeds relevant comparators on the same task and declared thresholds for traceability, autonomy, security and coordination cost are satisfied.

  • Synergistic OrgAI is an outcome label, not an M6 level.

Depends on: FRT Performance, frontier and homogenisation
Feeds: P1–P8 The framework’s propositions

1Situated execution

actor + delimited HumanAI configuration

An actor performs a task within a delimited HumanAI configuration.

Depends on: —
Feeds: 2 Documented output

2Documented output

sources · configuration · interventions · confidence

The output is accompanied by sources, configuration, interventions and confidence level.

Depends on: 1 Situated execution
Feeds: 3 Validation by a competent role

3Validation by a competent role

accept / reject in proportion to risk

A competent role validates or rejects the contribution in proportion to risk.

Depends on: 2 Documented output
Feeds: Δepi Epistemic decoupling

4Attribution and integration

attributed decision → controlled process

The decision is attributed and integrated into a controlled organisational process.

Depends on: —
Feeds: 5 Memory update through adjudication

5Memory update through adjudication

separate adjudication workflow

Accepted conclusions may update memory only through a separate adjudication workflow.

Depends on: L Validated organisational learning, 4 Attribution and integration
Feeds: 6 Monitoring and withdrawal

6Monitoring and withdrawal

outcomes and errors monitored · access withdrawn

Outcomes and errors are monitored, and access or rules can be withdrawn or corrected.

Depends on: 5 Memory update through adjudication
Feeds: —

P5

Epistemic decoupling and propagation

Δepi = A − V · Ωprop = max(0, Δepi) · ρ · κ · 5 components

The framework’s central risk: access to answers grows faster than demonstrated capacity to validate them, and reuse turns a local error into organisational risk.

ΔepiEpistemic decoupling

Δepi(T;X,t) = A(T;X,t) − V(T;X,t)

The gap between the range of claims, interpretations or options that AI makes accessible and the demonstrated capacity of the accountable actor to validate them. Across a declared task set T, A is the proportion of tasks for which AI provides a usable response, and V the proportion for which the accountable actor can produce a verified justification.

  • It is calculated within the same domain and ranges from −1 to 1.
  • A high positive value shows that access exceeds validation.

Depends on: Vᵢ Validation and trust calibration, 3 Validation by a competent role
Feeds: Ωprop Propagation exposure

A ≠ auth.Access is not authority

generation · validation · authorisation

Access to a claim does not automatically produce justified knowledge, and technical validation does not automatically confer decision authority. The framework separates three questions: what the system can generate or retrieve, what the competent actor can validate, and who is authorised to decide or execute.

Depends on: —
Feeds: —

ΩpropPropagation exposure

Ωprop = max(0, Δepi) × ρ × κ

ρ is the rate at which an output is reused or diffused and κ the criticality of consequence. Without local calibration, the formula does not estimate real-world probabilities: it shows how a small error reused frequently in a critical process can become a major organisational risk.

  • A conceptual ordering indicator, not a probability.

Depends on: Δepi Epistemic decoupling
Feeds: MET O OrgAI metrics

SIGObservable signals

6 signals of decoupling

Signs that access has outrun validation.

  • Responses are accepted faster than their sources can be checked.
  • Citations, explanations or calculations cannot be reproduced independently.
  • The same output is reused across processes without reassessing context.
  • Reported confidence rises while error-detection rates decline.
  • Organisational memory is updated with unadjudicated outputs.
  • Authority is formally assigned to a person, but practical constraints make contestation impossible.

Depends on: INF The informational environment
Feeds: Mitigation measures

MITMitigation measures

7 measures

Measures that raise validation without necessarily reducing access.

  • Limit the domain and state unknowns.
  • Cite and verify primary sources.
  • Require independent validation for high-impact outputs.
  • Separate generation from approval and execution.
  • Test trust calibration and error detection.
  • Control reuse and memory updates.
  • Preserve rights to contest, stop and return to the unassisted process.

Depends on: SIG Observable signals
Feeds: PRINC Governance principles

P6

Propositions, maturity and evaluation

P1–P8 · M0–M5 · profiles, not scores · 8 components

How the framework is tested and how a configuration is assessed: testable propositions, maturity levels assigned per domain, dimensional metrics and a minimum protocol. The default form of reporting is a profile, not a composite score.

P1–P8The framework’s propositions

3 conceptual · 5 empirical

The propositions make the framework open to criticism and verification. P2, P3 and P4 are conceptual commitments that follow from the definitions; P1, P5, P6, P7 and P8 are empirical and can be confirmed or refuted by observation.

  • The full list is in the Propositions section below.

Depends on: EPI The status of claims, SYN The synergy condition
Feeds: —

M0–M5The maturity model

M0 → M1 → M2 → M3 → M4 → M5 (per domain)

Describes observable states of integration, not an obligation to reach the highest level. A level is assigned to a bounded domain and process, not to an organisation in the abstract.

  • An organisation may operate at M1 in one domain, at M4 in another and prohibit AI in a third.
  • For some tasks, managed HumanAI is more appropriate than cumulative OrgAI.

Depends on: Iorg The constitutive OrgAI threshold, L Validated organisational learning
Feeds: —

PRINCMeasurement principles

6 principles

Rules that precede any measurement.

  • Define the unit, task, period and configuration before measurement.
  • Select the comparator according to the real decision, not to favour the AI result.
  • Report quality and risk together with time and coordination cost.
  • Separate test data from data used for configuration or training.
  • Retain negative outcomes, abstentions and not-applicable cases.
  • Produce a profile and an uncertainty interval rather than false precision.

Depends on: —
Feeds: —

CALCThe computational companion

The framework calculator · versioned separately

The HumanAI and OrgAI calculator operationalises six relationships: epistemic decoupling, propagation exposure, the constitutive threshold, material contribution, synergy and maturity classification. It implements the formal rules without changing their meaning; the whitepaper remains the canonical source.

  • An unknown state never counts as demonstrated.
  • Exported values remain user-entered claims until linked to evidence.

Depends on: —
Feeds: —

MET HHumanAI metrics

8 dimensions

Quality, time, error, detection, calibration, autonomy, learning and vulnerability, each with an indicator and evidence.

  • The full table is in the Evaluation section below.

Depends on: dₓ ≥ θₓ The material contribution condition
Feeds: —

MET OOrgAI metrics

9 dimensions

Knowledge, coordination, validation, traceability, security, resilience, diversity, learning and propagation.

Depends on: Ωprop Propagation exposure
Feeds: —

PROTMinimum evaluation protocol

8 steps

From delimiting the task to reporting residual risk.

  • Define the task, population, period and consequence of error.
  • Freeze the evaluated configuration: model, version, tools, sources, interface and rules.
  • Set comparators, materiality threshold and success criteria before testing.
  • Build a representative task set containing normal, boundary and adversarial cases.
  • Measure quality, time, errors, detection, autonomy and coordination cost.
  • Test permissions, data separation, prompt injection, unavailability and uncertain responses.
  • Adjudicate results through competent roles and preserve disagreements.
  • Report configuration, evidence, limitations, applicability interval and residual risk.

Depends on: —
Feeds: STAGES The implementation pathway

✕ SCOREWarning on scores

dimensional profile = the default form

A composite score can hide faster execution achieved by reducing validation, or greater consistency achieved by reducing diversity.

Depends on: —
Feeds: —

P7

Governance, security and implementation

roles · threats · stages · stop conditions · 9 components

What makes authority, validation and contestability real: separated roles, controls for specific threats, an audit trail, an eight-stage implementation pathway and explicit stop conditions.

PRINCGovernance principles

6 principles

What must remain true throughout the workflow.

  • Authority remains explicit and attributable.
  • Validation is independent in proportion to impact and cannot be replaced by nominal approval.
  • Contestability includes time, competence, evidence access and a real ability to stop or correct.
  • Only authorised knowledge with ownership, provenance, validity and access rules is reusable.
  • Configuration changes are versioned, tested, approved and reversible.
  • Negative outcomes and disagreements remain visible for learning and audit.

Depends on: Mitigation measures
Feeds: —

ROLERoles and separation of duties

7 roles · incompatible shortcuts

Each role has a responsibility and a shortcut that cancels it.

  • The full table is in the Governance section below.

Depends on: Roles, rights and accountability
Feeds: —

THRThe threat model

mechanism → minimum controls

Prompt injection, unauthorised disclosure, privilege confusion, hallucinated authority, memory contamination, automation bias and common-mode failure.

Depends on: Security and data protection
Feeds: —

AUDEvidence and audit trail

7 categories of evidence

What must be retained so the decision can be reconstructed.

  • Identity, role and authorisation of the person and the service.
  • Model, version, system instructions, tools and configuration state.
  • Source identifiers, provenance, access decision and validity.
  • Material prompts or interventions, without unnecessary sensitive content.
  • Generated output, uncertainty, citations and validation status.
  • Approval, decision, execution, exception and rollback events.
  • Memory updates, adjudication, withdrawal and affected downstream uses.

Depends on: T Configuration and decision traceability
Feeds: —

STAGESThe implementation pathway

delimitation → … → monitoring

Eight stages, each with an exit criterion.

  • The full table is in the Implementation section below.

Depends on: PROT Minimum evaluation protocol
Feeds: Acceptance criteria

ACCAcceptance criteria

9 acceptance criteria

The conditions to meet before an implementation is accepted.

  • The configuration and domain are declared.
  • Comparators and thresholds were established before testing.
  • Sources are authorised, versioned and withdrawn in a controlled manner.
  • Permissions were tested for unauthorised users and cross-domain access.
  • Critical outputs have independent validation and an identifiable decision-maker.
  • Actions are controlled, logged and reversible.
  • Feedback does not update production memory directly.
  • A safe fallback, an incident procedure and suspension criteria exist.
  • The performance and risk profile reports negative outcomes rather than hiding them.

Depends on: STAGES The implementation pathway
Feeds: —

ANTIAnti-patterns and incorrect uses

8 anti-patterns · 6 incorrect uses

The confusions that make the framework look applied without being applied.

  • The full table is in the Anti-patterns section below.

Depends on: —
Feeds: —

STOPStop conditions

stop or return to the previous state

Implementation must stop or return to the previous state on data exposure, loss of decision attribution, degradation in error detection, unauthorised access, memory contamination, inability to reproduce critical results, or an unvalidated configuration change.

Depends on: —
Feeds: —

✕ LAWThe regulatory boundary

analysis and control design ≠ legal compliance

The framework supports analysis and control design but does not establish legal compliance. Systems with material effects on rights, safety, employment, finance, health, security or public services require domain-specific legal assessment.

  • HumanAI or OrgAI labels do not replace applicable obligations.

Depends on: —
Feeds: —

Notation

The variable dictionary, and the symbol collisions that can mislead.

SymbolMeaningOperational observation
Hᵢthe person’s expertise, experience and stateassessed relative to the domain and task
M, Mⱼmodel, tools and AI configurationincludes version, parameters, sources and tools
Xtask, context and constraintsdefines the domain of validity
Iᵢinterface and mode of interactionincludes prompts, feedback, explanations and friction
Vᵢvalidation practice and trust calibrationnot reducible to formal human acceptance
Dᵢdelegation and autonomy ruleswhat AI may recommend, decide or execute
Kᵢsources and knowledge available to the personincludes provenance and use limitations
Korgauthorised institutional knowledgehas an owner, version, validity and access rules
Pprocesses and control pointsconnects AI to actual work
Rroles, rights and accountabilityincludes decision-maker, validator and owner
Ggovernance, validation, contestability and auditdefines rules, exceptions and oversight
Ssecurity and data protectioncontrols identity, access, isolation and execution
Lvalidated organisational learningseparates raw feedback from accepted updates
Tconfiguration and decision traceabilitysupports reconstruction proportionate to risk
dₓ, θₓobserved difference and declared materiality thresholdthe threshold is declared before evaluation
ρ, κreuse rate and consequence criticalityused in Ωprop

Same symbol, different meanings

Aaccess in Δepi = A − Vautonomy Aᵢ in the profile Yᵢ
Lvalidated organisational learning in Aorgindividual learning Lᵢ in Yᵢ
Pprocesses in Aorgthe propositions P1–P8
Mmodel and AI configurationthe maturity levels M0–M5
Ttraceability in Aorgthe declared task set in Δepi(T;X,t)

Limitations and conditions of application

  • The formulas express dependencies, thresholds and interpretive conditions, not universal laws or parameters calibrated for every domain.
  • The materiality threshold, comparators and quality criteria must be adapted to the task and risk.
  • The framework is not a certification, technical standard, legal method or evidence that an implementation is effective.
  • The maturity model should not be applied to an entire organisation without delimiting its processes.
  • Any application should identify the actual configuration, sources, model version, roles, controls and evaluation period.

The decisive question is not whether an organisation uses AI. It is whether the organisation can demonstrate which capacity it has created, in which domain, from which sources, through which roles, with what validation and within which limits.

Frequently asked questions

What is the HumanAI and OrgAI framework?

A conceptual and operational framework that separates two levels of AI-mediated capacity. HumanAI is the situated person–AI–task–context configuration in which AI materially changes a person’s performance, judgement, learning or vulnerability. OrgAI is the governed organisational capacity that integrates those episodes through authorised knowledge, roles, processes, validation, traceability, security and controlled learning.

When does AI use in an organisation become OrgAI?

When the constitutive threshold Iorg = 1[Korg ∧ P ∧ R ∧ G ∧ S ∧ T] is met: authorised knowledge, processes, roles, governance, security and traceability, all demonstrated with evidence. User or licence counts are not enough; without these components, use remains connected or aggregated.

What is epistemic decoupling?

The gap between the range of answers AI makes accessible and the accountable actor’s demonstrated capacity to validate them: Δepi = A − V, on the same task set. When access grows faster than validation, the organisation produces claims it cannot support, and their reuse raises the exposure Ωprop = max(0, Δepi) × ρ × κ.

Is HumanAI the same as successful augmentation?

No. HumanAI describes a configuration, not an outcome. The AI contribution may be positive, neutral or negative: dependence or skill erosion do not remove a case from the category, they describe its profile. Performance, autonomy and risk are reported separately, as a profile.

What do the maturity levels M0–M5 mean?

Observable states of integration, assigned to a domain and a process rather than to the organisation as a whole: exploratory, episodic HumanAI, managed HumanAI, connected OrgAI, governed OrgAI and cumulative OrgAI. There is no obligation to reach the top level, and synergy is not a level but a separately demonstrated outcome.

Can the framework be used as proof of compliance?

No. The framework supports analysis and control design, but it is not a certification, technical standard or legal method. Systems with material effects on rights, safety or public services require domain-specific legal assessment.

Apply the framework to a concrete process

We can help you delimit the unit of assessment, choose comparators and thresholds before measuring, and build the evidence for the Iorg threshold, so the result holds up in front of management or an auditor.

Framework: Angheluș, A. (2026). HumanAI and OrgAI: A Relational Framework for AI-Mediated Human and Organizational Capacity, v1.5. Zenodo. DOI 10.5281/zenodo.22295278
Tool: Angheluș, A. (2026). HumanAI and OrgAI Framework Calculator, v1.2.0. Zenodo. DOI 10.5281/zenodo.22884721
The whitepaper is published under CC BY-ND 4.0. This page is a visual presentation of the framework; the canonical text remains the whitepaper.
The scenarios and case-study values are illustrative. The framework is not a certification, technical standard, legal advice or a determination of conformity.
Skip to content