§
Sovereign.Software
↓ .MD

← Lineage and Related Work

2021–Present (NIST AI 100-1, 2023) • National Institute of Standards and Technology (NIST), Ben Shneiderman (Human-Centered AI), OECD / EU AI Governance communities

Human-Centered AI Governance (NIST AI RMF)

How trustworthy AI frameworks such as the NIST AI Risk Management Framework (AI RMF 1.0) establish transparency, explainability, and human oversight, and how Sovereign Software adds the critical requirement that AI services remain replaceable, non-custodial dependencies.

Lineage summary for Human-Centered AI Governance (NIST AI RMF)
Origin & key figures2021–Present (NIST AI 100-1, 2023) (National Institute of Standards and Technology (NIST), Ben Shneiderman (Human-Centered AI), OECD / EU AI Governance communities)
Conceptual overlapModerate–high
Principles informedTransparency and Control, Sovereignty, Locality
Framework requirements & testsE4, E5, T3, T4, T5
Our motive & where we standWe adopt mainstream AI governance principles of human oversight, inspectability, and contestability for consequential actions (Principle IV / E5). Our distinct contribution is treating AI models and remote inference APIs as withdrawable operational dependencies that must never gain permanent custody over a user's underlying records or workflows.

1. Historical context and core thesis

As machine learning and generative artificial intelligence moved from specialized research laboratories into everyday authoring, coding, financial, and decision-support software, a major body of governance and engineering literature emerged to ensure that automated systems remain accountable to human beings.

Two foundational contributions represent this tradition:

  1. National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST AI 100-1, January 2023): Developed through a broad public-private consensus process, the NIST AI RMF organizes AI risk management around four core operational functions (Govern, Map, Measure, and Manage) and defines seven characteristics of trustworthy AI:
    • Valid and Reliable
    • Safe
    • Secure and Resilient
    • Accountable and Transparent
    • Explainable and Interpretable
    • Privacy-Enhanced
    • Fair with Harmful Bias Managed
  2. Human-Centered AI (HCAI): Championed by human-computer interaction researchers such as Ben Shneiderman (Human-Centered AI, 2022), HCAI rejects the false dichotomy that higher automation requires lower human control. Instead, it argues that well-engineered systems should combine high automation with high human control through clear responsibility boundaries, comprehensible interfaces, continuous audit logs (“flight data recorders” for AI actions), and immediate human override.

2. Where Sovereign Software agrees (shared foundation)

Section 04 of the Sovereign Software Manifesto (AI and Automated Systems), Principle IV (Transparency and Control), and Requirement E5 (Governability of consequential actions) draw directly from Human-Centered AI and the NIST AI RMF:

3. Where we stand and why we diverge (our motive)

Why are existing AI governance frameworks like the NIST AI RMF not sufficient on their own for evaluating software sovereignty?

3.1 AI as a custody and dependency trap, not only a safety/bias problem

Mainstream AI governance frameworks (NIST AI RMF, the EU AI Act, ISO/IEC 42001) focus primarily on model behavior, safety, fairness, hallucination risk, and institutional compliance. They ask: Is the model accurate? Is it biased? Does it respect privacy regulations?

From a software sovereignty perspective, however, even a 100% accurate, fair, and well-calibrated cloud AI assistant can destroy user authority if the application uses AI integration as a custody and dependency trap:

Where we stand: Sovereign Software evaluates AI features not only as governable actors (Principle IV / E5), but also as withdrawable external dependencies (Principle I, II, III / E1–E4):

  1. Underlying records must remain independent of the AI layer: If the remote AI provider shuts down, revokes API keys, or changes pricing tomorrow, all user-authored records, prompts, outputs, and core non-AI editing/analysis capabilities must continue working locally without loss (E4, T3).
  2. Explicit transmission boundaries (T4, T5): No local document, repository, or database record may be transmitted to an external model endpoint or used for training without clear, revocable user authorization.
  3. Endpoint replaceability (T3, T6): Where AI capabilities are used, architectures that allow users to run local models on their own hardware or swap API providers align far more strongly with Principle III (Locality) than systems tethered to a single vendor’s cloud.

4. Concrete architectural contrasts and boundary cases

ScenarioStandard AI Governance (NIST AI RMF) ViewSovereign Software Verdict
Cloud-tethered AI editor that documents model limitations and bias clearly, but locks local files inside a proprietary cloud workspace and silently uploads project contextMay score well on Explainable/Interpretable disclosures while raising Privacy-Enhanced concerns.Fails fundamental requirements (E1–E4 and E5): Clear model cards do not excuse trapping the user’s primary work or exfiltrating local context without granular authorization.
Local desktop tool (Obsidian, Emacs, VS Code / VSCodium with local plugin) where files remain plain local Markdown/code and an optional AI assistant uses either a local model or an explicit, diff-reviewed API callEvaluated on the reliability and human-in-the-loop controls of the assistant plugin.Strong alignment: Primary data custody (E1–E4) and offline editing (T3) are completely unaffected if the AI plugin is disabled, and all AI edits are presented as inspectable diffs (E5, T4).
Autonomous agent given unlogged write access to a production repository or financial ledger without diff review or rollbackHigh risk under NIST Govern and Manage functions (lack of human oversight).Fails E5 (Governability of consequential actions) and T4: Consequential operations lack proportionate authorization, auditability, and reversal.

5. How this shapes the evaluation methodology

  1. Test T4 (Operational transparency and control): Specifically requires evaluators to test AI-assisted or automated features for prior authorization boundaries, diff/audit visibility, uncertainty disclosure, and rollback capability.
  2. Provider-withdrawal test applied to AI dependencies (T3, T5): Evaluators block access to external AI inference endpoints during Stage 3 of the laboratory protocol to verify that the core application and all previously created records remain fully usable (E4).

6. Primary sources and further reading