Trust
AI assists. People decide.
Event teams and public institutions need to know what a system will and will not do. These are the risks I expect, and what the design does about each.
The ground rules
They apply to every feature, not only to application.
- People make the decisions
- No finding without a source
- Data stays on infrastructure you control
- No hidden scoring or ranking of people
- Everything is logged and traceable
Risks and mitigations
Hallucination and incorrect findings
- Risk
- LLM-generated output may fabricate or misinterpret information.
- Mitigation
- Evidence-required architecture: no finding without a source
- Structured JSON outputs, not free-text reasoning
- Deterministic validation logic for critical checks
- Human review remains mandatory
- Try or train different small language models
Data privacy and protection
- Risk
- Processing passports, personal identifiers and contact details through AI systems could expose sensitive data.
- Mitigation
- In-house hosting of AI services
- No external storage of applicant data
- Encryption at rest and in transit
- Alignment with applicable data-protection policies
- Strict role-based access controls
- A plan for removing a person's data, including from models, if required
Over-reliance on AI
- Risk
- Reviewer may rely too much on AI summaries and review less deeply.
- Mitigation
- Explicit confirmation checkbox before a decision
- Transparent evidence links
- Reviewer override and feedback mechanism
- AI positioned as a research assistant only
Bias and discrimination
- Risk
- AI systems may introduce unintended bias in contextual or reputational analysis.
- Mitigation
- No automated scoring or ranking
- No automated decision-making
- Context module limited to factual, verifiable public information
- Final assessment always made by a person
Infrastructure and security
- Risk
- Background AI services add complexity and attack surface.
- Mitigation
- Isolated services behind an AI gateway that enforces permissions
- Web access only through a safe proxy
- Self-hosted models and OCR
What I plan to publish
Trust should be checkable. As features reach prototype stage, I plan to publish:
- What each model is used for, and what it is not for.
- Evaluation results, including the failure cases.
- How data is handled at each step.
Planned, not yet available.
Help me test this
If you work in an institution where these safeguards matter, your scrutiny is the most useful contribution. Tell me what would make you trust it, or what would make you reject it.