How our AI actually works

AI Transparency and Responsible AI Policy

Version: 1.1 · Owner: Pocket PMO Ltd · Approval status: Approved · Review date: quarterly

Purpose

Pocket PMO uses AI extensively across its "AI project team" (Alex, Morgan, Jordan, Taylor and Sam), executive summaries, plan generation, RAID analysis, and predictive risk. This policy explains how AI is used, what safeguards are in place, and where the boundaries are.

Principles

1. Human in the loop. AI never edits customer data or communicates externally without explicit user approval. Every AI suggestion is marked [DRAFT] until a person commits it.
2. No AI agents as owners. AI personas cannot be assigned tasks or work items. Ownership always sits with a human.
3. Advisory only. AI decisions have no legal or similarly significant effect on data subjects.
4. Approval-first UX. UI patterns force acknowledgement before actions like sending emails or applying plan changes.
5. Rate and cost limits. Per-tier AI credit caps prevent runaway usage.

How AI features work

Every AI feature routes through the Lovable AI Gateway from a Supabase edge function. LOVABLE_API_KEY is server-only. The gateway proxies to model providers; today the default chat model is google/gemini-3-flash-preview with OpenAI models available for specific tasks. The current model list in production is controlled server-side.

For each AI workflow, see the Technical Inventory §8. Each workflow specifies: trigger, input, provider route, output, storage, approval requirement, whether it changes data, and whether it communicates externally.

Data sent to model providers

• Prompt content includes the specific project context needed for the task (for example, the RAID list for risk theming; the plan for standup drafting).
• Customer identity metadata is not included in prompts beyond what the customer has voluntarily typed.
• Uploaded documents used in AI review are transmitted as prompt content only when the user invokes the feature.

Model training and retention

Owner-confirmation D-05. Pocket PMO relies on written attestations from the Lovable AI Gateway operator and downstream model providers that customer prompt content is not retained beyond the request and is not used for training. These attestations are held on file and provided on request.

If a provider is unable to meet the no-training requirement, the corresponding model is disabled at the gateway level and removed from production routing.

Human oversight

• Approval workflow. Every AI-proposed action requires an inline Approve or Reject on the surface where it appears. Rejected actions are logged.
• Standup, executive summary, plan generation, business case, snapshot: user commits before any data change.
• Autopilot & lifecycle scans: produce alerts, never automated writes; every alert is user-acknowledged.
• Continuous delivery monitoring (delivery-watcher): runs hourly on a server schedule and evaluates deterministic delivery signals only (milestone slippage, stalled work, unmanaged RAID, confidence drops, dependency risk). It writes findings to the Agent Inbox. It never changes project data and never communicates externally.
• AI-drafted remedies (agent-propose-fix): on request, an AI agent drafts a concrete remedy as a structured proposal held against the finding. Nothing is written until a person selects Approve. Applied changes are restricted to a server-side field whitelist and recorded in the audit log with the signal, agent and affected records.
• Automation rules: customers configure, in plain English, which signals are watched and what is drafted. Automatic application of changes is not available; every proposal terminates in a human decision.
• Support triage assist: suggestions only; admins send responses manually.

Bias, fairness and error

• AI content may be wrong. Users are trained to treat suggestions as drafts.
• We do not use AI to make employment, HR, credit or eligibility decisions.
• We do not use AI to profile individuals.

Voice and transcription

• The elevenlabs-transcribe function handles transcription. Audio files are transmitted to the transcription provider for processing.
• Retention of raw audio is owner-confirmation D-03. Customers must ensure participants have been informed and, where required, have consented.

Customer controls

• AI features can be turned off at workspace level.
• AI Team persona names are customisable and can be disabled per persona.
• AI credit usage is visible to owners and admins.

Sub-processors and regions

• Lovable AI Gateway — region owner-confirmation H-02.
• Google (via the gateway) — regions per Google's terms.
• OpenAI (via the gateway) — regions per OpenAI's terms.
• ElevenLabs (transcription) — regions per provider terms.

Owner confirmation required

• D-03 recording retention; D-05 provider no-training; H-02 AI region.

Document history