# People–System Interaction Assessment and Human Oversight Report ## 1. Executive finding **Status:** Real input; no sample facts used. Pseudonyms P1–P3 are as supplied. Evidence R1–R3 are as supplied. I assigned E1 (the people/system field) and E2 (the closing sentence of the evidence field). **Objectives:** (1) an evidence-bound judgment of each interaction, (2) one justified priority per person, (3) a scenario test of whether the proposed controls make each interaction workable. **Main finding:** - Observed R3: rejected candidates leave the queue after 15 minutes. - Observed R2 clause 3: rejection requires supervisor approval. - R3 does not say whether removal waits for approval. The two records may conflict, but that is Unknown until the rule logic and an enforcement log are supplied. - Observed E2: no approval-enforcement log or intervention-time study was supplied. This is a scope limit, not proof of a missing control. - Legal applicability: Not assessed. **HITL** (human-in-the-loop) means a person who can meaningfully check, correct, approve or stop a system action before it takes effect. ## 2. People–interaction register | Person / interaction | System and activity | Permission and consequence | Tier and evidence | |---|---|---|---| | P1 Recruitment Officer / I1 | Observed E1 P1 sentence 1: shortlists candidates using AI ranking system | Observed R1 P1 entry: accepts rankings. Applicants progress or stall [n1] | Inferred: L2, reliance on outputs; E1 P1 sentence 1; volume Unknown | | P2 HR Supervisor / I2 | Observed E1 P2: approves hiring decisions | Observed R1 P2 entry: approval access, scope Unknown. Applicants' outcomes [n2] | Observed: approves consequential actions, L2; E1 P2, R1 P2 entry | | P3 System Administrator / I3 | Observed E1 P3: manages ranking settings | Observed R1 P3 entry: edits ranking thresholds. Affects all rankings [n3] | Observed: configures rules, L2; E1 P3, R1 P3 entry | - **n1:** Affected group is job applicants (Observed E1 affected groups). Observed E1 P1 sentence 2: P1 cannot view excluded candidates. - **n2:** Observed E1 P2 says "hiring decisions," while Observed R2 clause 3 requires approval of *rejections*. Whether P2 is the designated supervisor under R2 is Unknown. - **n3:** Whether P3's edits need approval is Unknown. R2 supplies only clause 3. ## 2a. Domain–layer entitlement matrix | Person / entitlement | Domain / operational layer | Resource / effective action | Evidence / conditions | |---|---|---|---| | P1 / G1 | HR recruitment; Application/workspace (Inferred) | Ranking system; accept rankings | Observed R1 P1 entry; effectiveness Unknown [n4] | | P2 / G2 | HR recruitment; Application/workspace (Inferred) | Approval function; object scope Unknown | Observed R1 P2 entry; scope Unknown [n4] | | P3 / G3 | HR recruitment; Identity/control administration (Inferred: rule configuration) | Ranking thresholds; edit | Observed R1 P3 entry; approval condition Unknown [n4] | - **n4:** Missing for all grants: account mapping, environment/tenant, object scope, access path (direct, group, inherited, delegated), validity or activation, restrictions or denies, and usage records. R1 is an access snapshot, so assigned versus effective rights are Unknown. - **Identity:** no identity is merged or linked across pseudonyms. ## 2b. Per-person privilege nexus | Person / linked entitlements | Connected capability / consequence | Status and evidence | Independent control / HITL | |---|---|---|---| | P1 / G1 | Accept ranking, then candidate leaves or progresses | No connected path evidenced within P1's own rights; R1 P1 entry | Unknown; reviewer for excluded candidates not evidenced | | P2 / G2 | Approve; possible ability to alter thresholds or logs unevidenced | No connected path evidenced; independence Unknown (R1 P2 entry only) | Unknown; P2's complete linked rights not supplied | | P3 / G3 | Edit thresholds, which change rankings P1 relies on | Potential path: P3's approver and change log Unknown (R1 P3 entry) | Not demonstrated; P3 must not approve own changes (Proposed) | | Cross-person flow G3→G1→G2 | Threshold edit, ranking, acceptance, R3 removal, approval | Potential path: R3 trigger and P2's role unverified (R3, R2 clause 3) | Contain pending control (Proposed) | - **Cross-person flow:** this is a dependency across three people, not a separation-of-duties conflict, since no person holds the full chain. - **Usage:** no usage or transaction records were supplied, so no execution is evidenced. - **Absence:** "no connected path evidenced" does not mean any person is safe. - **Missing domains and links:** other domains, service accounts, group membership and logging rights. ## 3. Exposure and operating conditions | Interaction | Security exposure | Operational exposure | Evidence / unknowns | |---|---|---|---| | I1 | Unknown; no access concern evidenced | Inferred: P1 cannot check exclusions before acting on rankings | Insufficient evidence; E1 P1 sentence 2; volume Unknown | | I2 | Unknown whether approval can be bypassed or altered | Inferred: removal at 15 minutes may precede approval; reversibility Unknown | Priority treatment; R3, R2 clause 3; E2 | | I3 | Inferred: unauthorised or unreviewed threshold alteration | Inferred: one setting error propagates to every applicant ranking | Priority treatment; R1 P3 entry; change log Unknown | - **Sensitivity:** applicant data sensitivity is Unknown. - **Treatment labels:** Priority treatment, Routine review and Insufficient evidence are descriptive. No score or residual-risk assurance is given. ## 4. HITL requirements | Interaction | Mode and trigger | Human role and intervention | Basis / current evidence | |---|---|---|---| | I1 | Review before use; each ranking acceptance | P1 reviews; needs excluded-candidate access or a designated reviewer | Proposed; Gap observed: E1 P1 sentence 2; oversight Not demonstrated | | I2 | Contain pending control; each queued rejection | P2 (if designated) approves; authority to stop removal | Required by R2 clause 3; containment Proposed; enforcement Not demonstrated (E2) | | I3 | Approve before effect; each threshold change | Independent system owner approves; P3 cannot self-approve | Proposed safeguard; no supplied clause; Unknown; Not demonstrated | - **Evidence access and alternatives:** Not demonstrated. E1 P1 sentence 2 shows P1 cannot see excluded candidates. - **Authority and time:** authority to stop removal, and capacity to decide within 15 minutes, are Not demonstrated (R3, E2). - **Logs:** decision and override logs are Not demonstrated. - **Fallback (Proposed):** a manual route holding queue removal until an approval record exists. - **Containment:** the interim protection for I2 is not implemented or authorised by this report. ## 5. Capability and organisational support | Person / interaction | Capability evidence | Organisational gap | One priority | |---|---|---|---| | P1 / I1 | Unknown: no competence or review-time evidence (E2) | Observed: no view of excluded candidates (E1 P1 sentence 2) | System design plus evidence collection; see note | | P2 / I2 | Unknown: no competence or workload evidence (E2) | Unknown: gate enforcement, capacity within 15 minutes (R3, E2) | Governance and system design; see note | | P3 / I3 | Unknown: no competence evidence supplied | Unknown: change approval policy and change log not supplied | Governance and permissions; see note | - **P1:** owner is the system owner (Proposed). First action: confirm how exclusions can be reviewed. - **P2 (highest overall priority):** owner is the system owner with HR leadership (Proposed). First action: obtain the R3 rule logic and approval-enforcement log. It ranks highest because rejection affects applicants directly and R2 and R3 may conflict. - **P3:** owner is the system owner (Proposed). First action: obtain threshold-change history and approver records. - **Training:** missing competence evidence does not show personal incompetence. Evidence supports no training need yet. ## 6. Verification and reassessment | Priority / owner | Scenario test | Pass evidence | Stop / review trigger | |---|---|---|---| | P2: gate enforcement; system owner | Proposed: queue a test rejection with no approval; observe minute 15 | Proposed: candidate held; approver can act; override logged | Proposed: any removal without approval record | | P1: exclusion review; system owner | Proposed: test exclusion; P1 or reviewer requests review within window | Proposed: reasons visible; correction route works; decision logged | Proposed: reviewer cannot see or reverse exclusion | | P3: change control; system owner | Proposed: submit test threshold change by P3 | Proposed: independent approval precedes effect; change logged | Proposed: change effective without independent approval | - **No tests have run.** All thresholds are Proposed. - **Applicants:** preserve and verify a correction or appeal route for applicants (Unknown whether one exists). - **Reassess** after changes to duties, access, ranking rules or thresholds, scale, incidents, or affected groups. - **Next evidence packet:** R3 rule logic, an approval-enforcement and removal-event log for a defined period, and group/role membership for P1–P3. ## Evidence key - **E1:** people/system field (P1, P2 and P3 entries; affected groups) - **E2:** closing sentence of the evidence field (no enforcement log or intervention-time study) - **R1:** access snapshot (Observed content, not verified truth) - **R2:** policy clause 3 (required practice, not proof of implementation) - **R3:** configuration record (15-minute automatic removal)