govFMP

AI policy enforcement for public agencies.

Your agency has an AI policy. The harder question is whether you can show it is operating. govFMP screens every staff-authored prompt against your own rules before it reaches a model, and writes a record of each decision to a log you own.

The gap this fills

Policy templates are easy to come by now. Most agencies have adopted one, and it usually says something close to: staff must not enter confidential, regulated, or restricted data into AI systems that are not approved for that category of data. That sentence is enforceable in principle and unenforced in practice, because nothing sits between a staff member and the prompt box.

So the policy exists, and the honest answer to how AI use is controlled is that staff have been asked to be careful. When an auditor, a board, or a records request arrives, being careful is not evidence.

Observe first, enforce when you are ready

There is a real distinction between monitoring and enforcement, and the product does both because agencies need them in that order. Monitoring records what happened. Enforcement decides whether it happens at all, by evaluating the prompt against policy before the model call and refusing the ones your rules reject.

Deployments start in observe mode. Everything is scored and logged, nothing is blocked, and you get a month of real traffic showing what staff are actually doing before a single rule turns restrictive. Then you enforce the rules the data justifies. Switching enforcement on first is how a governance control becomes the thing everyone works around.

What the audit log contains

When an auditor examines AI governance, the question is whether controls were technically enforced, whether each event is attributed to a responsible individual, and whether the policy was operating as written. Each evaluation writes a record answering exactly that:

• The prompt, or its hash, depending on your retention policy
• The quality score with its per-axis breakdown
• The security clearance and the specific reason for it
• The rubric pack and version in force at the time
• The user identity, from your own identity provider
• The timestamp and which model endpoint handled it

The log is the deliverable. It is what turns the answer to how staff AI use is controlled from a description into a record.

Runs inside your boundary

Single-tenant container in your environment, calling the approved model endpoint you already run or procure. Prompts are not routed to us and there is no callback to a service we operate. The tradeoff is stated on the security page rather than buried: we cannot meter your usage remotely and we cannot debug an incident by looking at your data.

Sensitivity and role

Rules are not uniform across an organization, so the gate is not either. You classify data categories, and you decide which categories may reach which models, and which roles may send them. A caseworker handling records with personal data and an analyst drafting a public notice are not the same risk, and a single blanket rule for both either blocks the analyst or lets the caseworker through.

For school districts

K-12 is under a firmer deadline than most of state government. A number of states now require districts to adopt an AI policy with board approval, and district plans have to align to a state framework. The vocabulary differs too: the exposure districts worry about is student data and FERPA, not federal classification categories.

The same control applies, with a rubric pack written in that vocabulary, and the audit log is what a superintendent brings to the board rather than a description of intent.

The standard it applies

The scoring standard is published in full and free to adopt, whether or not you ever buy anything. Read the Prompt QA Governance Standard (PQA-1) or the technical summary covering deployment and integration.

The AI FactSheet is filed on the GovAI Coalition template and answers all 24 of its fields, including the ones where the honest answer is that the work has not been done yet. Those are marked rather than omitted.

Questions we get

govFMP is in active development and working with early agencies. If you own AI governance somewhere and want to pressure-test the standard, that is a conversation worth having even if you never buy. Get in touch and mention your agency.