ai-governance

name	ai-governance
description	Enforces AI governance for Black Trigram — transparent and accountable AI-assisted development aligned with Hack23 AI Governance Policy, EU AI Act, NIST AI RMF, and Information Security Policy
license	MIT

🤖 AI Governance Skill

Strategic Principle: AI-powered development must be transparent, accountable, and aligned with organizational policies.

🎯 Purpose

Enforce AI governance standards for Black Trigram, ensuring AI-assisted development (GitHub Copilot, coding agents) follows Hack23 ISMS policies for transparency, security, and compliance.

Reference: Hack23 ISMS Information Security Policy | EU AI Act

Enforcement Rules

Rule 1: AI-Generated Code Review

IF (code generated or assisted by AI: Copilot, coding agents)
THEN (review for security vulnerabilities, license compliance, and correctness)
ELSE (AI-generated code may contain vulnerabilities or license issues)

Rule 2: AI Agent Governance

IF (using GitHub Copilot coding agents)
THEN (define clear instructions via agents/*.md, enforce skills, limit permissions)
ELSE (ungoverned AI agents may produce non-compliant code)

Rule 3: Data Privacy in AI

IF (AI tool processes code or data)
THEN (verify no sensitive data (secrets, PII) is sent to AI services)
ELSE (data leakage through AI service APIs)

Rule 4: AI Output Verification

IF (AI generates security-critical code: auth, crypto, input validation)
THEN (mandatory human review AND automated security scanning)
ELSE (AI may generate insecure patterns)

Rule 5: AI Transparency

IF (AI significantly contributes to implementation)
THEN (document AI involvement in PR description or commit message)
ELSE (lack of transparency in development process)

Core Patterns

Agent Governance Structure

.github/agents/          → Agent definitions with frontmatter
.github/skills/          → Skill enforcement rules
.github/copilot-instructions.md → Global AI instructions
.github/copilot-mcp.json → MCP server configuration

Agent Size Limits

IF (agent .md file)
THEN (must be < 30,000 characters)
ELSE (agent will not load properly)

AI Code Review Checklist

□ No hardcoded secrets or credentials
□ Input validation present for all user inputs
□ Error handling follows project patterns
□ Types are strict (no 'any')
□ Tests are comprehensive and meaningful
□ Korean theming applied correctly
□ Performance considerations addressed
□ License-compatible with project

EU AI Act Alignment

Requirement	Implementation
Transparency	AI contributions documented in PRs
Human oversight	Human review required for all AI PRs
Risk management	Security scanning of AI-generated code
Data governance	No PII/secrets sent to AI services
Technical documentation	Agent and skill documentation maintained

GitHub Copilot Governance

Allowed Uses

• ✅ Code completion and suggestions
• ✅ Test generation
• ✅ Documentation writing
• ✅ Code review assistance
• ✅ Issue analysis and triage

Required Controls

• ✅ All AI PRs require human approval
• ✅ Security scanning (CodeQL) on all AI code
• ✅ License compliance verification
• ✅ Agent instructions within character limits
• ✅ Skill enforcement rules applied

Testing Requirements

• ✅ AI-generated code passes all existing tests
• ✅ Security scanning clean (CodeQL, npm audit)
• ✅ No license violations in AI suggestions
• ✅ Agent files within size limits
• ✅ Skills properly enforce rules

Compliance

• ISO 27001:2022: A.5.1 (Policies for information security)
• EU AI Act: Transparency and human oversight requirements
• NIST AI RMF: Govern, Map, Measure, Manage
• Hack23 ISMS: Information Security Policy, Secure Development Policy

---

흑괘의 AI 거버넌스 - AI Governance of the Black Trigram