AI hiring governance

No stage change, rejection, hire or message is ever driven by a score. Every state transition is performed by a named person. There is no setting, plan or switch that makes the tool advance or reject anyone.

It compares a résumé against a job description. It is not validated as a predictor of job performance, tenure or retention, and we make no such claim.

Advancing someone the tool did not recommend, rejecting someone it did, hiring against it, or an interview verdict contradicting it — each is captured with the actor and the before/after state, at every decision point in the pipeline.

A name is a well-known proxy for gender, ethnicity and national origin. The dedicated name field is omitted from the scoring prompt, but résumé text may contain identifying information: the prompt carries the opening of the résumé, where a name, an email address and a phone number usually sit. Stated precisely, because the distinction matters: the control is on the prompt, not on the text. A name written inside the résumé itself can still reach the model, and is mitigated by instructing the model to ignore it rather than prevented structurally.

There is no gender, race, age, date-of-birth, religion, disability, veteran, marital or photo field on the candidate record. Where a workspace chooses to collect voluntary self-identification for fairness testing, it is stored in a separate table that the scorer has no path to reach; recruiter screens show it only as aggregates, and only the organisation owner's export of the whole workspace contains the individual answers.

The dedicated email and phone fields are not part of the scoring input — though, as above, the résumé text the model does receive may contain them.

Every scoring prompt instructs the model to judge job-relevant merit only and to ignore any protected signal that leaks through free text. This mitigates indirect proxies in a résumé — a university, a country, a career gap — it does not eliminate them, which is exactly why the statistical testing below exists.

Which candidate, which job, which model, which prompt version, the score, the band, the merit signals the model actually saw, and its rationale with contact details and names stripped out. No part of the product changes what a decision says once it is written. Two paths touch one again: merging two records of the same candidate moves both records' decisions onto the one that survives, and erasure deletes them with the candidate.

When the AI is switched off, the spend cap is reached or the model call fails, a deterministic fallback produces the score. That is still an automated employment decision, so it is logged as one — recorded as having had no model and no prompt.

An audit trail with gaps in it cannot answer the only question that matters: how was this person scored. So there is nothing to turn off.

Not a number somebody remembers to increment. Change one word and past decisions stay attributable to the wording that produced them. That is attribution, not replay: the filled prompt and the model's answer are not kept, so a past score can be traced to its wording but not re-run.

The explanation is written in the same database transaction as the score, so a score can never exist without one.

The distribution of scores, which model and prompt version produced them, the share produced with no model, and the rate at which humans decided against the tool. No demographic data is required for any of it. A near-zero override rate is itself a finding: it suggests the humans are rubber-stamping.

The decision and override logs are written for everybody, always. The report that reads them is a pilot we enable workspace by workspace — off by default, and off in our production deployment until its gates are closed — and the statistical half needs data that has to be collected separately. A workspace without it still has the log; it does not yet have the report.

The four-fifths test compares selection rates between demographic groups, and we hold no demographic data. Inferring it from names or photos would be both unlawful and the exact bias that omitting the name field is meant to reduce. So a workspace may choose to invite voluntary, consented self-identification — a decision to take with legal advice, and one some jurisdictions constrain.

A group of fewer than 5 people has its counts, rates and ratio removed entirely, and is excluded from comparison. A ratio computed on three people swings on a single decision and can re-identify individuals; a number there is worse than no number, because it reads as evidence.

When any group is withheld, the headcounts beside it are withheld and coverage is banded, because an exact total published next to the reported groups lets a reader recover the withheld one by subtraction.

Self-identification is voluntary, so each table states what share of the scored population it was computed over, and low coverage is flagged on the report page. Where there was no scored population at all, that share is withheld rather than published as 0%, because a zero there would read as "we asked and nobody answered". A ratio over a small fraction of applicants is not evidence, and presenting one without its coverage is the easiest way to mislead with this report.

Every automated decision made about them, the model and prompt version behind it, the merit signals it used, and the human decisions that followed.

Decisions, overrides and any self-identification are erased with the candidate. An audit record's instinct is to survive; here it is deliberately overridden, because every one of those rows is about the data subject.

Every applicant is told before they apply that their application is scored by an automated tool, and is given an address to ask for a human review, an alternative selection process or a reasonable accommodation, or a copy of the automated assessments made about them. The address is the employer's own, or ours until they set one.