> [!note] Migrated issue > > <!--Drupal.org comment--> > > <!--Migrated from issue #3608922.--> > > Reported by: [joshua1234511](https://www.drupal.org/user/3362218) ## Problem / Motivation AI Empathy today evaluates empathetic decision-making against per-scenario reference decisions, and the `ai_empathy_hr` / `ai_empathy_healthcare` submodules add narrow, sector-specific regulatory scoring via hard-coded PHP enums (`HiringRegulation`, `RegulationFramework`). There is no general, site-configurable way to say "evaluate responses against the EU AI Act and India's AI governance guidelines" or "apply general trustworthy-AI principles only". Global AI governance is converging on a recognisable set of frameworks and cross-cutting themes: | Framework | Type | Scope | |-----------|------|-------| | EU AI Act | Legally binding | EU | | OECD AI Principles | International policy | 50+ countries | | UNESCO Recommendation on the Ethics of AI | International recommendation | 190+ countries | | UN AI Advisory Body recommendations | Global governance | Worldwide | | Council of Europe Framework Convention on AI | International treaty | Signatories | | G7 Hiroshima AI Process | International agreement | G7 | | ISO/IEC 42001 | International standard | Organizations | | India — IndiaAI Mission / AI Governance Guidelines / DPDP Act | National, principles-based | India | | US — NIST AI RMF / Executive Orders | National, sectoral | USA | | UK — AI Safety Institute / principles | National, principles-based | UK | | Singapore — Model AI Governance Framework / AI Verify | National | Singapore | | Canada — AIDA (proposed) | National | Canada | | China — generative AI / recommendation-algorithm rules | National | China | Common themes across all of them: **human oversight, transparency, explainability, accountability, fairness/bias mitigation, privacy & data governance, security/robustness, risk management, auditability, human rights, sustainability, public trust, incident reporting, continuous monitoring.** Researchers and organisations want to pick which of these apply — by jurisdiction/country or as general principles — and have AI Empathy evaluate against them. Frameworks change over time, so the catalogue must be **updatable** without a code release. ## Proposed resolution Add a **jurisdiction-selectable, updatable AI governance policy layer** to the `ai_empathy_ccc` submodule, wired through the Context Control Center (`ai_context`), plus a **policy-alignment score**. ### 1. Policy catalogue (data-driven, updatable) Introduce an `ai_empathy_governance_policy` **config entity** with fields: * `id`, `label` * `jurisdiction` — e.g. `eu`, `india`, `usa`, `uk`, `singapore`, `canada`, `china`, `global`, or `general` (cross-cutting principles) * `type` — `binding` | `policy` | `recommendation` | `treaty` | `standard` * `themes` — multi-value from the common-theme list above * `source_url`, `version` / `as_of` date * `guidance` — concise, prompt-ready text describing what a compliant, empathetic response should honour (same style as the existing `HiringRegulation::guidance()` / `RegulationFramework::guidance()` text) * `status`, `weight` Because they are config entities, policies are **editable in the UI, exportable, and shippable as packs** (mirroring the scenario-pack approach in `ai_empathy_finance`). A default set is seeded via `config/install`, and updates ship as new config / `hook_update_N` or an optional "governance pack" submodule. ### 2. Selection (site-wide and per-scenario) * **Site-wide default:** a settings form section listing policies, filterable by jurisdiction, with checkboxes ("apply EU + India", or "General principles only"). * **Per-scenario override:** stored as a third-party setting on the scenario config entity, reusing the pattern in `CccScenarioSettings` so the base module stays governance-agnostic. ### 3. Activation — configurable, two paths (site setting) * **(a) Generate CCC context items** — a service _formulates_ each active policy into an `ai_context` context item under a new `governance_policy` scope. The existing `CccIntegrationSubscriber` then injects it into the evaluation prompt like any other context, and the policies become editable inside the Context Control Center. Items are created/updated idempotently when the selection or a policy changes. * **(b) Direct prompt injection** — append the selected policies' `guidance` straight into the evaluation/scoring prompt (as `ai_empathy_hr` / `ai_empathy_healthcare` do today), with no CCC items. A site setting chooses **CCC items**, **direct injection**, or **both**. ### 4. Policy-alignment scoring Add a `PolicyAlignmentScorer` service (mirroring `ToneAlignmentScorer` / `HiringFairnessScorer`) that scores the AI response against the active policies' guidance and contributes a `policy_alignment` metric (0–100) via a base field on the result entity (same mechanism as `tone_alignment`), with a configurable threshold. Results and the dashboard surface the new metric. ## User interface changes * New "AI Governance Policies" collection (list/add/edit/delete) under the AI Empathy admin, with jurisdiction filter. * New "Governance" section on the AI Empathy settings form: activation mode, site-wide policy selection, and the `policy_alignment` threshold. * Per-scenario "Governance policies" selector (via ai_empathy_ccc). * `policy_alignment` shown on result pages and dashboard charts. ## API / data model changes * New config entity type `ai_empathy_governance_policy` (+ schema, list builder, forms, routes, permissions). * New `ai_context` scope plugin `governance_policy`. * New services: policy → CCC context formulator; `PolicyAlignmentScorer`. * New result base field `policy_alignment` + settings key/threshold (added by `ai_empathy_ccc`, like `tone_alignment`). * No breaking changes to the base module; `ai_empathy_hr` / `_healthcare` keep their sector enums (optionally refactored later to consume the catalogue). ## Remaining tasks (this feature) * `ai_empathy_governance_policy` config entity + schema + admin UI + perms * Seed default policy catalogue (frameworks + general themes) in config/install * `governance_policy` ai_context scope plugin * Site-wide + per-scenario selection (settings form + CccScenarioSettings) * Activation service: generate/update CCC context items from selections * Activation path: direct prompt injection + mode toggle * `PolicyAlignmentScorer` + `policy_alignment` base field + threshold * Dashboard/result surfacing of policy_alignment * Unit + kernel + functional tests * README / docs; cspell words * Manual validation against a live AI provider * Rebase the `governance_policy` scope plugin and the CCC activation path onto the ai_context beta5 API (blocked by https://git.drupalcode.org/project/ai_empathy/-/work_items/3616671) ## Dependencies `ai`, `ai_context` (Context Control Center), `ai_agents` (transitive via ai_context). Reuses the existing `ai_empathy_ccc` :left_right_arrow: `ai_context` bridge.