- Capability
- What the AI capability actually does and the boundary of the function being recorded.
- Data Access
- What organisational, user or system data the capability can access or use.
- Decision Authority
- What judgment or decision the AI itself makes, and where rules, constraints or other systems determine the outcome instead.
- Actions
- Whether the capability generates information or can cause consequential actions in software, operational or physical systems.
- Human Confirmation
- Whether an individual action requires human approval before execution, can execute without it, or is not publicly established.
- Permission Basis
- What permissions, credentials, roles or other authority allow the capability to act, where publicly established.
- Administrative Control
- How organisations can enable, restrict, configure or disable the capability.
- Availability
- Which products, plans, regions, deployments or users receive the capability.
- Evidence & Verification
- What first-party evidence supports the recorded behaviour, including where important details remain not publicly established.
- Capability History
- How the capability, its controls or its documented behaviour have changed over time.