A policy needs an operational definition.
An AI system cannot reliably apply an organization's meaning of sensitive, approved or appropriate if that meaning has never been specified.
Dr. Benjamin Harvey
Watch the 48-second visual essay
The adjective is not the rule
Protect sensitive information. Use approved tools. Escalate inappropriate requests. Each statement expresses a reasonable intention. None tells an AI system everything it needs to decide what to do in a particular workflow.
Sensitive to whom, under which classification scheme, for what action and destination? Approved for public material, or also for a restricted customer record? Appropriate for drafting, or for releasing the finished work? If those distinctions are missing, a model may supply a plausible interpretation that the organization never authorized.
That is not simply a prompt-writing problem. It is a governance problem: somebody must define the terms, own the decision and specify the evidence that makes the rule applicable. My research agenda separates policy interpretation from authority and observed action. Operational definitions are one place where that separation becomes practical.
Start with the organization's context
NIST's AI RMF Playbook, under GOVERN 1.2, recommends defining key terms and the scope of intended uses, connecting AI policy to existing organizational controls, and specifying testing and review processes. MAP 1.1 emphasizes documenting purpose, users, deployment setting and relevant assumptions. These recommendations support context-setting; they do not certify any particular policy engine.
The practical implication is to treat context as a maintained input, not background knowledge the model is expected to guess. A policy owner should identify the authoritative classification source, approved destinations, relevant roles, permitted actions and review conditions. Record the version and effective date so a later reviewer can reconstruct which definition applied.
NIST currently notes that AI RMF 1.0 is being updated. The references here describe the Playbook available on October 19, 2026, rather than an assumed future revision.
Turn one broad statement into a bounded decision
Consider a fictional rule: do not send sensitive reports to external AI services. A testable version might apply to upload attempts from a specific workspace, use the organization's current Restricted label as one input, and check the destination against a maintained service register. In this example, external upload of a Restricted report is denied; a missing or conflicting classification pauses the upload for an authorized review. A Public label merely clears this particular check—it does not override other controls.
This example is intentionally narrow. Labels may be missing, stale or wrong. A classifier may help flag suspicious content, but its confidence is not the policy owner's approval. The design should distinguish an observed label, an inferred category and an explicit authorization. It should also state what happens when the required evidence is unavailable.
For AI IP attribution, the same discipline applies to words such as reusable. A technical relationship, an internal access label and permission for external release are different facts. Making one of them machine-readable does not establish the others. Nor can every judgment be reduced to a deterministic pattern; some cases need accountable review.
Test meaning as well as enforcement
A proposed study could compare broad policy prose with an owner-approved operational specification using the same model, tools, cases and inference budget. Use fictional documents with known classifications and destinations. Include legitimate public uploads, restricted uploads, missing labels, contradictory metadata and a change in the destination register.
Measure incorrect approvals, unnecessary blocks, appropriate escalation, reviewer burden and legitimate task completion. Separately inspect whether the tool actually stopped the prohibited transfer. A correct explanation and an enforced decision are different outcomes.
This is a proposed evaluation, not a report of improved performance or a claim that the example is production-ready. Start with one adjective in your policy. Can the people responsible for it explain what evidence would make it true, false or unresolved in a real task? Until they can, enforcement is being asked to implement an interpretation that has not yet been agreed.