Doctrine

The DDAO role

DDAO: Delegated Decision Agent Officer. The human cornerstone of ACF®. A named individual (or collegial body) responsible for an agent (or a portfolio of agents) in production. Inspired by the DPO (GDPR art. 37-39) and the CISO.

iNote

DDAO is not a marketing title nor a decorative role. It is a named, identifiable person who engages the legal liability of the company for the decisions of the agent they supervise. For that reason, ACF® requires the DDAO to be independent from the agent’s reporting chain, as the DPO is independent from the Director of Marketing.

The four missions

Validation of critical decisions: that the agent is designed to escalate (thresholds from card ACF-P6, written into the ACF-13 mandate).
Arbitration on unplanned escalation: off-mandate situation, drift behaviour, alert from the register.
Drift monitoring: model drift, case distribution drift, cost drift.
Periodic reviews: quarterly at least, on the assigned perimeter, with a report to the governance committee.

Expected profile

The DDAO typically comes from one of three pools: (1) an existing DPO expanding their perimeter, (2) a CISO or internal audit director, (3) a product compliance lead or a senior product manager moving into a governance posture. None of these profiles is native to ACF®, formal training is explicit, via cards ACF-18 (Guided Case Study) and ACF-19 (Instructor's Guide).

Independence

The DDAO cannot report to the same manager as the agent they supervise. For a lead-qualification agent, the DDAO cannot report to the CMO. For a credit-scoring agent, the DDAO cannot report to the head of credit risk. Target architecture is a direct report to general management, to the DPO, or to the board audit committee. This is hardened in card ACF-13 (Agent Mandate).

Liability

As with the GDPR DPO, the DDAO does not bear legal liability in place of the company, the company answers for itself. But the DDAO carries functional liability: they must be able to produce, on request, the cryptographic trace of a specific decision, justify the threshold choices, and demonstrate that reviews were conducted. On an AI Act audit, they are the one summoned by the regulator.

MCP instrumentation

Three acf-mcp tools are specifically designed for the DDAO: acf.assign-ddao-controls (assign controls), acf.evaluate-agent-mandate (audit an existing mandate),acf.identify-governance-gaps (find gaps before external audit). A tooled DDAO can run a quarterly review in hours instead of days.