REASON

acf.advisor

ACF® governance advice from a free-text case, one paragraph in, one structured evaluation out: activated principles, autonomy level, risk class, applicable articles, first actions, operational risks. This is the conversion tool from documentation library to governance advisor.

!Warning

This tool produces a preliminary evaluation from free-text heuristics, not legal advice. requires_human_review is always true. For a more defensible qualification, re-run through acf.classify-agent with qualified enums.

When to use

Use this tool when a case owner (CIO, business line, consultant) arrives with a prose description of their AI agent and needs a structured first verdict on the applicable ACF® governance: which principles fire, which delegated autonomy level fits, which regulatory obligations trigger, which fiches to mobilise in what order. It is the “first step” tool before rigorous qualification.

It answers the board-level question: “where do we start on this case?”. The output is designed to be served to an AI committee or a DDAO who will decide the next steps.

Input parameters

One required field (the case description), three optional context fields that tighten the calibration.

case_descriptionstring (20-2000)required

Free-text case description: what the agent does, who runs it, what it acts on, who validates. The sharper the description, the stronger the inference heuristics.

sectorstring (≤80)

Sector (“banking”, “healthtech”, “public sector”…). Without a sector, criticality uses a neutral calibration.

jurisdiction"eu" | "uk" | "us" | "ca" | "ch" | "br" | "jp" | "other"

Primary deployment jurisdiction. By default the tool reasons assuming EU.

deployment_scale"pilot" | "department" | "enterprise" | "public"

Deployment scale. Influences criticality and the recommended first actions.

locale"en" | "fr"default: "en"

Language of the textual output.

Output schema

Output is a structured object with autonomy level, risk level, activated principles, prioritised fiches, applicable articles, first actions, operational risks, signed footer.

autonomy_level{ level: "suggestive"|"co_decision"|"supervised_autonomous"|"autonomous", rationale: string }

Inferred ACF® autonomy level and its rationale.

risk_level{ level: "low"|"medium"|"high"|"unacceptable", rationale: string }

AI Act-compatible risk class, derived from the criticality (card ACF-03, Criticality Matrix).

activated_principles{ code: string, why: string }[]

ACF® principles (P1 to P4) triggered by the case, each justified.

priority_fiches{ code: string, order: number, why: string }[]

ACF® cards to mobilise, in order, with the reason for each.

applicable_articles{ regulation: string, article: string, why: string }[]

AI Act / GDPR / DORA / NIS2 / ISO 42001 articles mobilised by the case.

first_actionsstring[] (≤5)

The first five operational actions to kick off.

operational_risksstring[]

Typical operational risks tied to the inferred profile.

confidence"low" | "medium" | "high"

Global confidence of the evaluation. Stays “medium” by default when input is prose only.

assumptionsstring[]

Explicit assumptions made during inference (notably enums inferred from text).

gaps_to_validatestring[]

Gaps to close via human review, including the systematic recommendation to re-run through classify-agent.

rationale_per_rule{ rule_id, rule_version, fired, evidence }[]

Per-rule trace: identifier, version, fired status, evidence from the input text.

requires_human_reviewtrue

Constant. No call returns false.

Example call

An internal HR assistant proposing a shortlist validated by a recruiter:

advisor.tstypescript

import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";

const transport = new StdioClientTransport({
  command: "npx",
  args: ["-y", "acf-mcp"],
});
const client = new Client({ name: "demo", version: "1.0" }, {});
await client.connect(transport);

const result = await client.callTool({
  name: "acf.advisor",
  arguments: {
    case_description:
      "We are rolling out an internal HR assistant that summarises candidate CVs, proposes a shortlist score, and writes the shortlist to our ATS. A recruiter validates each shortlist before any candidate is contacted. The agent reads structured candidate profiles (name, email, education) and uses a GPAI under the hood for the summarisation.",
    sector: "human-resources",
    jurisdiction: "eu",
    deployment_scale: "department",
    locale: "en",
  },
});

console.log(JSON.stringify(result.content, null, 2));

Response

response.jsonjson

{
  "autonomy_level": {
    "level": "co_decision",
    "rationale": "No clear autonomy threshold matched the declared inputs; defaulting to co-decision (the agent proposes, a human validates). Confirm with the team."
  },
  "risk_level": {
    "level": "medium",
    "rationale": "Combination of personal_data_level + financial_exposure not yet calibrated; defaulting to medium for safety."
  },
  "activated_principles": [
    {
      "code": "P1",
      "why": "Decision sovereignty applies to every agentic deployment, regardless of autonomy."
    }
  ],
  "priority_fiches": [
    {
      "code": "ACF-01",
      "order": 1,
      "why": "Start here: the sovereignty score is the entry point of the toolkit."
    }
  ],
  "applicable_articles": [],
  "first_actions": [
    "Identify or appoint the DDAO accountable for the agent (cf. ACF-13).",
    "Document the agent constitution (decision perimeter, allowed/forbidden actions: cf. ACF-04).",
    "Open the decision register and define the retention policy (cf. ACF-09 + ACF-P14)."
  ],
  "operational_risks": [],
  "confidence": "low",
  "assumptions": [
    "human_approval, external_actions and personal_data_level were inferred from the free-text description; pass classify-agent with qualified enums for higher confidence."
  ],
  "gaps_to_validate": [
    "re-run via acf.classify-agent with structured enums for a more defensible qualification."
  ],
  "requires_human_review": true,
  "rationale_per_rule": [
    {
      "rule_id": "ai-act-annex-iii.annex-iii-1a-biometric-identity",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-2-critical-infrastructure",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-3-educational",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-4-employment",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-5b-credit-scoring",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-5c-insurance-pricing",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-6-law-enforcement",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-7-migration-asylum",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-8-justice-democracy",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-i.annex-i-medical-device",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-i.annex-i-vehicle-safety",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-i.annex-i-machinery",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "gpai-triggers",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "autonomy-inference.default-co_decision",
      "rule_version": "2026-06",
      "fired": true,
      "evidence": "inferred human_approval=sometimes, external=read_only from description"
    },
    {
      "rule_id": "criticality-matrix.default-medium",
      "rule_version": "2026-06",
      "fired": true,
      "evidence": "inferred pii=standard, financial=none from description"
    }
  ],
  "doctrine_version": "ACF framework v1.0 / rules 2026-06",
  "doctrine_hash": "sha256:119819463363cde0649504ab8ed5a96982fdb8506441f2c5e76e7e3c3feb77f1",
  "doctrine_signature": "ed25519:3R0oIiqL3Kgd…",
  "doctrine_archive_url": "https://acfstandard.io/archive/doctrine/v1.0/doctrine-v1.0.json",
  "regulatory_snapshot": "EU AI Act (Reg. 2024/1689, incl. Digital Omnibus deferral) + GDPR (Reg. 2016/679) + DORA (Reg. 2022/2554) + NIS2 (Dir. 2022/2555) + ISO 42001:2023: as of 2026-06-07",
  "generated_at": "2026-11-01T12:06:31.037Z",
  "disclaimer": "Preliminary qualification produced by the ACF® deterministic engine. Not legal advice. Human review required. Do not use for autonomous regulatory decision-making. See doctrine_archive_url for the version of the doctrine used.",
  "conversion_cta": "Continue this assessment with the auditable ACF® Compliance workspace at https://acfstandard.com/compliance?ref=mcp"
}

Common errors

Invalid parameters: case_description too short (under 20 characters): the tool does not guess, provide a minimal description of the case. The call fails with a JSON-RPC error whose message lists the offending fields.
Low confidence: when few context fields are provided, confidence is low and assumptions states what was assumed. Complete the input before relying on the result.

acf.classify-agent: re-run with qualified enums as soon as the case is precise, to gain confidence.
acf.assess-autonomy: drill into the autonomy-level decision alone when it is the blocking question.
acf.identify-governance-gaps: broaden from the isolated case to a global governance audit of the organisation.