AI governance platform
Menu

Statement

How Remit uses AI

Version 1.1 · last updated 25 September 2026

Remit’s position

AI assistance in Remit drafts, checks and cites. A person makes every decision: the scope decision, every risk rating, every approval, every signature and every submission to the DTA. Nothing the model produces becomes part of a record until a person accepts it.

This statement is written for the agency that uses Remit. Remit's own AI assistance is an AI use by the agency, so the agency may need to run the policy scope check on Remit, describe it in the agency's AI transparency statement, and satisfy its security and privacy advisers about what leaves the agency's systems. The facts below are the facts an assessing officer needs for each of those tasks. They describe the product as built and are not a verdict on scope or risk; those decisions are the agency's.

  • Human decision requiredA person makes every decision.
  • Quotes verified before displayEvery quote is checked against its source.
  • Every AI step loggedFull audit trail and versioning.
  • Works with AI assistance offEvery other feature still works.

Where AI assists, feature by feature

11 features
  1. 01Intake triage on a new use case
    What it does
    Reads a completed intake form, a project document or a typed description and proposes an answer to each of the five Appendix C in-scope criteria, with the model's reasoning and a verbatim quote from the text, plus proposed register fields (name, description, product, technology type, domain, usage pattern) from Remit's controlled vocabularies, and the two answers on the information the AI will use (the expected highest classification and whether it uses personal information).
    What is sent to the model
    The text extracted from the uploaded file or the typed description (at most 60,000 characters), the policy's own wording of each criterion, and the vocabularies. Nothing else about the agency or the register is sent.
    What comes back
    For each criterion a verdict of likely yes, possibly yes, unclear or likely no, its reasoning and a quote. A quote is shown only if it appears word for word in the source; verdicts are mapped conservatively (only 'likely yes' becomes Yes, only 'likely no' becomes No, everything else becomes Unsure). For the information the AI will use, a classification or a Yes or No on personal information is proposed only with a quote found in the source; SECRET, TOP SECRET or an unrecognised marking is never proposed.
    What the person does
    Sees each suggestion marked as a suggestion beside the question in the policy scope check, and accepts, edits or discards it. Nothing is stored until the person records the scope decision, which then keeps what was suggested, what was recorded and what was changed.
    The limit
    The scope decision is the person's. The wizard works in full with AI assistance off. The uploaded file is kept as evidence only if the person chooses; otherwise it is used once and deleted, with an audit entry. The expected classification is answered first: on screen the upload or description is not read until it is; through the API it travels as a header and the body is never read when it is refused; through MCP the request is refused before anything is kept, logged or sent. If the classification is changed to SECRET, TOP SECRET or an unrecognised marking after suggestions were made, everything provided is discarded and the AI log entry and its audit entry keep only the fact that they happened, with their content removed.
    Where in Remit: AI use cases › Register use case › Upload a document, or Describe it in your own words
  2. 02Drafting an assessment answer
    What it does
    Drafts an answer to one assessment question from the agency's own evidence for that use case, with a citation to the passage behind each claim, a list of the assumptions it made and any evidence gap it noticed.
    What is sent to the model
    The question, the DTA's guidance for it, the use case's register fields, and the passages retrieved from the evidence filed against that use case (its own and linked agency-wide documents) that best match the question.
    What comes back
    A draft answer with citations, assumptions and an evidence gap; on a risk question, a suggested rating with its reasoning, shown for consideration only. Each citation is checked against the indexed passage and counted as unverified if it does not match.
    What the person does
    Reads the draft and its citations, then accepts, edits or discards it. Only the accepted text is written to the answer, under the person's name.
    The limit
    The model never writes a rating. The rating fields are set by the person from the DTA's consequence and likelihood scales, and the matrix derives the result. One question at a time, on click; nothing runs in the background.
    Where in Remit: A question in the AI impact assessment › Draft with AI
  3. 03Register integrity check (the two model-based checks)
    What it does
    Reads the register records in the chosen selection together with excerpts of their evidence and points at contradictions: a register field that a document contradicts, and a scope answer the description does not support. Five further checks are rules in code and use no model.
    What is sent to the model
    For each use case in the selection: its register fields, its scope answers and excerpts of each linked document. Each document is capped (at most 20,000 characters, and a whole-register run shares a budget so that no document falls below 1,800 characters); a run sends at most 200,000 characters in total, and its step log states the cap used and any document that was cut.
    What comes back
    Findings, each with a severity, the place in the record it concerns and a quote from the document. Every quote is verified against the source text; a finding whose quote cannot be found is discarded and counted in the run log.
    What the person does
    Reads the finding with 'the record says' and 'the document says' side by side, opens the exact place in the record, and marks it resolved or dismisses it with a reason. Findings resolve themselves only when a later check no longer finds them.
    The limit
    The check never changes a record. It can be run over the whole register or one use case, and only by an administrator or the accountable official. The policy mandates no automated check; this is Remit's own assurance over the agency's compliance.
    Where in Remit: Assurance › Register integrity › Run checks…
  4. 04Automatic checks
    What it does
    Runs the same register integrity check without a person starting it: on a daily or weekly schedule, or on one use case ten minutes after its record or evidence last changed.
    What is sent to the model
    Exactly what a manual run sends, for the selection and checks the administrator chose.
    What comes back
    The same findings, attributed everywhere to 'Remit, automatic' with the reason for the run.
    What the person does
    An administrator turns it on with a recorded reason and sets a monthly cap in US dollars on the estimated model cost; when the cap is reached the agency's automatic runs pause until the next month. Findings still need a person to resolve or dismiss them.
    The limit
    Off by default. Manual runs are never capped. Nothing automatic ever changes a record, and no email or message is sent; the overview's attention list and the sidebar count carry the signal.
    Where in Remit: Admin › Automatic checks
  5. 05Policy answers
    What it does
    Answers a question about the policy from the DTA's own published pages and documents, which Remit fetches and indexes itself, never from the model's memory.
    What is sent to the model
    The question and the numbered passages from the policy corpus that matched it closely enough. If too little matches, the question is refused before any model is called.
    What comes back
    A short answer written only from those passages, with quotes. Each quote is verified against its passage and dropped if it does not match. With AI assistance off, the matching passages are shown as the answer.
    What the person does
    Reads the answer beside the passages it came from, with a link to each source page, and can open the run's step log to see what was searched, sent and verified.
    The limit
    The corpus is public DTA material; no agency record is sent for a plain question. No second model provider and no external search service are used.
    Where in Remit: Guidance › Policy guidance
  6. 06Apply the policy to a use case
    What it does
    Reports what the policy requires of a chosen use case and what its record and evidence show, by reading them through a bounded set of read-only tools.
    What is sent to the model
    The question, then only what the model asks to read through six read-only tools: search the policy corpus, read the use case record, read its scope decision, list its evidence, read passages of one document, and list its open integrity findings. At most 8 tool calls per question; the budget is enforced in code.
    What comes back
    A report of requirements against evidence, with quotes. Every quote is verified against the tool output it claims to come from and dropped otherwise. Every tool call is written to the step log, the AI call record and the audit entry.
    What the person does
    Reads the report as input to their own assessment and can trace every statement to the record or document it cites.
    The limit
    The tools are read-only by construction. The loop cannot rate, decide scope, approve, change a record or submit anything.
    Where in Remit: Guidance › Policy guidance › choose a use case
  7. 07Ask about spend
    What it does
    Answers a question about the agency's AI spend for the period on screen, by reading the agency's own AI spend view through a bounded set of read-only tools, and says what the figures show without saying why.
    What is sent to the model
    The question and the period, then only what the model asks to read through six read-only tools over the agency's AI spend view, each result inside a data block the model is told is never instructions: spend_totals (the total or why it is withheld, how complete it is, the valuation mix, spend by kind, the comparison with the prior period, the run rate, the agency budget); spend_by (each row's name or label, its key and its figure or withheld reasons); facts_for (for one entity, each counted fact's day, amount, valuation, attribution basis, the reason it is unattributed, completeness, data refresh date, source name and model name); findings (type, subject name, figure, reason, the role it routes to, first seen); coverage (source and connection names, status and reason words, covered-to and refresh dates, counted figure); anomalies (subject ids, days, actual and median amounts, the multiple, status and the role they route to). Every name, label and reason from a record is stripped of brackets and line breaks and capped at 80 characters (reasons at 200). Never a prompt, a completion or a conversation of the agency's own AI, which Remit does not read. At most 6 tool calls per question; the budget is enforced in code. A question that is not about AI spend is refused before any model is called.
    What comes back
    A short answer with the question as the model understood it and citations to the figures and facts it used. Remit checks the figures and the citations, not the whole answer: each sentence stating an amount, a percentage or a multiple must cite the line it came from, and the figure, with its sign, must be on that line, or the sentence is dropped; every citation must name a line the model was shown, and any quote must be copied from that line. The valuation, attribution and freshness beside a citation are Remit's own. A sentence naming a cause, recommending that spend be stopped, or making a comparison, budget or anomaly verdict that does not cite the line Remit assessed is dropped, and the view's own withheld and incomplete qualifications are always shown beside the answer.
    What the person does
    Reads the answer beside its citations and qualifications, follows a next action to the finding, agent or use case behind it, and can open the run's step log to see every tool call and what was dropped. Nothing is changed by the answer.
    The limit
    Read-only by construction: the tools read the spend view and nothing else, and no tool can change anything. It never says why usage changed, never gives a figure or a judgement the view withholds, and never recommends stopping spend: Remit records and routes. It has no API or MCP door.
    Where in Remit: AI spend › Search or ask about spend
  8. 08Policy update agent (platform level)
    What it does
    When the DTA changes a page or file behind the policy pack in force, fetches the new document and proposes the exact changes to the assessment question set: an analyst model lists reworded, added and removed questions with a verbatim quote for each, a second critic model checks the candidate against the document, and the loop repeats until the critic passes or three passes are reached. Remit then validates the candidate deterministically (schema, the Word template's placeholders and checkboxes, a trial fill) and stages it as a candidate pack.
    What is sent to the model
    The current question set (question ids, numbers, titles, wording and types only), the text of the DTA's new document (at most 120,000 characters) and the names of the changed DTA pages. No agency data, no use case, no evidence.
    What comes back
    A list of proposed changes with quotes, the tool's version and date as printed, and the critic's verdict and findings. A change is kept only if its wording appears word for word in the document; a finding is kept only if its quote does.
    What the person does
    A platform operator starts the agent, or it starts after the daily refresh when the mode says so. The operator reviews the run's step log and the candidate, and activates the pack from a date; in the release mode the agent activates a pack itself only when every quote verified, the critic passed and every deterministic check passed.
    The limit
    Never rewrites the Appendix C in-scope criteria: a proposed change to those is reported and the candidate is marked for review, because they decide scope under the policy. Never changes an existing assessment. Never runs without the DTA's actual document.
    Where in Remit: Platform › Knowledge › Policy packs
  9. 09AI spend setup assistant
    What it does
    Checks what Remit already holds about one AI spend source (whether its read is approved on the register, which connection carries it, what the last read found) and proposes the settings it needs: the expected-source record, a rate card draft for each licence Remit holds with no price recorded, and a monthly budget from the last complete months of Known AI spend. Every check and proposal is worked out without AI; the AI service is asked only for a two-sentence plain summary of the finished plan.
    What is sent to the model
    The finished plan as JSON and nothing else: the check results, the names of the connection and the source, the licence names and seat counts Remit holds, and the monthly Known AI spend figures a budget proposal rests on. No prompt, conversation, document, person or credential.
    What comes back
    Two plain sentences on where setup stands and what to do next. A summary that names any figure the plan does not hold is dropped and the step log says so.
    What the person does
    An administrator starts the assistant, reads the checks and the summary, and saves each proposal they want through the AI spend settings with their own reason; each save is audited as theirs.
    The limit
    Never saves anything, never proposes a price, never calls a provider or starts a read, and never holds a key or secret: a key is pasted by a person into the sealed field.
    Where in Remit: AI spend › Sources & data health › Set up (administrators)
  10. 10Ask Remit IQ
    What it does
    Answers one question about one use case by explaining that use case's Remit IQ context packet: what the cited items say, why they matter, and where in Remit each is dealt with. One model call, no tools. The status, risk ratings, blockers, readiness and completeness are shown from the record itself, never written by the model.
    What is sent to the model
    Exactly two things: the question as typed (at most 1,000 characters), and the use case's context packet, read fresh for the person asking, as numbered lines inside a data block the model is told is never instructions. The packet lines are the use case's reference and name, product, scope, lifecycle stage, assessment status and version, inherent and residual risk ratings, the accountable owner's and the approving officer's names, the approval decision and conditions, human oversight, policy obligations, governance reviews and reporting positions, the Operate Gate reading and each blocker in the gate's words, deployment identifiers and names, evidence, open incident and integrity finding counts, recent activity by action and date, and every expected source with whether it was read. Brackets and line breaks in record text are neutralised so it cannot pose as an item or instruction. Never a document's content, evidence text, an assessment answer, a comment, an audit entry's detail, another use case, another agency's data, anything read from a connected platform, or any Microsoft 365 content.
    What comes back
    Explanation sentences and a separate list labelled as Remit IQ's inference, each citing the packet items it rests on, with an optional quote. Code, not a model, then withholds every sentence that cites nothing, cites an item not in the packet, quotes words not copied from the item it cites, or claims an approval, clearance, compliance, readiness or risk rating, or that nothing is wrong while the packet names a problem (the patterns are in config/iq-claims.json). The screen says how many sentences were withheld.
    What the person does
    Reads the record's own readiness, ratings and blockers first, then the explanation beside its citations, each a link to the place the fact is kept or the problem is put right, and can open the run's step log to see what was read, sent and withheld. Nothing is changed by the answer.
    The limit
    Read-only by construction: it has no tools and its answer changes no record, rating, gate or decision. The verifier only withholds; a sentence it keeps is cited, not certified. It never states that a use case is approved, cleared, ready, compliant or safe, or what its risk rating is: those come from the record. The question, the step log (item ids and counts, never packet text) and the verified answer are kept as execution telemetry under Remit IQ's memory classes; the packet itself is never kept.
    Where in Remit: A use case's record › Remit IQ › Ask about this use case; the API at /api/v1/iq/ask and the agent tool ask_use_case_question
  11. 11Access for other agents and systems
    What it does
    Lets an agency's own systems and AI agents work with the register through 18 named tools and the public API: list and read use cases, findings, incidents and the runtime systems the agency recorded, search and ask the policy, ask Remit IQ about one use case, start an integrity check, propose scope answers from a document, and log an incident.
    What is sent to the model
    Nothing to any model unless the tool called is one of Remit's own AI features above, which then behave exactly as they do on screen and honour the agency's AI switch.
    What comes back
    The same data the screens show, scoped to the key's agency.
    What the person does
    An administrator issues each key, chooses read or read-and-write scope and an expiry, and can revoke it at any time; every key stops working on its own once it expires. Any write a key does make is audited under the key's creator.
    The limit
    No key can change a use case record, rate, approve or submit. Recording a runtime binding or a report, recording, linking, confirming or retiring a runtime system, dismissing a finding and changing an incident are made by a signed-in person in Remit, never by a key. The agent is a client of Remit's rules, not a way around them.
    Where in Remit: Admin › API keys; the API under /api/v1 and the agent endpoint at /api/mcp

How you can check

  • Every quote the model offers is checked against the text it claims to quote before it is shown. A quote that cannot be found is dropped and the run log says so.
  • Every call is written to the AI call log and to the audit log, which is append-only at the database level.
  • Every prompt carries a version, so a change in wording is visible in the log and in the run steps.
  • Every screen shows what a run did: what was loaded, what was sent and how much, which model, the tokens used, what came back and what was verified.
  • No screen blocks on the model. Runs continue in the background and the page shows their progress; a failure leaves the record exactly as it was.
  • The rule-based integrity checks, the policy scope check, the assessment, the exports and every other feature work with AI assistance off.

Assessing Remit under the policy

Appendix C, in the policy's own words
Each Appendix C in-scope criterion in the policy’s own words, and the facts about Remit relevant to it.
The policy asks whetherWhat is true of Remit
More than insignificant harmThe use, misuse or failure of AI could lead to more than insignificant harm to individuals, communities, organisations, the environment or the collective rights of cultural groups including First Nations peoples.Every output is a suggestion reviewed by a signed-in officer before it can affect any record. A suggestion that is wrong and is accepted becomes that officer's recorded decision, in their name. The realistic harm to consider is a missed or misleading suggestion that an officer relies on.
Materially influences administrative decisionsThe use of AI will materially influence administrative decisions that affect individuals, communities, organisations, the environment or the collective rights of cultural groups including First Nations peoples.Remit's AI assistance informs the agency's own governance records about its AI use cases. It plays no part in any decision about a member of the public, a benefit, an entitlement or an obligation.
Public interaction without human reviewIt is possible the public will directly interact with, or be significantly impacted by, the AI or its outputs without human review.No member of the public interacts with Remit or sees anything its model produces. Every output is shown only to signed-in agency staff.
Personal, sensitive or classified dataThe AI is designed to use personal or sensitive data (as defined by the Privacy Act 1988 (Cth)) or security classified information (as defined by the Australian Government Protective Security Policy Framework).The register text and evidence documents sent to the model can contain personal information and material marked OFFICIAL: Sensitive. The agency controls what is uploaded and whether AI assistance is on; see the data-handling rows above.
DTA-directed elevated riskIt is deemed an elevated risk AI use case as directed by the DTA.No direction from the DTA concerning this kind of use is known to the operator at the date of this statement. The agency should check the DTA's current directions when it records its decision.

These are facts about Remit for the agency's own policy scope check, set beside the policy's own wording of each criterion. They are not Remit's verdict on scope. The agency records its decision in Remit like any other use case. Source: Policy for the responsible use of AI in government, Appendix C.

What AI never does in Remit

  • Set or change a risk rating. Ratings come from the DTA's scales chosen by a person, and the matrix derives the result.
  • Decide whether a use case is in scope. The scope decision is recorded by a person from their own answers.
  • Approve, endorse or request changes to an assessment.
  • Sign as the accountable official or any officer.
  • Send anything to the DTA or to any system outside Remit, other than the model provider for the call itself and the agency's own ITSM connection for incidents.
  • Change, delete or create a register record, a scope decision, an evidence document or an audit entry.
  • Run without a record: every call is logged with who, what, which model and what came back.

Data handling

Read live from the installation where it can be
AI service on this installation
Configured. Model in use: claude-opus-5-5.
Provider and model
The Anthropic API. The model is set for the whole installation by the platform operator and shown on Admin › AI assistance; at the time this page was rendered it is claude-opus-5-5.
What is sent
Only the text the feature needs, listed feature by feature above: the description or document being triaged, the question and matching evidence passages, the records and document excerpts of an integrity run, or the policy passages of a question. Never the whole database, never credentials, never the AI service key, never another agency's data.
What Remit stores about each call
One AI call record: the feature, its outcome, the person (or 'Remit, automatic'), the agency, the record concerned, the model, a hash and version of the prompt, the citations, the output, the token counts and the estimated cost. A matching audit entry is written. Application code never deletes or edits these rows.
What the model provider keeps
[PLACEHOLDER — operator: state, from your agreement with Anthropic, the data-processing location, the retention period for API inputs and outputs, and confirm that API data is not used to train models under the commercial terms in force.]
Protective marking
Remit sends text at the marking the agency has put into it. Whether OFFICIAL: Sensitive material may be sent to the model is the agency's decision, made when its administrator turns AI assistance on and when its people choose what to upload.
Personal information
Evidence documents and register text can contain personal information. It is sent only within the limits above, only when the agency's switch is on, and it is never used by Remit for any purpose other than the feature the person invoked.

Controls the agency holds

Two switches
AI assistance runs only when the installation has an AI service key and the agency's own switch is on. A new agency starts with its switch off; an agency administrator turns it on or off under Admin › AI assistance with a recorded reason, and the change is in the audit log.
Shown, or explained
Every AI control on every screen is either available or replaced by the reason it is not. Nothing fails silently, and every screen works in full with AI assistance off.
Usage and cost
Admin › Usage and cost shows every call by feature, person and record with its tokens and estimated cost; the estimate is indicative and the provider's invoice is the record.
Monthly cap on automatic runs
An administrator sets a cap in US dollars on the estimated cost of automatic integrity checks; manual runs are never capped.
Service key
The AI service key lives only in the installation's environment with an expiry date beside it. Remit never reads it back to a screen or a log. From 14 days before expiry, administrators are warned on the overview, the Admin AI page and the Platform page.
API keys for agents and systems
Issued by an administrator, shown once, stored hashed, scoped to read or read-and-write, and given an expiry (90 days by default); revocable at any time, and a key stops working on its own once it expires.

Sources

Statement version 1.1 · last updated 25 September 2026. Attach the Word copy to your agency’s record of its decision.

Download as Word