Strategy and governance
Turn a broad AI mandate into a ranked use-case portfolio, clear decision rights, and an evidence plan tied to mission value and public risk.
Use-case brief · decision map · control registerAI for government that can survive scrutiny.
Soxoa helps public-sector teams turn a mission need into a bounded, inspectable AI decision—then connect strategy, implementation, governance, and training around what the work actually requires.
Policy and procurement are part of the design from the start. Agency officials retain authority for approval, acquisition, risk acceptance, and every consequential decision.
- Strategy
- Governance
- Implementation
- Training
One consulting practice, connected around the mission.
A strategy memo that cannot be implemented is incomplete. A pilot that people cannot govern or operate is incomplete too. Soxoa can join at one point or carry the evidence across the whole decision.
See how we work
Evaluation and implementation
Test credible options on approved work, integrate the narrowest system that clears the gate, and preserve human review, traceability, and an exit path.
Evaluation protocol · pilot record · operating runbookWorkforce training
Prepare leaders, operators, builders, and oversight teams to use approved systems with shared language for data, verification, escalation, and accountability.
Role curriculum · practice lab · facilitator kitStart where the work is bounded and the evidence is visible.
A useful first project is reversible, measurable, and owned. These patterns are starting hypotheses, not pre-approved use cases; the responsible entity determines authority and fit.
| Candidate pattern | What the system may support | What must stay explicit |
|---|---|---|
| Knowledge and service support | Retrieve approved policy or program material and draft a response for staff review. | No invented authority; source citations and a named reviewer remain in the workflow. |
| Document-intensive operations | Classify, extract, compare, or route authorized records with their source attached. | Exceptions, low-confidence fields, and retention requirements follow agency rules. |
| Program analysis and reporting | Summarize approved records, surface patterns, and prepare a traceable first draft. | The system supports analysis; accountable officials make and explain decisions. |
| Internal workforce enablement | Give staff an approved assistant for repeatable research, drafting, or administrative work. | Data rules, acceptable use, verification, and incident escalation are taught before rollout. |
From mission need to a defensible decision.
The work advances through five evidence gates. Each gate can stop the project, narrow it, or define what must be true before the next one begins.
- 01
Frame the mission need
Define the public outcome, accountable owner, affected people, and the decision the work must support.
- 02
Map authority and data
Locate policy, procurement, privacy, security, accessibility, records, and workforce constraints before selecting technology.
- 03
Design the evaluation
Write representative scenarios, failure modes, acceptance criteria, human checkpoints, and evidence-capture requirements.
- 04
Run a bounded pilot
Test on approved historical, redacted, or synthetic material; document results, exceptions, dependencies, and cost drivers.
- 05
Make the decision usable
Deliver a clear proceed, revise, or stop recommendation with the operating controls, training, and handoff needed next.
Typical working records
- Mission and use-case brief
- Decision-rights and stakeholder map
- Evaluation protocol and test set plan
- Risk, control, and exception register
- Requirements package for procurement review
- Pilot report, runbook, and training plan
The operating environment is part of the system.
Public-sector AI has to work inside delegated authority, acquisition rules, existing technology, public obligations, and a workforce that will inherit the result. Treating those as external dependencies is how pilots become dead ends.
- Authority
- Agency policy owners and counsel determine what is permitted. The project records the answer; it does not manufacture one.
- Acquisition
- Procurement officials choose the acquisition path. Soxoa can prepare technical requirements and evaluation evidence for their review.
- Data and security
- Approved environments, access, retention, logging, model use, and incident handling are defined before sensitive work enters a test.
- Accessibility and records
- Public access, disclosure, retention, explainability, and appeal obligations are treated as workflow requirements, not launch-day cleanup.
- Operations
- A named owner, review queue, fallback process, change log, and exit plan keep the system governable after a pilot ends.
- Workforce
- Role-specific training covers permitted use, limits, verification, escalation, and how staff report unexpected behavior.
Reference the current rulebook.
These official sources inform discovery questions, evaluation design, and evidence planning. The exact authorities that apply depend on the entity, system, data, use case, and acquisition path.
OMB Memorandum M-25-21
Federal direction for agency AI use, innovation, governance, inventories, and public trust.
OMB Memorandum M-25-22
Federal direction for acquiring AI with competition, performance, data, portability, and risk considerations in view.
OMB Memorandum M-26-04
Additional federal principles and implementation guidance for agency procurement and use of large language models.
NIST AI RMF and Generative AI Profile
Voluntary references for governing, mapping, measuring, and managing AI risk. NIST notes that AI RMF 1.0 is under revision.
Read the Generative AI ProfileState Administrative Manual § 4986.9
California policy for state-entity GenAI procurement, disclosure, assessment, and related acquisition requirements.
State Administrative Manual § 4986.13
California policy for GenAI workforce training within executive-branch state entities.
Frameworks and memoranda are reference points, not a certification. Agency policy owners, counsel, security, privacy, accessibility, procurement, records, and other responsible officials remain the authoritative reviewers.
A productive start has an owner and an edge.
The right first conversation is specific enough to examine and early enough to shape. A mandate to “do AI” can become useful once someone can name the mission need, the accountable people, and the constraints that cannot move.
Good conditions for a first engagement
- A mission or service problem with an accountable owner
- Access to policy owners and operational subject-matter experts
- Approved examples or a path to synthetic test material
- A willingness to define failure and stop conditions in advance
- A real human review and escalation path
What Soxoa does not promise
- Agency past performance, a contract vehicle, or procurement status not stated in writing
- Legal advice, audit opinions, FedRAMP authorization, or certification of compliance
- A shortcut around security, privacy, accessibility, records, labor, or procurement review
- Autonomous high-impact decisions or a risk-free AI system
- Guaranteed savings, adoption, accuracy, or policy approval
Questions public-sector teams ask early.
Plain boundaries make it easier to decide whether a working session is worth scheduling.
What is a sensible first public-sector AI project?
Usually one bounded, reversible workflow with a named owner, approved sample material, observable failure modes, and a human who can review every consequential output. The first question is whether the use case belongs in AI at all—not which model to buy.
Can Soxoa work within our procurement process?
Soxoa can help define technical requirements, evaluation scenarios, evidence expectations, and implementation boundaries for your procurement team to review. Your contracting and procurement officials determine the authorized path, and any engagement remains subject to applicable registration, onboarding, and award requirements.
Does this make an agency NIST, FedRAMP, or policy compliant?
No. Soxoa can map a project to relevant requirements, document controls, and prepare evidence for the agency's reviewers. We do not provide legal advice, conduct a certification audit, confer FedRAMP authorization, or replace an agency's security, privacy, procurement, accessibility, or legal authorities.
How do you handle sensitive or protected data?
Data classification, authorization, environment, access, retention, and logging are established before testing. Early evaluation can often use approved historical, redacted, or synthetic material. Live sensitive data does not enter a workflow merely because a tool supports it.
Is training part of the implementation?
It can be. Public-sector adoption works best when leaders, operators, technical staff, and oversight functions understand different responsibilities. Training can be scoped with a pilot or delivered as a separate role-based program tied to the entity's approved tools and policies.
Do you automate public-benefit or enforcement decisions?
Soxoa does not position autonomous high-impact decision making as a first project. Any work touching rights, benefits, safety, enforcement, eligibility, or similarly consequential outcomes requires heightened authority, impact review, human accountability, and appeal or recourse design determined by the public entity.
Bring the mission need. We will help make the decision inspectable.
A 30-minute conversation is enough to identify the responsible owner, the authority questions, the evidence available, and whether there is a sensible next step.