State & Local GovernmentIssue 403 records
State Government
Oklahoma's statewide standard for AI agents, effective since July but newly relevant after Virginia's legislative audit found Virginia's own AI standards silent on agents, sets six autonomy levels, a CIO-run registry for agents that act, mandatory named owners, quarterly reviews and automatic suspension when monitoring lapses. An Oregon state privacy official argues every AI pilot should end with a documented scale, narrow, revise, pause or retire decision owned by a named person. Colorado's first AI architecture director says the central AI team is term-limited and will sunset in three to five years once AI is part of normal IT practice. None of the three reports measured outcomes.
- Evidence records
- 3
- Cross-source patterns
- 1
- Evidence classes
- 2 standards or public-body guidance1 independent reporting
- Outcomes
- 3 emerging
- Source freshness
- 2 new this fortnight1 recent
- Research completed
- 2026-10-18
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
State AI oversight is moving from one-time approval to ongoing review with named decision owners
Interpretation. All three items treat approval as the start of oversight, not the end, and none reports outcomes. Oklahoma's agent standard says agents need continuous oversight rather than point-in-time approval, and requires named owners, a registry, quarterly reviews and suspension when monitoring lapses. An Oregon EIS official argues each pilot should close with a documented decision, a named owner, a review date and someone who can suspend the tool. Colorado's AI team is building infrastructure to evaluate LLM products on an ongoing basis before handing AI to product teams. The open question is capacity: each model adds standing review work that none of the sources costs out.
Operating questionAfter an AI tool or agent is approved, who reviews it, how often, against what evidence, and who can suspend it?
Supporting evidenceOklahoma Office of Management and Enterprise Services, Information Services (state CIO Dan Cronin)Michael Hanna-Butros Meyering, chief privacy and communications officer, Oregon Enterprise Information Services (writing in a personal capacity); published by Government TechnologyColorado Governor's Office of Information Technology (OIT); Jane Yang, principal director of AI architecture; reported by Government Technology
Evidence ledger
Full record · every source keeps its link and limitations
Oklahoma's statewide standard for AI agents sets six autonomy levels, a CIO-run registry for agents that act, named owners, quarterly reviews and mandatory suspension when monitoring lapses
Oklahoma's standard supplements its general AI standard because, it says, agents need continuous oversight of decisions and actions rather than point-in-time approval. The CIO classifies every agent before deployment on a 0-5 scale (observe, recommend, prepare, execute, orchestrate, delegate) based on configured capabilities, not supplier descriptions. Levels 0-2 need agency business-owner sign-off (plus the technical owner at level 2); levels 3-5 also need agency executive leadership and the CIO, documented threat modeling against the OWASP Top 10 for Agentic Applications and MITRE ATLAS, a statewide registry entry, continuous monitoring with automated anomaly detection, and automatic suspension on defined triggers. Approval covers only the documented purpose, autonomy, data, tools and action space; material changes need re-approval. Business, technical and executive owners are mandatory for every agent. Agents may not finalize benefits, permits, payments, hiring or procurement decisions, represent themselves as human, or create other agents without approval. Logs must be tamper-evident, and for benefits, payments or official records detailed enough for an independent third party to replay each consequential action. Agents are reviewed quarterly.
Why it matters, evidence and limitations
- Why it matters
- Why now: Virginia's JLARC report (Oct 13, archived) found VITA's AI standards 'do not refer to agents' or safeguards for autonomous tools, Utah's EO 2026-08 (Oct 6, archived) orders safeguards against rogue AI agents without yet defining them, and 64% of state CIOs in NASCIO's 2026 survey (archived) expect agentic AI to be most impactful. Oklahoma's July standard, not previously archived, is a working example of the controls those states have not written: autonomy tiers, registry, named owners and procurement terms.
- Evidence and measured results
- Opened the 12-page PDF on oklahoma.gov over HTTPS and read it in full, including definitions, the autonomy table, accountability roles, registry, delegation, prompt-injection, data, logging, monitoring, prohibited uses, incident, quarterly review and procurement sections. The revision block states effective date, last revised and last reviewed as 07/30/2026, annual review cycle, approved by CIO Dan Cronin. For the why-now context, reopened Virginia JLARC Report 621 and confirmed its statement that VITA standards do not address agents.
- Limitations and uncertainty
- This is a written standard, not evidence of outcomes; no registry entries, agent counts, incidents or compliance results are published. It dates from July 30, 2026, before recent runs; it is included because current events made it newly relevant (stated above). The document contains duplicated sections (two accountability passages) and some rough drafting, suggesting it may be revised. Whether agencies have the monitoring tooling to meet the continuous-monitoring requirement is not stated.
Oregon EIS privacy chief (GovTech Voices, Oct 15): every public-sector AI pilot should end with a documented decision to scale, narrow, revise, pause or retire, owned by a named person
A state privacy official argues that AI pilots should end with an 'accountable disposition': a documented decision to scale, narrow, revise, pause or retire, naming who owns it, what evidence supports it and what would trigger reconsideration. Before testing, name the person authorized to decide whether the workflow continues, and agree on success criteria, unacceptable outcomes and limits. Measure a faster first draft only alongside final accuracy, verification effort and whether residents understand next steps, since a tool that shifts work from drafting to correcting may be worth less than its demo. Test ambiguous requests, conflicting sources, hand-offs to humans, languages and accessibility; record what remains untested so a narrow trial does not become permission for broad rollout. Count review, training, support and content-upkeep time, not only licenses. Approval should carry a review date, named suspension authority and a fallback service. The author uses a hypothetical county permit assistant and cites the NIST AI RMF 1.0.
Why it matters, evidence and limitations
- Why it matters
- Directly addresses the question states raised in this week's archived StateTech feature (Oct 15) on moving GenAI from pilot to production: what to do when a pilot ends. It gives state agencies a concrete decision record and test plan, from a practitioner inside a state IT agency, at a time when Utah, Virginia and others are writing new oversight requirements.
- Evidence and measured results
- Opened the GovTech article over HTTPS and read it in full; page metadata and byline show Oct 15, 2026. The author bio states his Oregon EIS role, prior Nevada Governor's Technology Office role, and that he writes in a personal capacity and does not represent his employer.
- Limitations and uncertainty
- Opinion and guidance written in a personal capacity; not Oregon policy and not an evaluation. The worked example is hypothetical. No measured results are reported. Its main relevance is as a practitioner checklist.
GovTech (Oct 13): Colorado's first principal director of AI architecture says the central AI team is term-limited, with a planned sunset in three to five years once AI is built into OIT's normal practice
Jane Yang joined Colorado OIT in July as its first principal director of AI architecture, during an OIT realignment to a product-oriented delivery model. OIT's AI directive has three pillars: accelerating delivery, activating opportunities and maintaining transparency. Yang describes 'AI street sense', meaning staff judgment about when and which AI tool to use, transparency about use, and access to secure, governed tools. Colorado plans to open-source much of its AI guidance for other states. The central AI team is term-limited, with a planned sunset in three to five years, after which AI capabilities should be part of OIT's ongoing functions and the team advisory, to avoid a 'permanent bureaucracy around AI.' The team is building practices and infrastructure to evaluate large language model products' effectiveness on an ongoing basis and to judge whether AI meets intended outcomes and returns. New Colorado AI laws (SB 26-189, HB 26-1263, HB 26-1139) take effect in 2027.
Why it matters, evidence and limitations
- Why it matters
- A concrete operating-model choice for state CIOs: a central AI team designed to dissolve into normal IT practice, rather than a permanent AI office. It complements this week's archived coverage of states moving pilots to production and gives buyers a sense of what Colorado will expect: ongoing LLM evaluation, open guidance, and AI embedded in product teams.
- Evidence and measured results
- Opened the GovTech article over HTTPS and read it in full; byline and page metadata show Oct 13, 2026. All statements are Yang's, as reported; no OIT document was opened.
- Limitations and uncertainty
- Interview-based reporting of plans and intentions; no outcomes, budgets, staffing numbers or evaluation results. Published Oct 13, before the Oct 15 and Oct 16 runs, and not archived; included because it bears directly on the pilot-to-production and oversight discussion in this week's sources. The sunset timeline is aspirational.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Standards or public-body guidance
- Normative or advisory guidance from a standards body or public institution.
- Independent reporting
- Independent reporting with attributable sources but without a formal evaluation design.