Roles and responsibilities
ORF is a shared operating model. Engineering produces the signals, platform teams make them dependable, operators use them, and accountable owners decide what evidence is necessary.
Core responsibilities
| Role | Accountable for | Typical evidence |
|---|---|---|
| Product owner | Intended use, users, service outcomes, impact, risk acceptance | System profile, scope approval, prioritised gaps |
| Technical owner | Architecture, instrumentation, schema, integration, technical acceptance | Telemetry design, trace samples, tests |
| AI or application engineer | Model, prompt, retrieval, agent, and tool events | Interaction and tool records, evaluation results |
| Platform or SRE | Collection reliability, storage, dashboards, alerts, retention | Pipeline health, SLOs, alert tests |
| Service operations | Triage, escalation, handover, incident response | Runbooks, exercise and incident records |
| Security and privacy | Threat signals, access, integrity, classification, minimisation | Access reviews, privacy tests, audit-trail evidence |
| Risk or governance | Risk tier, permitted waivers, control evidence, periodic review | Approved register, waiver decisions, review minutes |
| Data or evaluation lead | Baselines, datasets, sampling, labels, metric interpretation | Evaluation protocol, dataset card, metric reports |
Lightweight RACI
A = accountable, R = responsible, C = consulted, I = informed.
| Activity | Product | Technical | Platform/operations | Security/privacy | Risk/governance |
|---|---|---|---|---|---|
| Define intended use and boundary | A/R | C | C | C | C |
| Determine risk tier | A | C | I | C | R |
| Select requirements and delivery plan | A | R | C | C | C |
| Decide permitted waivers | C | R | C | C | A |
| Design event and trace model | C | A/R | R | C | I |
| Approve sensitive-content handling | I | R | C | A/R | C |
| Implement and test | I | A/R | R | C | I |
| Operate alerts and runbooks | I | C | A/R | R | I |
| Review operating evidence | A | R | C | C | C |
| Decide residual-risk acceptance | C | C | I | C | A/R |
One person may hold several roles
Small teams do not need separate people for every row. They do need explicit ownership and an independent challenge for consequential risk, waivers, and go-live decisions.
Governance forums
Use existing forums where possible:
- service operations for weekly reliability and incident review;
- change advisory or release review for model, prompt, policy, data, and tool changes;
- security/privacy review for access, leakage, credential, and audit-trail concerns; and
- AI governance or risk oversight for scope, waivers, residual risk, and periodic assurance.
Done when: every selected ORF requirement, dashboard, alert, runbook, waiver, and review has one named accountable owner and a backup or escalation route.
Next: Understand your system