Build a review packet, not a records engine.
Document Management Specialists administer systems and procedures that capture, store, retrieve, share, and destroy electronic documents and records.1 That scope makes provenance useful, but also makes silent inference risky. A safe AI workflow prepares a labeled packet from fictional or organization-approved minimum-necessary text. A named human decides every record, source, retention, access, and system question.
needs_review.Set the boundary before any AI work.
Give the packet a fictional or approved scenario label, purpose, and authority owner. Exclude live document bodies, repository exports, personal or confidential data, legal-hold material, schedules, credentials, and system identifiers.
Register what is known without selecting a winner.
For each label, record the stated source, owner, date/version, intended use, and status:
approved,unknown, orconflicting. Never ask the model to decide which version controls.Ask AI to organize, not retrieve or classify.
AI may format the register, find missing fields in the supplied labels, group duplicate labels, and draft neutral questions. It must not connect to a repository, search unapproved content, infer a classification, or create metadata.
Turn gaps into reviewer questions.
For every missing owner, dated version, access condition, retention rule, hold, or approval, preserve the gap as
unknown. Ask a named authority which current approved rule applies.Route authority to the right owner.
Records/information governance owns record and retention questions; business/data owners own purpose; legal owns hold and legal questions; privacy/security owns permitted handling; system owners own access and configuration.
Stop at the handoff.
Issue a local
needs_reviewreceipt. Do not open a system, change a record, publish, share, delete, destroy, transfer, sign, or communicate.
Three bounded roles. One human control point.
unknown or conflicting. No record, retention, or authority conclusion.NIST’s Generative AI Profile is voluntary, cross-sector risk guidance. Use it as a governance lens, not as a records policy or approval.5
Let AI prepare evidence. Let authority control records.
| AI may prepare | Named human approval is required |
|---|---|
| Format labels supplied in the approved scope. | Access, search, retrieve, or upload from a repository. |
| Preserve source, owner, version/date, stated use, and unknown/conflict labels. | Select a source of truth, determine record status, classify, or set retention/disposition. |
| Draft neutral questions about missing authority or conflicting labels. | Place/release a hold; delete, destroy, transfer, publish, sign, disclose, or share. |
| Produce a local review-only receipt. | Change metadata, permission, system configuration, vendor/tool status, or any external record. |
Five ways document control quietly turns into unauthorized control.
| Mistake | Why it fails | Repair |
|---|---|---|
| “Use the newest file.” | Newest is not necessarily approved, authoritative, or applicable. | Preserve dates and versions; ask the owner which source controls. |
| “Classify this for me.” | Classification can create records, legal, access, or retention consequences. | Record the question and route it to the authorized records owner. |
| “Clean up this folder.” | Moving, deleting, or renaming can alter evidence, access, or disposition. | Use a fictional label register; obtain separately scoped system approval for any implementation. |
| “The policy says keep it seven years.” | The policy may be stale, noncontrolling, contextual, or subject to a hold. | Label the rule/source/version unknown until an authorized reviewer confirms it. |
| “Send the final version.” | Sharing or publishing can be an external action with privacy, contract, or legal effects. | Stop at a local review receipt; human owners approve content, audience, and channel. |
Document Control Evidence Desk
Enter only fictional or organization-approved, minimum-necessary labels. This form stays in the browser and creates a review-only receipt; it does not send or save anything.
What this manual is built on.
- O*NET OnLine: Document Management SpecialistsOccupational context; profile marked updated 2026. [1]
- National Archives: Records Management Guidance for Federal EmployeesFederal records context and the role of agency instructions, file plans, schedules, and records officers. [2]
- National Archives: Universal Electronic Records Management RequirementsFederal lifecycle-oriented requirements and tailoring context. [3]
- National Archives: Records Management Regulations and GuidanceCurrent federal guidance index, reviewed 2026-05-01. [4]
- NIST AI 600-1: Generative AI ProfileVoluntary, cross-sector AI-risk context; publication page updated 2026-04-08. [5]
Sources are evidence context, not permission to use private material or take records/system action. Recheck them and the controlling organization rules before any non-fictional use.
Where this guide fits.
Proposed links: the Data Warehousing Specialist Evidence Desk for data-provenance work, the Database Administrator Change Evidence Desk for controlled database changes, the Web Administrator Operations Manual for site operations, and the Occupation AI Workflow Guide Directory for the broader shelf. Use these related guides to keep each workflow's authority boundary clear.