<?xml version="1.0" encoding="utf-8"?>
<?xml-model href="rfc7991bis.rnc"?>
<rfc
  category="info"
  docName="draft-veridom-omp-employ-00"
  ipr="trust200902"
  obsoletes=""
  updates=""
  submissionType="independent"
  xml:lang="en"
  tocInclude="true"
  tocDepth="3"
  symRefs="true"
  sortRefs="true"
  version="3">

  <front>
    <title abbrev="OMP Employment ADS Profile">
      OMP Domain Profile: Automated Decision Systems Accountability in
      Employment Under California FEHC CRC Regulations, New York City
      Local Law 144, and Related ADS Accountability Obligations
    </title>
    <seriesInfo name="Internet-Draft" value="draft-veridom-omp-employ-00"/>

    <author fullname="Tolulope Adebayo" initials="T." surname="Adebayo">
      <organization>Veridom Ltd</organization>
      <address>
        <postal><city>London</city><country>United Kingdom</country></postal>
        <email>tolulope@veridom.io</email>
      </address>
    </author>
    <author fullname="Oluropo Apalowo" initials="O." surname="Apalowo">
      <organization>Veridom Ltd</organization>
      <address>
        <postal><city>Awka</city><country>Nigeria</country></postal>
        <email>ropo@veridom.io</email>
      </address>
    </author>
    <author fullname="Festus Makanjuola" initials="F." surname="Makanjuola">
      <organization>Veridom Ltd</organization>
      <address>
        <postal><city>Toronto</city><country>Canada</country></postal>
        <email>festus@veridom.io</email>
      </address>
    </author>

    <date year="2026" month="April" day="5"/>
    <area>Security</area>
    <workgroup>Internet Engineering Task Force</workgroup>

    <keyword>automated decision systems</keyword>
    <keyword>employment AI</keyword>
    <keyword>California CRC regulations</keyword>
    <keyword>NYC Local Law 144</keyword>
    <keyword>bias audit</keyword>
    <keyword>disparate impact</keyword>
    <keyword>AEDT</keyword>
    <keyword>audit trail</keyword>
    <keyword>tamper-evident</keyword>
    <keyword>operating model protocol</keyword>
    <keyword>four-year retention</keyword>

    <abstract>
      <t>
        This document defines a domain profile of the Operating Model Protocol (OMP)
        for automated decision systems (ADS) deployed in employment contexts subject to
        the California Civil Rights Council (CRC) Employment Regulations on Automated
        Decision Systems (effective October 1, 2025), New York City Local Law 144 (bias
        audit requirement for automated employment decision tools), the Illinois
        Artificial Intelligence Video Interview Act (AIVIA), and related US state and
        municipal ADS accountability obligations in employment.
      </t>
      <t>
        The profile -- designated WorkMark -- specifies how OMP's deterministic routing
        invariant, Watchtower enforcement framework, and three-layer cryptographic integrity
        architecture satisfy the record-retention, named accountability, bias audit evidence,
        and per-decision auditability requirements applicable to employment ADS deployments.
        The profile directly addresses the California CRC requirement to retain ADS inputs,
        outputs, decision criteria, and audit results for four years with named accountability
        for AI-assisted hiring and employment decisions.
      </t>
      <t>The OMP core specification is defined in the Operating Model Protocol Internet-Draft (draft-veridom-omp).</t>
    </abstract>
  </front>

  <middle>

    <section anchor="introduction" numbered="true" toc="default">
      <name>Introduction</name>
      <t>
        Automated decision systems are now embedded across the employment lifecycle: in
        resume screening, candidate ranking, video interview analysis, skills assessment
        scoring, promotion modelling, workforce planning, and termination risk prediction.
        These systems affect the economic circumstances of individuals at scale, and the
        regulatory frameworks governing their use are now moving from guidance to
        enforceable obligation.
      </t>
      <t>
        Three instruments have crystallised the per-decision accountability requirements
        for employment ADS with sufficient precision to support technical specification:
      </t>
      <ul spacing="normal">
        <li>
          The California CRC Employment Regulations on Automated Decision Systems
          (effective October 1, 2025) require employers to retain, for a minimum of four
          years from each employment decision, the inputs, outputs, decision criteria,
          audit results, and named human decision-maker for each ADS-assisted Covered
          Employment Decision.
        </li>
        <li>
          New York City Local Law 144 (in force) requires employers and employment agencies
          using automated employment decision tools (AEDTs) in hiring or promotion decisions
          to conduct annual independent bias audits, publish results, and notify candidates
          when an AEDT was used.
        </li>
        <li>
          The Illinois Artificial Intelligence Video Interview Act (AIVIA) requires
          employers using AI to analyse video interviews to inform candidates, obtain
          consent, limit data sharing, and retain the video and its AI analysis.
        </li>
      </ul>
      <t>
        These instruments converge on a structural evidence requirement that maps directly
        onto OMP <xref target="I-D.veridom-omp"/>: every ADS-assisted employment decision
        must generate a per-decision record documenting what the ADS recommended, what data
        it used, how the recommendation was weighted, and who was accountable for the final
        decision -- retained for a minimum of four years and independently verifiable by
        regulators, candidates, and auditors.
      </t>
      <t>
        This document defines the WorkMark profile: the domain-specific instantiation of
        OMP for employment ADS accountability. WorkMark denotes that every AI-assisted
        employment decision is cryptographically marked against the employer's ADS
        accountability obligations, producing a tamper-evident record that satisfies
        California CRC four-year retention requirements, NYC Local Law 144 bias audit
        evidence standards, and AIVIA documentation obligations through a single evidence
        architecture.
      </t>
      <t>
        Related OMP domain profiles include the Clinical AI profile
        <xref target="I-D.veridom-omp-clinical"/> and the EU AI Act Article 12 profile
        <xref target="I-D.veridom-omp-euaia"/>.  Audit Trace payloads are canonicalized
        per <xref target="RFC8785"/>.  The OMP specification is also archived at
        <xref target="ZENODO-OMP"/>.
      </t>
      <t>
        The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD",
        "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be
        interpreted as described in <xref target="RFC2119"/> <xref target="RFC8174"/>.
      </t>
    </section>

    <section anchor="terminology" numbered="true" toc="default">
      <name>Terminology</name>
      <t>This document uses the terminology defined in <xref target="I-D.veridom-omp"/>. In addition:</t>
      <ul spacing="normal">
          <li>Automated Decision System (ADS): A computational system that uses machine learning, statistical modelling, data
        analytics, or artificial intelligence to generate a score, classification,
        recommendation, or other output that influences or replaces human decision-making
        in an employment context.</li>
          <li>Covered Employment Decision: An employment decision in which an ADS or AEDT was used to screen, rank, score,
        or otherwise influence the outcome. Subject to the WorkMark Invariant.</li>
          <li>Employment Decision Authority (EDA): The human decision-maker responsible for the final employment decision where an
        ADS was used. In OMP terms, the Named Accountable Officer for ASSISTED and ESCALATED
        interactions under this profile.</li>
          <li>Bias Audit: An impartial evaluation, conducted by an independent auditor, of an AEDT to
        assess whether its outputs exhibit disparate impact across race, sex, or
        intersectional categories, as required by NYC Local Law 144.</li>
          <li>Four-Year Retention Period: The minimum period for which Covered Employment Decision records must be retained
        under California CRC Regulations, measured from the date of the employment decision.</li>
          <li>Disparate Impact Flag: A field in the WorkMark Audit Trace indicating that the ADS output for this
        interaction falls within a demographic category or score band that the employer's
        most recent bias audit identified as exhibiting selection rate disparity above the
        adverse impact threshold.</li>
          <li>WorkMark Invariant: The two-property invariant defined in <xref target="workmark-invariant"/>:
        every Covered Employment Decision generates a sealed WorkMark Audit Trace retained
        for the Four-Year Retention Period, independently verifiable by regulators,
        candidates, and auditors.</li>
        </ul>
    </section>

    <section anchor="employ-framework" numbered="true" toc="default">
      <name>Employment ADS Regulatory Framework Analysis</name>

      <section anchor="ca-crc" numbered="true" toc="default">
        <name>California CRC Automated Decision Systems Regulations</name>
        <t>
          The California CRC Employment Regulations <xref target="CA-CRC-ADS"/> (effective October 1, 2025) require
          employers to retain for four years: ADS inputs (candidate data, job requirements,
          scoring criteria); ADS output (score, ranking, classification, recommendation);
          decision criteria applied; weight given to ADS output in the final decision;
          applicable bias audit results; and the identity of the human decision-maker who
          made or approved the final decision. Records must be producible to the California
          Civil Rights Department (CRD) upon request.
        </t>
      </section>

      <section anchor="nyc-ll144" numbered="true" toc="default">
        <name>New York City Local Law 144</name>
        <t>
          NYC Local Law 144 <xref target="NYC-LL144"/> requires annual independent bias audits of AEDTs used in hiring
          or promotion decisions affecting NYC candidates, assessing selection rate disparities
          across race/ethnicity, sex, and intersectional categories. Results must be publicly
          disclosed. Candidates must receive at least ten business days' advance notice that
          an AEDT will be used. The NYC Local Law 144 bias audit requirement creates the
          integration point with Section 7 (Bias Audit Evidence Package) of this profile.
        </t>
      </section>

      <section anchor="il-aivia" numbered="true" toc="default">
        <name>Illinois Artificial Intelligence Video Interview Act</name>
        <t>
          The Illinois AIVIA <xref target="IL-AIVIA"/> requires employers using AI to analyse video interviews to inform
          candidates in writing, explain how the AI works, obtain candidate consent, limit
          sharing of video and AI analysis data to persons necessary for the hiring decision,
          and retain the video and AI analysis for a minimum period. WT-EMPLOY-06 (AIVIA
          Consent Gate) gives the consent requirement structural enforcement.
        </t>
      </section>

      <section anchor="federal-context" numbered="true" toc="default">
        <name>Federal Context: EEOC AI Guidance and Title VII</name>
        <t>
          The EEOC <xref target="EEOC-AI-2023"/> "Use of Artificial Intelligence in Employment Decisions" guidance (2023)
          states that employers cannot avoid Title VII liability by attributing discriminatory
          outcomes to an AI vendor. This reinforces the named accountability requirement in
          the WorkMark profile: the Employment Decision Authority, not the AI vendor, is the
          Named Accountable Officer. The WorkMark Audit Trace documents the employer's
          accountability for ADS outcomes, consistent with the EEOC's position.
        </t>
      </section>

      <section anchor="colorado-ai" numbered="true" toc="default">
        <name>Colorado AI Act Employment Provisions</name>
        <t>
          Colorado's Artificial Intelligence Act (effective June 1, 2026) requires deployers
          of high-risk AI in employment decisions to maintain risk management programmes,
          provide applicant disclosures, and implement discrimination mitigation measures.
          The WorkMark profile's Disparate Impact Flag and Bias Audit Evidence Package
          address the Colorado Act's discrimination mitigation evidence requirements.
        </t>
      </section>

      <section anchor="convergent" numbered="true" toc="default">
        <name>Convergent Requirements</name>
        <t>
          California CRC, NYC Local Law 144, Illinois AIVIA, EEOC guidance, and Colorado AI
          Act <xref target="CO-AI-ACT"/> define an evidence structure that maps directly onto OMP's three routing states:
          ADS-assisted decisions where the EDA reviewed, applied independent judgment, and
          documented the basis correspond to ASSISTED; decisions where a Disparate Impact Flag
          was triggered or the candidate invoked human review rights correspond to ESCALATED;
          fully autonomous ADS employment decisions are NOT PERMITTED for Covered Employment
          Decisions under this profile.
        </t>
      </section>
    </section>

    <section anchor="workmark-profile" numbered="true" toc="default">
      <name>OMP WorkMark Profile</name>

      <section anchor="routing-states" numbered="true" toc="default">
        <name>Routing States Under This Profile</name>
        <ul spacing="normal">
          <li>AUTONOMOUS: NOT PERMITTED for Covered Employment Decisions. WT-EMPLOY-01 MUST be
          configured as a universal FORCE_ASSISTED trigger for all Covered Employment
          Decisions. AUTONOMOUS routing is permitted only for administrative or pre-screening
          functions that do not substantially influence an employment outcome (e.g., document
          format validation, scheduling coordination, initial completeness screening without
          candidate ranking). Operators MUST maintain a written classification of which
          interaction types are non-Covered (AUTONOMOUS eligible) versus Covered Employment
          Decisions, reviewed annually and producible to the CRD upon request.</li>
          <li>ASSISTED: The standard routing state for Covered Employment Decisions. The ADS generates
          a recommendation, score, ranking, or classification; the Employment Decision
          Authority reviews, applies independent human judgment, and documents the basis
          for the final employment decision. The EDA's identity, review timestamp,
          independent judgment basis, and final decision are sealed in the WorkMark
          Audit Trace.</li>
          <li>ESCALATED: Triggered by: Disparate Impact Flag on ADS output (WT-EMPLOY-03); candidate
          invocation of human review right (WT-EMPLOY-04); ADS confidence failure
          (WT-EMPLOY-02); or bias audit threshold alert (WT-EMPLOY-05). Under ESCALATED
          routing, the final employment decision MUST be made by the EDA without reliance
          on the ADS recommendation.</li>
        </ul>
      </section>

      <section anchor="eda" numbered="true" toc="default">
        <name>Named Accountable Officer: The Employment Decision Authority</name>
        <t>
          The Named Accountable Officer under this profile is the Employment Decision
          Authority: the individual who makes or approves the final employment decision.
          For California CRC compliance, the EDA is the individual whose identity is
          required in the four-year retention record. For EEOC Title VII purposes, the
          EDA is the employer representative whose decisions are attributable to the employer.
        </t>
        <t>Required fields in the EDA record:</t>
        <ul spacing="normal">
          <li><tt>eda_employee_id</tt>: stable identifier, consistent throughout the Four-Year Retention Period;</li>
          <li><tt>eda_role</tt>: role in the decision process (e.g., "hiring_manager", "HR_business_partner");</li>
          <li><tt>eda_review_timestamp</tt>: ISO 8601 UTC of the EDA's review and decision;</li>
          <li><tt>eda_decision</tt>: one of PROCEED_WITH_ADS_RECOMMENDATION, PROCEED_MODIFIED, OVERRIDE, REJECT_CANDIDATE, ADVANCE_CANDIDATE;</li>
          <li><tt>eda_independent_basis</tt>: REQUIRED for PROCEED_MODIFIED and OVERRIDE; documents independent judgment and weight given to ADS recommendation.</li>
        </ul>
      </section>

      <section anchor="watchtowers" numbered="true" toc="default">
        <name>Watchtower Definitions</name>

        <section anchor="wt-employ-01" numbered="true" toc="default">
          <name>WT-EMPLOY-01: Employment Decision Authority Gate</name>
          <t><strong>Trigger:</strong> Any interaction classified as a Covered Employment Decision.</t>
          <t><strong>Action:</strong> FORCE_ASSISTED. Cannot be disabled for Covered Employment Decisions.</t>
          <t><strong>Rationale:</strong> California CRC Regulations require named accountability for ADS-assisted employment decisions. EEOC guidance requires employers to maintain responsibility for employment decision outcomes. This Watchtower makes it architecturally impossible for a Covered Employment Decision to be finalised without generating an EDA review record.</t>
        </section>

        <section anchor="wt-employ-02" numbered="true" toc="default">
          <name>WT-EMPLOY-02: ADS Confidence Floor Gate</name>
          <t><strong>Trigger:</strong> Composite Confidence Score falls below the employer's configured employment decision floor.</t>
          <t><strong>Action:</strong> FORCE_ESCALATED. EDA makes the final decision without reliance on the ADS recommendation. ADS output MAY be provided as context, clearly labelled as below the employment decision confidence floor.</t>
          <t><strong>Rationale:</strong> An ADS recommendation below the employment decision floor represents insufficient confidence to influence the employment outcome. ESCALATED routing ensures the EDA exercises independent judgment.</t>
        </section>

        <section anchor="wt-employ-03" numbered="true" toc="default">
          <name>WT-EMPLOY-03: Disparate Impact Flag Gate</name>
          <t><strong>Trigger:</strong> ADS recommendation, score, or ranking for this candidate falls within a demographic category or score band that the employer's most recent bias audit identified as exhibiting adverse impact (selection rate below 80% of the highest-rate group, the four-fifths rule).</t>
          <t><strong>Action:</strong> FORCE_ESCALATED. EDA reviews with specific awareness of the disparate impact concern. disparate_impact_flag set to true. EDA decision and independent basis are REQUIRED.</t>
          <t><strong>Rationale:</strong> NYC Local Law 144 and California CRC Regulations require employers to assess and document disparate impact in ADS employment decisions. ESCALATED routing ensures decisions in known adverse impact zones are made by a human with full awareness of the bias concern, documented in the Audit Trace for bias audit purposes.</t>
        </section>

        <section anchor="wt-employ-04" numbered="true" toc="default">
          <name>WT-EMPLOY-04: Candidate Human Review Request Gate</name>
          <t><strong>Trigger:</strong> A candidate has invoked their right to human review of an ADS-assisted decision under applicable law or employer policy.</t>
          <t><strong>Action:</strong> FORCE_ESCALATED. Candidate's request documented in WorkMark Audit Trace. EDA conducts and documents a human review.</t>
          <t><strong>Rationale:</strong> Colorado's AI Act and emerging state frameworks provide candidates the right to request human review of consequential AI decisions. This Watchtower ensures candidate-invoked human review generates a sealed record of the review and its outcome.</t>
        </section>

        <section anchor="wt-employ-05" numbered="true" toc="default">
          <name>WT-EMPLOY-05: Bias Audit Threshold Alert Gate</name>
          <t><strong>Trigger:</strong> Aggregate selection rate for a protected class in the ongoing WorkMark Audit Trace stream reaches the employer's configured pre-adverse-impact alert threshold -- firing before the four-fifths rule threshold is breached.</t>
          <t><strong>Action:</strong> FORCE_ASSISTED for all new interactions in the affected demographic category, pending review by the employer's bias audit authority. A bias audit alert record is generated.</t>
          <t><strong>Rationale:</strong> NYC Local Law 144 requires annual bias audits. WT-EMPLOY-05 provides continuous monitoring enabling employers to address emerging disparate impact before it becomes a documented violation.</t>
        </section>

        <section anchor="wt-employ-06" numbered="true" toc="default">
          <name>WT-EMPLOY-06: AIVIA Consent Gate</name>
          <t><strong>Trigger:</strong> For video interview AI deployments subject to Illinois AIVIA: candidate has not provided documented consent to AI video analysis, or consent record is missing or invalid.</t>
          <t><strong>Action:</strong> HARD_BLOCK. AI video analysis MUST NOT proceed without valid candidate consent.</t>
          <t><strong>Rationale:</strong> Illinois AIVIA requires employers to obtain candidate consent before using AI to analyse video interviews. HARD_BLOCK ensures consent cannot be bypassed through system error or process failure.</t>
        </section>
      </section>

      <section anchor="schema-extensions" numbered="true" toc="default">
        <name>Audit Trace Schema Extensions</name>
        <t>The following fields are REQUIRED under the WorkMark profile, in addition to core fields in <xref target="I-D.veridom-omp"/> Section 7:</t>
        <ul spacing="normal">
          <li><tt>eda_employee_id</tt>: string, REQUIRED for Covered Employment Decisions. Stable identifier consistent throughout the Four-Year Retention Period.</li>
          <li><tt>eda_role</tt>: string, REQUIRED.</li>
          <li><tt>eda_review_timestamp</tt>: string, ISO 8601 UTC, REQUIRED for ASSISTED and ESCALATED.</li>
          <li><tt>eda_decision</tt>: string, REQUIRED for ASSISTED and ESCALATED. One of: PROCEED_WITH_ADS_RECOMMENDATION, PROCEED_MODIFIED, OVERRIDE, REJECT_CANDIDATE, ADVANCE_CANDIDATE.</li>
          <li><tt>eda_independent_basis</tt>: string, OPTIONAL for PROCEED_WITH_ADS_RECOMMENDATION; REQUIRED for PROCEED_MODIFIED and OVERRIDE. Documents independent judgment and weight given to the ADS recommendation, satisfying the California CRC decision criteria documentation requirement.</li>
          <li><tt>ads_output_record</tt>: object, REQUIRED. MUST contain: output_type ("score", "ranking", "classification", or "recommendation"); output_value; output_timestamp (ISO 8601 UTC); ads_system_id; ads_version.</li>
          <li><tt>candidate_demographic_category</tt>: string, REQUIRED if lawfully collected; otherwise "not_collected". Used for bias audit assessment only.</li>
          <li><tt>disparate_impact_flag</tt>: boolean, REQUIRED. True if WT-EMPLOY-03 triggered.</li>
          <li><tt>bias_audit_reference</tt>: string, REQUIRED. Identifier of the most recent bias audit applicable at the time of the decision. For NYC Local Law 144, must reference an audit by an independent auditor within the preceding 12 months.</li>
          <li><tt>candidate_human_review_requested</tt>: boolean, REQUIRED. True if WT-EMPLOY-04 triggered.</li>
          <li><tt>employment_decision_category</tt>: string, REQUIRED. One of: "initial_screening", "interview_scoring", "promotion", "adverse_action", "compensation", "termination".</li>
          <li><tt>aivia_consent_obtained</tt>: boolean, REQUIRED for video interview AI deployments subject to Illinois AIVIA.</li>
          <li><tt>four_year_retention_expiry</tt>: string, ISO 8601 date, REQUIRED. Calculated as four years from eda_review_timestamp date. Implementations MUST enforce retention until this date.</li>
          <li><tt>profile_version</tt>: string, REQUIRED. MUST be "VERIDOM-WORKMARK-v1.0".</li>
        </ul>
      </section>
    </section>

    <section anchor="retention-architecture" numbered="true" toc="default">
      <name>Four-Year Retention Architecture</name>
      <t>
        The California CRC Regulations require employers to retain Covered Employment Decision
        records for a minimum of four years. The WorkMark profile implements this through:
        per-decision retention with a four_year_retention_expiry date enforced at generation;
        chain integrity across the retention period enabling regulators and auditors to verify
        that the complete set of WorkMark Audit Traces has been retained without deletion or
        modification (a chain gap is detectable as a chain integrity violation); regulator
        accessibility within the four-year period within 30 seconds via the Proof-Point
        generation mechanism; and retention across system migrations, with a sealed migration
        event record documenting the transition and preserving chain integrity.
      </t>
    </section>

    <section anchor="bias-audit-package" numbered="true" toc="default">
      <name>Bias Audit Evidence Package</name>
      <t>
        The WorkMark profile generates two types of bias audit evidence: per-decision
        evidence (each Audit Trace contains the candidate_demographic_category,
        disparate_impact_flag, and bias_audit_reference fields) and aggregate evidence (the
        Audit Trace stream can be aggregated to compute the selection rates and adverse impact
        ratios required by NYC Local Law 144 annual bias audit methodology from an
        independently verifiable basis).
      </t>
      <t>
        The Bias Audit Evidence Package, produced using the OMP Proof-Point artefact mechanism
        for a defined employment period, MUST contain: all sealed WorkMark Audit Traces
        for the period organised by employment_decision_category and ADS system; aggregate
        selection rate data by candidate_demographic_category; disparate impact ratio
        calculations for each demographic category and score band; count and disposition of
        WT-EMPLOY-03 Disparate Impact Flag triggers; count and disposition of WT-EMPLOY-04
        Candidate Human Review Request triggers; chain integrity proof (SHA-256 Merkle root);
        and RFC 3161 <xref target="RFC3161"/> TimeStampToken verification from the OMP Reference Validator
        <xref target="OMP-OPEN-CORE"/>.
      </t>
      <t>
        An independent bias auditor conducting an NYC Local Law 144 annual audit can use
        the Bias Audit Evidence Package as the primary evidentiary basis, verifying
        completeness and integrity without relying on the employer's self-reported statistics.
      </t>
    </section>

    <section anchor="workmark-invariant" numbered="true" toc="default">
      <name>The WorkMark Invariant</name>
      <t>Implementations of this profile MUST satisfy the following two-property invariant:</t>
      <ul spacing="normal">
          <li>Property 1 (Employment decision accountability completeness): Every Covered Employment Decision MUST generate a sealed WorkMark Audit Trace
        containing: the ADS output record; the EDA's identity and review timestamp; the
        EDA's decision and independent basis where required; the Disparate Impact Flag
        evaluation; and the applicable bias audit reference. The Audit Trace MUST be
        retained for the Four-Year Retention Period.</li>
          <li>Property 2 (Immutable trail): The WorkMark Audit Trace MUST be sealed with the three-layer integrity
        architecture defined in <xref target="I-D.veridom-omp"/> Section 7. Any
        modification to any historical Audit Trace record MUST be detectable by any
        third party -- including the California CRD, the NYC Commission on Human Rights,
        a bias auditor, or a court -- without access to the employer's or OMP implementer's
        infrastructure.</li>
        </ul>
      <t>
        An employer satisfying the WorkMark Invariant can demonstrate, for any Covered
        Employment Decision within the Four-Year Retention Period: the ADS output generated
        for the candidate; the EDA's identity and review timestamp; the EDA's final decision
        and independent basis for any departure from the ADS recommendation; the Disparate
        Impact Flag status with reference to the applicable bias audit; whether the candidate
        invoked human review; the applicable bias audit; and that the record has not been
        altered since sealing. This satisfies every element of a California CRC compliance
        examination, NYC Local Law 144 bias audit, EEOC Title VII investigation, and Colorado
        AI Act disparate impact assessment.
      </t>
    </section>

    <section anchor="security" numbered="true" toc="default">
      <name>Security Considerations</name>
      <t>The security considerations of <xref target="I-D.veridom-omp"/> apply in full.</t>
      <t>
        Candidate data sensitivity: WorkMark Audit Traces contain candidate PII and, where
        collected, demographic data. Operators MUST restrict access to individuals with
        a legitimate need in the employment decision process, HR governance, or bias audit
        function. Demographic data fields MUST have additional access controls consistent
        with applicable employment discrimination law.
      </t>
      <t>
        EDA identity integrity: eda_employee_id MUST reflect the actual individual who made
        or approved the final employment decision. Operators MUST implement technical controls
        to prevent EDA identity assignment without the relevant individual's authenticated
        action.
      </t>
      <t>
        Bias audit data integrity: the WorkMark Audit Trace stream is the evidentiary basis
        for the annual bias audit. The chain integrity architecture makes selective deletion
        detectable: a chain gap will be identified as a chain integrity violation in the
        Bias Audit Evidence Package.
      </t>
      <t>
        Demographic data segregation: where candidate demographic data is collected for bias
        audit purposes, it MUST be segregated from the ADS input data used in employment
        decisions, consistent with applicable employment discrimination law restricting the
        use of protected characteristics in employment decisions.
      </t>
    </section>

    <section anchor="iana" numbered="true" toc="default">
      <name>IANA Considerations</name>
      <t>This document has no IANA actions.</t>
    </section>

  </middle>

  <back>
    <references>
      <name>References</name>
      <references>
        <name>Normative References</name>

        <reference anchor="I-D.veridom-omp">
          <front>
            <title>Operating Model Protocol (OMP): A Deterministic Decision-Enforcement Protocol with Externalized Proof-of-Integrity</title>
            <author initials="T." surname="Adebayo" fullname="Tolulope Adebayo"/>
            <author initials="O." surname="Apalowo" fullname="Oluropo Apalowo"/>
            <author initials="F." surname="Makanjuola" fullname="Festus Makanjuola"/>
            <date year="2026" month="March"/>
          </front>
          <seriesInfo name="Internet-Draft" value="draft-veridom-omp-00"/>
        </reference>

        <reference anchor="RFC2119" target="https://www.rfc-editor.org/info/rfc2119">
          <front>
            <title>Key words for use in RFCs to Indicate Requirement Levels</title>
            <author initials="S." surname="Bradner" fullname="S. Bradner"/>
            <date year="1997" month="March"/>
          </front>
          <seriesInfo name="BCP" value="14"/>
          <seriesInfo name="RFC" value="2119"/>
        </reference>

        <reference anchor="RFC8174" target="https://www.rfc-editor.org/info/rfc8174">
          <front>
            <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
            <author initials="B." surname="Leiba" fullname="B. Leiba"/>
            <date year="2017" month="May"/>
          </front>
          <seriesInfo name="BCP" value="14"/>
          <seriesInfo name="RFC" value="8174"/>
        </reference>

        <reference anchor="RFC3161" target="https://www.rfc-editor.org/info/rfc3161">
          <front>
            <title>Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)</title>
            <author initials="C." surname="Adams" fullname="C. Adams"/>
            <author initials="P." surname="Cain" fullname="P. Cain"/>
            <author initials="D." surname="Pinkas" fullname="D. Pinkas"/>
            <author initials="R." surname="Zuccherato" fullname="R. Zuccherato"/>
            <date year="2001" month="August"/>
          </front>
          <seriesInfo name="RFC" value="3161"/>
        </reference>

        <reference anchor="RFC8785" target="https://www.rfc-editor.org/info/rfc8785">
          <front>
            <title>JSON Canonicalization Scheme (JCS)</title>
            <author initials="A." surname="Rundgren" fullname="A. Rundgren"/>
            <author initials="B." surname="Jordan" fullname="B. Jordan"/>
            <author initials="S." surname="Erdtman" fullname="S. Erdtman"/>
            <date year="2020" month="June"/>
          </front>
          <seriesInfo name="RFC" value="8785"/>
        </reference>

      </references>
      <references>
        <name>Informative References</name>

        <reference anchor="CA-CRC-ADS">
          <front>
            <title>Employment Regulations on Automated Decision Systems</title>
            <author><organization>California Civil Rights Council</organization></author>
            <date year="2025" month="October"/>
          </front>
        </reference>

        <reference anchor="NYC-LL144">
          <front>
            <title>Local Law 144 of 2021: Automated Employment Decision Tools</title>
            <author><organization>New York City Council</organization></author>
            <date year="2021"/>
          </front>
        </reference>

        <reference anchor="IL-AIVIA">
          <front>
            <title>Artificial Intelligence Video Interview Act (820 ILCS 42)</title>
            <author><organization>Illinois General Assembly</organization></author>
            <date year="2020" month="January"/>
          </front>
        </reference>

        <reference anchor="EEOC-AI-2023">
          <front>
            <title>Use of Artificial Intelligence in Employment Decisions</title>
            <author><organization>U.S. Equal Employment Opportunity Commission</organization></author>
            <date year="2023" month="May"/>
          </front>
        </reference>

        <reference anchor="CO-AI-ACT">
          <front>
            <title>Colorado Artificial Intelligence Act (SB 24-205)</title>
            <author><organization>Colorado General Assembly</organization></author>
            <date year="2026" month="June"/>
          </front>
        </reference>

        <reference anchor="I-D.veridom-omp-clinical">
          <front>
            <title>OMP Domain Profile: Clinical AI Decision Accountability Under Joint Commission/CHAI Guidance, California SB 1120, and Emerging US State and Federal Healthcare AI Obligations</title>
            <author initials="T." surname="Adebayo" fullname="Tolulope Adebayo"/>
            <author initials="O." surname="Apalowo" fullname="Oluropo Apalowo"/>
            <author initials="F." surname="Makanjuola" fullname="Festus Makanjuola"/>
            <date year="2026" month="April"/>
          </front>
          <seriesInfo name="Internet-Draft" value="draft-veridom-omp-clinical-00"/>
        </reference>

        <reference anchor="I-D.veridom-omp-euaia">
          <front>
            <title>OMP Domain Profile: EU AI Act Article 12 Logging and Traceability Requirements for High-Risk AI System Operators</title>
            <author initials="T." surname="Adebayo" fullname="Tolulope Adebayo"/>
            <author initials="O." surname="Apalowo" fullname="Oluropo Apalowo"/>
            <author initials="F." surname="Makanjuola" fullname="Festus Makanjuola"/>
            <date year="2026" month="April"/>
          </front>
          <seriesInfo name="Internet-Draft" value="draft-veridom-omp-euaia-00"/>
        </reference>

        <reference anchor="OMP-OPEN-CORE">
          <front>
            <title>OMP Open Core: Reference Validator and Schema Library</title>
            <author><organization>Veridom Ltd</organization></author>
            <date year="2026"/>
          </front>
          <seriesInfo name="" value="Apache 2.0, https://github.com/veridomltd/omp-open-core"/>
        </reference>

        <reference anchor="ZENODO-OMP">
          <front>
            <title>OMP -- Operating Model Protocol: A Deterministic Routing Invariant for Tamper-Evident AI Decision Accountability in Regulated Industries</title>
            <author initials="T." surname="Adebayo" fullname="Tolulope Adebayo"/>
            <author initials="O." surname="Apalowo" fullname="Oluropo Apalowo"/>
            <author initials="F." surname="Makanjuola" fullname="Festus Makanjuola"/>
            <date year="2026" month="March"/>
          </front>
          <seriesInfo name="Zenodo" value="DOI 10.5281/zenodo.19140948"/>
        </reference>

      </references>
    </references>
  </back>

</rfc>
