Data boundaries
Identify the information needed, the authority to use it, the providers involved and the relevant access, hosting and retention requirements.
Data & human control
Know what information a solution uses, what it can do and who approves consequential actions. Those decisions belong at the start.
Identify the information needed, the authority to use it, the providers involved and the relevant access, hosting and retention requirements.
Agree who can review, correct and approve outputs, especially external messages or changes to customer systems.
Test against agreed acceptance measures, record limitations and define support and recovery responsibilities before use.

Data & control
Before we build, we agree what information a solution can use, what it may do and where people need to approve its actions. Those controls are shaped around the work itself and checked before the solution is put to use.
The actual commitments belong in a reviewed project scope and technical evidence.