Trust ethics
Human in control. Always.
Sodexo will not let a machine speak to an NHS trust in our name. Nine agents can read, draft and suggest. Only named Sodexo colleagues decide what leaves the building.
Six commitments. Coded into the system, not written on a policy page. Every colleague can read them. Every agent is bound by them.
The six commitments.
Each commitment names what the system does, what colleagues can expect and how the commitment is enforced.
| Commitment | What it means in practice | How it is enforced |
|---|---|---|
| 1. No agent acts alone | Every campaign passes through four named colleagues before it leaves Sodexo. Draft. BD review. Marketing and risk. Named authentication. | Coded into the campaign builder. The send control stays disabled until all four stages carry a named sign-off. Steward flags any attempt to skip a stage the same day. |
| 2. Tier 2 evidence stays tier 2 unless cleared | Not every signal the agents see is safe to use externally. Tier 2 evidence is suppressed by default in anything that leaves Sodexo. | Tier 2 items are stripped automatically when a template is cloned and held in a governance queue. Release needs a named clearance at Stage 3. Steward reports tier 2 material dwelling in drafts. |
| 3. Named individuals need account-owner consent | Warmth scores and relationship notes live in the portal. No named individual is approached because an agent suggested it. | Contact steps carry the account-owner's name and cannot be authenticated by anyone else. Consent is recorded in the stage log with a timestamp. |
| 4. Every decision is traceable | Every campaign carries a stage log naming its reviewer, the time of the decision and the version of the evidence used. | The stage log is written by the system, not by hand, and cannot be edited after the fact. Evidence-pack exports carry the full audit trail with them. |
| 5. Steward audits daily | Steward is the governance agent. It checks for bypass attempts, dwelling tier 2 citations, reviewer-load imbalance and stage-log gaps. | The daily audit runs against every action taken in the previous 24 hours. Breaches are surfaced to the named governance lead within one working day and shown on the governance page. |
| 6. Any colleague can raise a concern | One-click concern-raise on any campaign, any signal, any agent output. Colleagues do not need permission to question something. | A raised concern freezes the campaign before Stage 4, routes to the governance lead and is logged for the quarterly ethics review. Nothing under concern goes out. |
What Priority-40 is not.
Deliberate scope discipline.
- Not a mass-outreach engine. Priority-40 targets 40 named trusts. Not the wider NHS. Not other sectors.
- Not a substitute for account ownership. Named account-owners keep authority. The system amplifies their judgement, it does not replace it.
- Not an autonomous agent stack. Every external action requires a signed-off named human. No exceptions.
- Not a data-hoarding project. The intake queue is governed. Colleagues own their contributions and can withdraw them.
- Not a black box. Every agent declares its sources, its refresh cadence and its current confidence on the agents page in the portal.
- Not a marketing platform. It is a business development operating system with marketing as one of four reviewer roles.