| Internet-Draft | OMP Employment ADS Profile | April 2026 |
| Adebayo, et al. | Expires 7 October 2026 | [Page] |
This document defines a domain profile of the Operating Model Protocol (OMP) for automated decision systems (ADS) deployed in employment contexts subject to the California Civil Rights Council (CRC) Employment Regulations on Automated Decision Systems (effective October 1, 2025), New York City Local Law 144 (bias audit requirement for automated employment decision tools), the Illinois Artificial Intelligence Video Interview Act (AIVIA), and related US state and municipal ADS accountability obligations in employment.¶
The profile -- designated WorkMark -- specifies how OMP's deterministic routing invariant, Watchtower enforcement framework, and three-layer cryptographic integrity architecture satisfy the record-retention, named accountability, bias audit evidence, and per-decision auditability requirements applicable to employment ADS deployments. The profile directly addresses the California CRC requirement to retain ADS inputs, outputs, decision criteria, and audit results for four years with named accountability for AI-assisted hiring and employment decisions.¶
The OMP core specification is defined in the Operating Model Protocol Internet-Draft (draft-veridom-omp).¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 7 October 2026.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.¶
Automated decision systems are now embedded across the employment lifecycle: in resume screening, candidate ranking, video interview analysis, skills assessment scoring, promotion modelling, workforce planning, and termination risk prediction. These systems affect the economic circumstances of individuals at scale, and the regulatory frameworks governing their use are now moving from guidance to enforceable obligation.¶
Three instruments have crystallised the per-decision accountability requirements for employment ADS with sufficient precision to support technical specification:¶
These instruments converge on a structural evidence requirement that maps directly onto OMP [I-D.veridom-omp]: every ADS-assisted employment decision must generate a per-decision record documenting what the ADS recommended, what data it used, how the recommendation was weighted, and who was accountable for the final decision -- retained for a minimum of four years and independently verifiable by regulators, candidates, and auditors.¶
This document defines the WorkMark profile: the domain-specific instantiation of OMP for employment ADS accountability. WorkMark denotes that every AI-assisted employment decision is cryptographically marked against the employer's ADS accountability obligations, producing a tamper-evident record that satisfies California CRC four-year retention requirements, NYC Local Law 144 bias audit evidence standards, and AIVIA documentation obligations through a single evidence architecture.¶
Related OMP domain profiles include the Clinical AI profile [I-D.veridom-omp-clinical] and the EU AI Act Article 12 profile [I-D.veridom-omp-euaia]. Audit Trace payloads are canonicalized per [RFC8785]. The OMP specification is also archived at [ZENODO-OMP].¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] [RFC8174].¶
This document uses the terminology defined in [I-D.veridom-omp]. In addition:¶
The California CRC Employment Regulations [CA-CRC-ADS] (effective October 1, 2025) require employers to retain for four years: ADS inputs (candidate data, job requirements, scoring criteria); ADS output (score, ranking, classification, recommendation); decision criteria applied; weight given to ADS output in the final decision; applicable bias audit results; and the identity of the human decision-maker who made or approved the final decision. Records must be producible to the California Civil Rights Department (CRD) upon request.¶
NYC Local Law 144 [NYC-LL144] requires annual independent bias audits of AEDTs used in hiring or promotion decisions affecting NYC candidates, assessing selection rate disparities across race/ethnicity, sex, and intersectional categories. Results must be publicly disclosed. Candidates must receive at least ten business days' advance notice that an AEDT will be used. The NYC Local Law 144 bias audit requirement creates the integration point with Section 7 (Bias Audit Evidence Package) of this profile.¶
The Illinois AIVIA [IL-AIVIA] requires employers using AI to analyse video interviews to inform candidates in writing, explain how the AI works, obtain candidate consent, limit sharing of video and AI analysis data to persons necessary for the hiring decision, and retain the video and AI analysis for a minimum period. WT-EMPLOY-06 (AIVIA Consent Gate) gives the consent requirement structural enforcement.¶
The EEOC [EEOC-AI-2023] "Use of Artificial Intelligence in Employment Decisions" guidance (2023) states that employers cannot avoid Title VII liability by attributing discriminatory outcomes to an AI vendor. This reinforces the named accountability requirement in the WorkMark profile: the Employment Decision Authority, not the AI vendor, is the Named Accountable Officer. The WorkMark Audit Trace documents the employer's accountability for ADS outcomes, consistent with the EEOC's position.¶
Colorado's Artificial Intelligence Act (effective June 1, 2026) requires deployers of high-risk AI in employment decisions to maintain risk management programmes, provide applicant disclosures, and implement discrimination mitigation measures. The WorkMark profile's Disparate Impact Flag and Bias Audit Evidence Package address the Colorado Act's discrimination mitigation evidence requirements.¶
California CRC, NYC Local Law 144, Illinois AIVIA, EEOC guidance, and Colorado AI Act [CO-AI-ACT] define an evidence structure that maps directly onto OMP's three routing states: ADS-assisted decisions where the EDA reviewed, applied independent judgment, and documented the basis correspond to ASSISTED; decisions where a Disparate Impact Flag was triggered or the candidate invoked human review rights correspond to ESCALATED; fully autonomous ADS employment decisions are NOT PERMITTED for Covered Employment Decisions under this profile.¶
The Named Accountable Officer under this profile is the Employment Decision Authority: the individual who makes or approves the final employment decision. For California CRC compliance, the EDA is the individual whose identity is required in the four-year retention record. For EEOC Title VII purposes, the EDA is the employer representative whose decisions are attributable to the employer.¶
Required fields in the EDA record:¶
eda_employee_id: stable identifier, consistent throughout the Four-Year Retention Period;¶
eda_role: role in the decision process (e.g., "hiring_manager", "HR_business_partner");¶
eda_review_timestamp: ISO 8601 UTC of the EDA's review and decision;¶
eda_decision: one of PROCEED_WITH_ADS_RECOMMENDATION, PROCEED_MODIFIED, OVERRIDE, REJECT_CANDIDATE, ADVANCE_CANDIDATE;¶
eda_independent_basis: REQUIRED for PROCEED_MODIFIED and OVERRIDE; documents independent judgment and weight given to ADS recommendation.¶
Trigger: Any interaction classified as a Covered Employment Decision.¶
Action: FORCE_ASSISTED. Cannot be disabled for Covered Employment Decisions.¶
Rationale: California CRC Regulations require named accountability for ADS-assisted employment decisions. EEOC guidance requires employers to maintain responsibility for employment decision outcomes. This Watchtower makes it architecturally impossible for a Covered Employment Decision to be finalised without generating an EDA review record.¶
Trigger: Composite Confidence Score falls below the employer's configured employment decision floor.¶
Action: FORCE_ESCALATED. EDA makes the final decision without reliance on the ADS recommendation. ADS output MAY be provided as context, clearly labelled as below the employment decision confidence floor.¶
Rationale: An ADS recommendation below the employment decision floor represents insufficient confidence to influence the employment outcome. ESCALATED routing ensures the EDA exercises independent judgment.¶
Trigger: ADS recommendation, score, or ranking for this candidate falls within a demographic category or score band that the employer's most recent bias audit identified as exhibiting adverse impact (selection rate below 80% of the highest-rate group, the four-fifths rule).¶
Action: FORCE_ESCALATED. EDA reviews with specific awareness of the disparate impact concern. disparate_impact_flag set to true. EDA decision and independent basis are REQUIRED.¶
Rationale: NYC Local Law 144 and California CRC Regulations require employers to assess and document disparate impact in ADS employment decisions. ESCALATED routing ensures decisions in known adverse impact zones are made by a human with full awareness of the bias concern, documented in the Audit Trace for bias audit purposes.¶
Trigger: A candidate has invoked their right to human review of an ADS-assisted decision under applicable law or employer policy.¶
Action: FORCE_ESCALATED. Candidate's request documented in WorkMark Audit Trace. EDA conducts and documents a human review.¶
Rationale: Colorado's AI Act and emerging state frameworks provide candidates the right to request human review of consequential AI decisions. This Watchtower ensures candidate-invoked human review generates a sealed record of the review and its outcome.¶
Trigger: Aggregate selection rate for a protected class in the ongoing WorkMark Audit Trace stream reaches the employer's configured pre-adverse-impact alert threshold -- firing before the four-fifths rule threshold is breached.¶
Action: FORCE_ASSISTED for all new interactions in the affected demographic category, pending review by the employer's bias audit authority. A bias audit alert record is generated.¶
Rationale: NYC Local Law 144 requires annual bias audits. WT-EMPLOY-05 provides continuous monitoring enabling employers to address emerging disparate impact before it becomes a documented violation.¶
Trigger: For video interview AI deployments subject to Illinois AIVIA: candidate has not provided documented consent to AI video analysis, or consent record is missing or invalid.¶
Action: HARD_BLOCK. AI video analysis MUST NOT proceed without valid candidate consent.¶
Rationale: Illinois AIVIA requires employers to obtain candidate consent before using AI to analyse video interviews. HARD_BLOCK ensures consent cannot be bypassed through system error or process failure.¶
The following fields are REQUIRED under the WorkMark profile, in addition to core fields in [I-D.veridom-omp] Section 7:¶
eda_employee_id: string, REQUIRED for Covered Employment Decisions. Stable identifier consistent throughout the Four-Year Retention Period.¶
eda_role: string, REQUIRED.¶
eda_review_timestamp: string, ISO 8601 UTC, REQUIRED for ASSISTED and ESCALATED.¶
eda_decision: string, REQUIRED for ASSISTED and ESCALATED. One of: PROCEED_WITH_ADS_RECOMMENDATION, PROCEED_MODIFIED, OVERRIDE, REJECT_CANDIDATE, ADVANCE_CANDIDATE.¶
eda_independent_basis: string, OPTIONAL for PROCEED_WITH_ADS_RECOMMENDATION; REQUIRED for PROCEED_MODIFIED and OVERRIDE. Documents independent judgment and weight given to the ADS recommendation, satisfying the California CRC decision criteria documentation requirement.¶
ads_output_record: object, REQUIRED. MUST contain: output_type ("score", "ranking", "classification", or "recommendation"); output_value; output_timestamp (ISO 8601 UTC); ads_system_id; ads_version.¶
candidate_demographic_category: string, REQUIRED if lawfully collected; otherwise "not_collected". Used for bias audit assessment only.¶
disparate_impact_flag: boolean, REQUIRED. True if WT-EMPLOY-03 triggered.¶
bias_audit_reference: string, REQUIRED. Identifier of the most recent bias audit applicable at the time of the decision. For NYC Local Law 144, must reference an audit by an independent auditor within the preceding 12 months.¶
candidate_human_review_requested: boolean, REQUIRED. True if WT-EMPLOY-04 triggered.¶
employment_decision_category: string, REQUIRED. One of: "initial_screening", "interview_scoring", "promotion", "adverse_action", "compensation", "termination".¶
aivia_consent_obtained: boolean, REQUIRED for video interview AI deployments subject to Illinois AIVIA.¶
four_year_retention_expiry: string, ISO 8601 date, REQUIRED. Calculated as four years from eda_review_timestamp date. Implementations MUST enforce retention until this date.¶
profile_version: string, REQUIRED. MUST be "VERIDOM-WORKMARK-v1.0".¶
The California CRC Regulations require employers to retain Covered Employment Decision records for a minimum of four years. The WorkMark profile implements this through: per-decision retention with a four_year_retention_expiry date enforced at generation; chain integrity across the retention period enabling regulators and auditors to verify that the complete set of WorkMark Audit Traces has been retained without deletion or modification (a chain gap is detectable as a chain integrity violation); regulator accessibility within the four-year period within 30 seconds via the Proof-Point generation mechanism; and retention across system migrations, with a sealed migration event record documenting the transition and preserving chain integrity.¶
The WorkMark profile generates two types of bias audit evidence: per-decision evidence (each Audit Trace contains the candidate_demographic_category, disparate_impact_flag, and bias_audit_reference fields) and aggregate evidence (the Audit Trace stream can be aggregated to compute the selection rates and adverse impact ratios required by NYC Local Law 144 annual bias audit methodology from an independently verifiable basis).¶
The Bias Audit Evidence Package, produced using the OMP Proof-Point artefact mechanism for a defined employment period, MUST contain: all sealed WorkMark Audit Traces for the period organised by employment_decision_category and ADS system; aggregate selection rate data by candidate_demographic_category; disparate impact ratio calculations for each demographic category and score band; count and disposition of WT-EMPLOY-03 Disparate Impact Flag triggers; count and disposition of WT-EMPLOY-04 Candidate Human Review Request triggers; chain integrity proof (SHA-256 Merkle root); and RFC 3161 [RFC3161] TimeStampToken verification from the OMP Reference Validator [OMP-OPEN-CORE].¶
An independent bias auditor conducting an NYC Local Law 144 annual audit can use the Bias Audit Evidence Package as the primary evidentiary basis, verifying completeness and integrity without relying on the employer's self-reported statistics.¶
Implementations of this profile MUST satisfy the following two-property invariant:¶
An employer satisfying the WorkMark Invariant can demonstrate, for any Covered Employment Decision within the Four-Year Retention Period: the ADS output generated for the candidate; the EDA's identity and review timestamp; the EDA's final decision and independent basis for any departure from the ADS recommendation; the Disparate Impact Flag status with reference to the applicable bias audit; whether the candidate invoked human review; the applicable bias audit; and that the record has not been altered since sealing. This satisfies every element of a California CRC compliance examination, NYC Local Law 144 bias audit, EEOC Title VII investigation, and Colorado AI Act disparate impact assessment.¶
The security considerations of [I-D.veridom-omp] apply in full.¶
Candidate data sensitivity: WorkMark Audit Traces contain candidate PII and, where collected, demographic data. Operators MUST restrict access to individuals with a legitimate need in the employment decision process, HR governance, or bias audit function. Demographic data fields MUST have additional access controls consistent with applicable employment discrimination law.¶
EDA identity integrity: eda_employee_id MUST reflect the actual individual who made or approved the final employment decision. Operators MUST implement technical controls to prevent EDA identity assignment without the relevant individual's authenticated action.¶
Bias audit data integrity: the WorkMark Audit Trace stream is the evidentiary basis for the annual bias audit. The chain integrity architecture makes selective deletion detectable: a chain gap will be identified as a chain integrity violation in the Bias Audit Evidence Package.¶
Demographic data segregation: where candidate demographic data is collected for bias audit purposes, it MUST be segregated from the ADS input data used in employment decisions, consistent with applicable employment discrimination law restricting the use of protected characteristics in employment decisions.¶
This document has no IANA actions.¶