What is AI governance?

AI governance is the set of controls on what an AI system may do. It covers whose authority it acts on, what it may spend, and what evidence it leaves. If the system does not check the controls when it acts, the policy is only a plan.

Many organisations with AI governance have a written policy, an approved vendor list and a committee. These help, but none of them is there when an agent decides whether to approve a payment.

What AI governance covers

Six controls cover almost every way an automated decision goes wrong.

GatehouseIn Gatehouse, Surehand's control plane, one signed manifest per deployment sets rules like these in five gates: scope, role, limits, review and seal. See Gatehouse

How it differs from ordinary IT governance

Given the same input, ordinary software does the same thing. Test it once and you know what it will do, so governance is mostly about access and change control. A model can give different answers to the same input. Its behaviour shifts as inputs change, as the vendor updates it, and as the world moves on. So the checks have to continue after launch.

So a sign-off at launch matters less than a record of every later decision. The sign-off shows intent, and the record shows what happened.

What it looks like day to day

1. /01

   A run arrives. The agent checks what it is permitted to touch for this work, and refuses anything outside that. The refusal is recorded.

2. /02

   It reaches a decision with a confidence figure, compared against a threshold that was fixed before the run started.

3. /03

   Above the bar, it acts and the run is sealed. Below it, the run holds and a named approver gets it with the evidence already gathered.

4. /04

   Spend is counted against a limit as it goes. At the limit it holds rather than fails, so no work is lost.

5. /05

   The record closes with the evidence the decision rested on, and exports in open formats without the vendor.

6. /06

   On a fixed schedule, a named person looks at hold rate, drift and cost per run, and adjusts the thresholds with numbers rather than opinions.

Accountability sits with a person

Accountability always sits with a person. The question is whether you can name them before something goes wrong. Every automated decision should map to a human role that approved it or set the rule that let it proceed. The system cannot hold accountability, and saying the AI decided is not an answer a regulator, customer or board will accept.

This is why a hold is useful. When the system stops and asks, it is clear who is accountable.

Where a team should start

Start with one process. Pick the process that takes the most hours. Write its scope, threshold and limit on one page, and keep records from the first run. A programme that starts with a policy tends to end with a policy. One that starts with a governed process produces records, and the next approval will ask for them.