Governance operating guide
How to set rules an AI workflow must follow
AI governance means enforceable rules for what a system may read, suggest, change, or send for review. Put those rules in permissions, approval checks, tests, and operating instructions. Keep records so your team can check what happened. A policy document alone cannot enforce them.
- Good fit
- Use this model when an AI-assisted process touches customer data, money, publication, access, regulated decisions, or any action whose authority must be explained later.
- Pause when
- A governance program is not useful if it produces a document nobody can connect to runtime behavior, or if every exception depends on an unavailable executive rather than an operating owner.
When this approach helps
- Teams disagree about whether the assistant may act or only recommend.
- Approvals happen in chat but are not attached to the resulting external change.
- Operators cannot reconstruct which evidence, policy version, and identity produced a decision.
Follow these steps
- 01
List the permitted actions
For each tool and record, list what may be read, proposed, changed automatically, changed with approval, or blocked. Include customer and role restrictions.
- 02
Define what happens when a rule fails
Track pending, approved, denied, expired, missing-evidence, and unknown-action states. If no rule matches, stop. Explain which information or responsible person is missing.
- 03
Record the action and its approval
Keep source references, policy version, approver identity, request, result identifiers, and timestamps. Protect sensitive data while retaining enough information to review the decision.
- 04
Review the rules and test recovery
Review exceptions and business changes. Test pausing, removing access, retrying, correcting data, and undoing changes. Update the instructions when tools or processes change.
Documents and records to keep
Machine-readable policy pack
Versioned rules connect business language to tool names, roles, thresholds, approvals, evidence requirements, and explicit blocked states.
Approval record
The record binds the decision to a person or policy, a defined scope, supporting evidence, expiration, and the action that consumed it.
Recovery checklist
Operators receive tested instructions for pausing work, invalidating access, correcting state, notifying owners, and documenting the final disposition.
Common questions
What is the minimum viable AI governance artifact?
For one workflow, start with an authority table that names each action, its allowed identity, required evidence, approval state, and failure behavior. Connect that table to tests and receipts before expanding into a broader governance program.
Can a prompt serve as an AI policy?
A prompt can explain intent, but it cannot by itself authenticate a user, enforce a scope, prove an approval, or reverse an external change. Pair judgment instructions with runtime permissions, validators, state, and observable evidence.
How often should AI workflow policies be reviewed?
Review after material tool, data, legal, organizational, or failure changes and on a cadence proportionate to risk. Use observed exceptions and denied actions as inputs, rather than updating policy only on a calendar.