Governance that works at the level AI actually operates.
Establish the inventory, access boundaries, decision authority, oversight and evidence that make AI deployment defensible — process by process.
What this is for.
Organizations deploying AI into meaningful business processes face a specific set of questions, and none of them are answered by a policy document alone. What role does AI play in this process? What information can it access? What actions can it take? Where is human approval required? What happens if it is wrong? What controls are required, and what evidence should be retained?
This engagement answers those questions for each material use case, and establishes the operating model that keeps the answers current as the estate grows — including the AI already in use inside tools nobody formally approved.
What we look at.
What actually happens.
Use-case discovery
Build the inventory, including embedded and unsanctioned use, and assign an owner to each entry.
Risk classification
Classify by consequence so that controls are proportionate rather than uniform.
Access and authority design
Define what each use case may read and what it may do, bounded by the same permissions that bound people.
Oversight design
Determine where human approval is required, by whom, and on what information.
Testing and monitoring design
Known-answer testing and ongoing accuracy monitoring, so performance is measured rather than assumed.
Evidence and audit
Define what is retained, for how long, and how it is produced when asked for.
Operating model
How new use cases get reviewed and approved once the engagement ends.
What you own.
AI use-case register
Owned, classified and reviewable by a board or an auditor.
Access and authority matrix
What each use case can see and do, and what it cannot.
Oversight and control design
Approval points, controls and escalation paths, proportionate to consequence.
Testing and monitoring plan
How accuracy is measured initially and tracked over time.
Evidence retention standard
What is kept, where, and for how long.
Governance operating model
The process for reviewing and approving new use cases going forward.
Frequently asked questions.
Is this an AI policy?
No. A policy alone does not answer the questions that matter. This engagement works use case by use case: what the AI can access, what it can do, where a person must approve, and what evidence is kept.
Does it cover AI already in use in other tools?
Yes. The inventory includes AI embedded in vendor tools and use nobody formally approved, and each entry is given an owner.
Is every use case held to the same controls?
No. Use cases are classified by consequence, so controls are proportionate: a drafted email and a posted journal entry are not the same risk.
How do we get started?
Book a 30-minute strategy session. We map how your systems connect and identify where the first engagement would create the most value.
Talk through AI Governance & Assurance.
Thirty minutes to establish scope, effort and what you would have at the end of it.