Skip to content

Governance

Governance, for this framework, is the set of durable artifacts that make AI-assisted development auditable, proportionate to risk, and answerable to external standards. It is not the same as approval: governance enables engineers to move safely, not slower.

What lives here

Page Purpose
Acceptable Use Policy The company-wide policy that every engineer acknowledges; structure and non-negotiables.
RACI & decision rights Who decides what, across the full program.
Risk classification The 5-factor matrix used to tier systems and determine verification rigour.
Vendor & tool standards How tools get onto the approved list, and how they come off.
Data handling What data moves between engineers, AI services, and internal systems, and how it is retained.
IP & licensing The IP-safety, open-source-provenance, and indemnification stance.
Incident response The AI-specific IR framework, including agent-caused incidents.
Audit trail Evidence the program produces, where it is stored, and how long it is kept.
Regulatory mapping Crosswalk of company controls to NIST AI RMF, ISO/IEC 42001, EU AI Act, sector rules.

Principles

  1. Evidence precedes rule. A new clause in the AUP is justified by an incident, a regulation, a published study, or a direct audit finding. Never by a vendor pitch or industry headline alone.
  2. Proportionality. Controls escalate with risk tier. A Medium system does not require the same rigour as a Critical one.
  3. Attributable ownership. Every control has a single owner (a role, not a person). If nobody owns it, it does not exist.
  4. Durability. Governance artifacts are versioned, reviewed on a cadence, and survive changes of tool, vendor, and leadership.
  5. Public-standard anchoring. Where an external standard addresses an AI-specific concern, the company's control cites and maps to it rather than inventing a proprietary one.

The external anchors

Governance here is written to map onto (not replace) these public standards. The mapping itself lives in Regulatory mapping.

How governance integrates with the rest of the framework

  • The roadmap is when to produce each artifact; governance here is what good looks like for each.
  • The worksheets are the runnable meetings that produce the artifacts.
  • The frameworks (S.C.A.F.F., V.E.R.I.F.Y., S.H.I.E.L.D., etc.) provide the operational patterns that controls here reference.
  • The measurement pages tell you whether the governance is being followed.

What governance is not

  • Not a brake. A policy that is "no AI for anything" is bad governance; so is a policy that defers every choice to exception.
  • Not a gate on everything. Critical-tier work is gated; lower-tier work uses lightweight review. Both are governance.
  • Not a substitute for verification. The best AUP in the world does not guarantee a safe merge. V.E.R.I.F.Y. and C.L.E.A.R. do.
  • Not fixed. The control set refreshes with incidents and regulatory change; Phase 3 embeds the cadence.

Next