02 / GOVERNANCE
Control what AI can do.
Set an explicit boundary between generated advice and a system with permission to act.
RELEASE FRAMEWORK
Four questions before production.
Who owns the decision?
Name the process and risk owners, set escalation responsibilities and record who can stop the system.
Where can the system cause harm?
Document the sources, identities, tools, affected people, dependencies and permitted actions.
What evidence supports the scope?
Replay exceptions and attempted policy violations. Record errors, human overrides and the cost of review.
What happens after release?
Monitor changes, audit actions, assign incident response and make rollback a tested operation.
- NIST AI Risk Management Framework · January 2023
Voluntary framework for governing, mapping, measuring and managing AI risk.
- NIST Generative AI Profile (AI 600-1) · 26 July 2024
Cross-sector companion for evaluating and managing generative AI risks.
- OWASP Top 10 for Agentic Applications for 2026 · 9 December 2025
Practitioner taxonomy of risks specific to AI systems that take actions across workflows.
INTERACTIVE / AUTHORITY SIMULATOR
Walk through a release decision.
Change the proposed action and evidence. The simulator explains which control blocks the path and why.
SIMULATED OUTCOME
Educational example. Use your organisation’s release authority and legal, security and operational reviews.