Governance Setup
Who decides, and what happens when something goes wrong?
Who asks
This tends to arrive with the compliance lead, holding a customer contract or an insurance questionnaire that asks for a named owner of AI decisions when nothing on file names one.
What we look at
Policies that already exist get read before anything new is written, because most organizations have an acceptable use policy, a data classification scheme, and a vendor onboarding process that an AI policy should hang off rather than duplicate. Then we establish who currently approves a new tool, which is usually several people informally and nobody on the record, and turn that into a named path with a named decision maker. Incident response gets the same treatment, covering what counts as an AI incident here, who is called, what gets preserved, and who speaks to the customer. The finished policy is written to be applied by people who were not in the room when it was drafted.
What you get
Key deliverables
- An AI policy
- An acceptable use policy
- A written tool approval process naming who decides
- An incident response runbook
What this does not cover
Nothing here is legal advice. The AI RMF is voluntary guidance, and mapping to it establishes conformity with no law, standard, or contract, so anything carrying legal exposure should go past counsel before it is published internally. Technical enforcement is a separate question as well. The controls that stop an agent from doing something at runtime live in your own systems, and the Agentic Routing Policy is where that design is done.
What lands in the platform
This engagement leaves less in the platform than the others do. Tools are registered in the vendor catalog, and department assignment is held there too, so the question of which departments a tool is assigned to and what share of its cost each one carries has an answer that can be looked up rather than remembered. The policies, the approval process, and the incident runbook are documents, and the platform has no approval workflow to route a new tool to the person who decides. That decision is made by the people the process names.
Next step
Start with the acceptable use policy you already have, and we will mark which of its clauses cover AI by accident and which gaps they leave.