Risk tiering
Every candidate workflow is placed in a risk tier before an agent touches it. Tier decides how much autonomy the agent gets, what evidence it must produce, and who signs off.
enterprise · governance framework
governed agentic AI, not ungoverned experiments
An enterprise AI governance framework that decides what agents may do, how much autonomy they hold, who approves the output and what evidence survives the audit — wired into the workflow, not filed beside it.
why it matters
the constraint on enterprise AI is control, not capability
Most large organisations already have AI in use, much of it unsanctioned. The blocker to scaling it is rarely model quality — it is the absence of an agreed answer to who is accountable, what the agent may touch, and what evidence exists after the fact.
- 01AI in use across teams with no shared boundary or owner
- 02Pilots that cannot pass an internal risk review
- 03No agreed definition of which decisions a machine may make
- 04No evidence trail when an output is challenged
- 05Governance written as policy, never wired into the work
the framework
six control pillars for governed AI agents
Each pillar is expressed as something operable — a tier, a threshold, a route, a named owner — rather than a principle.
Approval thresholds
Control points sit where the consequence sits: value thresholds, customer-facing output, safety-relevant decisions and anything that writes back into a system of record.
Escalation pathways
Defined routes for low confidence, missing data, out-of-scope requests and disputed outputs — so an agent hands work back rather than improvising.
Accountable owners
Each agent team has a named human orchestrator and an accountable executive. Governance is a role in the operating model, not a document in a folder.
Scope and access boundaries
Agents operate inside a defined role, on a defined data scope, using access your team grants and can revoke. Boundaries are designed in, not bolted on.
Evidence and audit trail
Briefs, inputs, outputs, approvals and escalations are recorded so an internal auditor or regulator can reconstruct how a decision was reached.
risk tiers
autonomy is granted by consequence
The tier a workflow lands in determines the agent's autonomy, the control that applies and the evidence that must be produced.
| tier | agent autonomy | control applied | typical work |
|---|---|---|---|
| Tier 1Assistive | Agent drafts, a human uses or discards. | No approval gate. Output never leaves the workspace unreviewed. | Research summaries, first-draft internal notes, meeting synthesis. |
| Tier 2Supervised | Agent completes the task end to end, a named reviewer approves before release. | Single approval gate with a recorded approver and timestamp. | Customer correspondence, operational reporting, supplier follow-up. |
| Tier 3Controlled | Agent operates inside a narrow, pre-agreed envelope with hard limits. | Threshold-based approval, dual review on exceptions, mandatory escalation on low confidence. | Write-backs to a system of record, commitments with a financial value, compliance evidence packs. |
| Tier 4Out of scope | No agent autonomy. | Excluded by policy. Reassessed only with executive and risk sign-off. | Safety-critical decisions, statutory determinations, anything without a competent human reviewer. |
Tiers are a starting position. They are set with your risk, legal and operations functions and adjusted to your own delegation of authority.
how we implement it
four steps from shadow AI to governed operation
Map the exposure
Inventory where AI is already being used, including shadow use. Identify the workflows, data and systems in scope, and the decisions that carry real consequence.
Set the policy spine
Agree risk tiers, approval thresholds, escalation rules, data-handling boundaries and the definition of an accountable owner. Written in operating language, not legal boilerplate.
Wire controls into the workflow
Controls are implemented as review points and scope limits inside the agent workflow itself, so governance happens where the work happens rather than in a quarterly review.
Operate, evidence and improve
Run with a human orchestrator, review the evidence trail, retire controls that add drag and tighten the ones that catch real problems.
questions
common questions about AI governance
What is an enterprise AI governance framework?
A practical set of rules and control points that decide which work agents may do, how much autonomy they have, who approves their output and what evidence is kept. It sits inside the operating model rather than beside it.
How is this different from an AI policy document?
A policy states intent. This framework turns intent into risk tiers, approval thresholds and escalation pathways that are wired into the agent workflows themselves, so the control fires at the moment work is produced.
Do governed AI agents slow the work down?
Controls are placed by consequence. Assistive work runs with no gate at all; only higher-tier workflows carry approval steps. The aim is to make more work safely automatable, not less.
Is this a certification or compliance guarantee?
No. It is an operating framework designed and run with your risk, legal and operations functions. It does not constitute certification, legal advice or an assurance of regulatory compliance.