Governance & Trust
AI value governance
Most governance frameworks stop at the first question. Scaling AI needs all three.
How to use it
Four steps. Each one is a control on this page, in the order you would use it.
Scope
Filter the stack to that tier. Those blocks are required; the rest stay optional for now.
Assign
Give every required block one accountable persona. A block without a name is the gap to fix.
Classify the workload first
One question sets the authority tier: what can it do without a human? The tier decides how much of the stack applies. Each tier includes the ones below it.
Each tier needs the governance maturity shown on its card. Take the quick check to see which tiers you can carry today.
It drafts. A person uses the output or discards it.
Needs governance at ExploringAbove your governance level
9 of 29 blocks required
It recommends. A person decides.
Needs governance at EstablishingAbove your governance level
18 of 29 blocks required
It changes data in business systems, with checkpoints.
Needs governance at ScalingAbove your governance level
27 of 29 blocks required
It runs sensitive processes alone. People handle exceptions.
Needs governance at ScalingCompounding where the workload is customer-facing.Above your governance level
29 of 29 blocks required
Which governance level each tier needs is the author's judgment, not a standard.
Tiers 3 and 4 are what "controls automated in the platform, every agent inventoried" means in practice.
What each governance level means · See the governance pillar on the map
Six questions, one per layer
An AI agent is a new kind of user. Three things make it different from a person:
- It reads everything it is allowed to read, at once. A person with too much access rarely finds the file. An agent always does.
- It can mistake what it reads for an instruction. Text in a document, an email or a database field can steer it.
- It can act. Through tools it sends, books, changes and deletes, faster than anyone can watch.
Every control in the framework answers one of six questions:
- What can it see?Which data, for which purpose, down to row and column.Data foundation
- Who is acting?A person or an agent, which one, and on whose behalf.Identity & access
- What can it do?Which tools and actions, with or without a person, and how to undo or stop them.Agent runtime control
- What may it spend?Tokens, capacity and credits, against a budget someone owns.Economic control
- Can we prove what happened?Tests before release, monitoring, and records an auditor can read.Assurance & evidence
- Is it worth it?A named owner, a baseline, and a regular decision to keep it or stop it.Value & accountability
The building blocks
Six layers, from the data underneath to the value on top. Each block is one control you either have or you don't. Select a block to see what it is, who owns it and the authority tier from which it is required.
Directly accountable for
Ensures ownership of
The remaining 25 blocks, each accountable to one of the 5 personas. The CDAIO confirms that every block has a name against it.
Maintains
The passport and the tier classification, current for every workload in production.
- Can it do this safely?
- Should it consume resources this way?
- Is it delivering enough value?
Value
Foundation
Where this comes from
Two layers, as everywhere on this site: what is drawn from public guidance, and what is mine.
The framework synthesizes public guidance such as the NIST AI Risk Management Framework, ISO/IEC 42001 and Microsoft’s Cloud Adoption Framework for AI. The workload passport, the authority tiers and the value-trust-economics framing are the author’s own.