AI governance
The rules, owners and checkpoints that decide what an AI system may access, decide and change, and who answers when it goes wrong. Governance that treats every agent the same is a weak control.
AI governance is the set of decisions about access, autonomy and accountability for AI systems. It answers who approves a use case, what data and tools the system can reach, which decisions it may take alone, and who is responsible when a decision is wrong.
Governance that applies one uniform policy to every agent misses the point. Autonomy and the scope of access are different things and should be controlled separately. A low-risk assistant and an agent that can act in a customer system need different checkpoints.
Most organizations are still early here. Governance is often written before the systems are in production, then discovered to be missing once agents are already acting. See decision rights and task-scoped authority.
Related terms
Decision rights
Who may decide what, on which evidence, and who can stop or reverse it. Without explicit decision rights, faster AI output turns into a queue of approvals nobody owns.
Task-scoped authority
A temporary authorization envelope for one AI-agent task, limited by allowed action, resource, consequence, duration and recovery conditions rather than broad standing role permissions.
Guardrails
Controls placed around an AI system — input and output checks, permission limits, review steps and escalation rules — that keep its behaviour within acceptable bounds.
NIST AI RMF
The NIST AI Risk Management Framework: a voluntary, use-case-agnostic US framework for managing AI risks. NIST's related work also stresses monitoring deployed AI systems after launch.