Disciplines → 4 of 6
The four control pillars applied to AI usage, enforced in the systems you already run and proportionate to the risk of the work.
Governance & Guardrails decides which AI tools, agents and integrations the organisation uses, what they may reach, do and decide, how their use is proven and how problems are detected. It gives the second line controls to assure that are enforced, not merely written down.
Governance here is proportionate by design. The risk tier of the work sets the controls: low-tier work passes automated checks and moves on, and scrutiny concentrates on high and critical work where a mistake is expensive or irreversible. Controls live in the pipeline, the identity platform and the tracker, not in a separate approval queue.
| Practice | Today | With Governance & Guardrails |
|---|---|---|
| Information-security policy | Acceptable-use rules for systems and data | Adds a short AI usage policy keyed to risk tiers: approved tools, data boundaries, who decides at each tier |
| Risk register | IT and operational risks per system | AI use cases, agents and providers registered with an owner, a tier and the controls that cover them |
| Vendor management | Due diligence scaled to supplier criticality | AI providers assessed on data use, retention, sub-processors, incident notification, audit rights and exit |
| Change advisory | Board reviews changes by category | Low and medium-tier AI-assisted changes become standard changes; the board spends its time on high and critical |
| Internal audit plan | Periodic audits of IT general controls | Covers AI-assisted work: tests that tier gates, provenance and kill switches operate as designed |
Most AI usage policies fail by length: a list of prohibitions nobody reads, out of date as soon as a new tool ships. Keep the policy to a page or two: which tools are approved for which data classes, what AI may do at each risk tier, who owns the decision at each tier, and how to request a new tool. Everything else lives in the controls that enforce it. A policy that says what is allowed keeps use inside sanctioned tools; one that only forbids pushes it onto personal accounts.
What is not visible cannot be governed. The inventory lists the AI tools, agents, integrations and use cases in operation, each with an owner, a tier, the data it can reach and the provider behind it. It is not a separate spreadsheet but a view of the element register, filtered to AI-specific elements. Discovery closes the gap: identity logs, network egress, browser extensions and expense claims reveal use that never went through a request.
Every hosted model, assistant or agent platform is a supplier processing your data. Contracts should settle whether inputs and outputs may be used for training, how long they are retained and where, which sub-processors are involved, how quickly incidents are notified, what audit and information rights you hold, and how you exit with prompts, context and logs intact. EU financial entities already manage these providers under DORA's ICT third-party risk rules; AI providers belong in the same register and the same exit planning, not on a side list.
A guardrail that exists only in a document is an intention. Express the rules where work runs: the pipeline's policy gate maps each change's tier to its required approvals, provenance checks fail unmarked changes, agents run as non-human identities with least privilege and short-lived credentials, and egress rules keep sensitive data away from unapproved providers. Policy code is versioned and reviewed like any other change, so the audit trail shows which rule applied at the time.
Every tool, agent and integration needs a fast way to stop it: revoke its credentials, disable the integration, block the provider at the network edge, fall back to the manual path. Name who may pull each switch and set a target time to revoke. Then pull it in a planned exercise: confirm the agent actually stops, nothing retries with cached credentials, and the work continues without it. A kill switch that has never been pulled is an assumption.
Delivery teams own and operate the controls on their own AI use: they tier the work, run the gates and keep the inventory current. Second-line risk and compliance set the policy, define control standards per tier and assure that they work, drawing on self-monitoring data rather than questionnaires. Internal audit tests the arrangement independently, including sampling AI-assisted changes back to their approvals. No one outside the team becomes a gatekeeper for low-tier work.
| Tier | Prevent (Guardrails) | Prove (Audit Trail) | Detect (Self-Monitoring) |
|---|---|---|---|
| Low | Approved tool catalogue; no sensitive data classes; automated policy checks | Use recorded in the inventory; provenance on changes | Use outside the catalogue flagged from identity and egress logs |
| Medium | Tier gate in the pipeline; agents with scoped, short-lived credentials | Approvals and policy version recorded with the change | Second-line sampling; usage drift per tool and team |
| High | Provider fully assessed as a third party; tested kill switch; specialist approval | Evidence bundle retained; agent access recertified | Alerts on anomalous agent actions; results reviewed by the second line |
| Critical | AI may inform, never decide or act, enforced by permissions, not policy text | Documented rationale; second-line sign-off | Any AI action in scope raises an incident; internal audit samples every cycle |
The EU AI Act takes a risk-based approach, as ScaledAIOps does, but the two classify different things: the Act classifies AI systems by their use (prohibited, high, limited, minimal risk); ScaledAIOps tiers classify work. The inventory records both. Staff of deployers need sufficient AI literacy (Art. 4), which the short policy and enablement support. Where a system in use is high-risk, deployer obligations apply (Art. 26): use in line with the provider's instructions, human oversight by competent people, monitoring of operation and retention of logs, which the pillars supply. AI used to evaluate or monitor workers is high-risk (Annex III, point 4), so governance measures teams, never individuals.
ISO/IEC 42001 frames the pillars as an AI management system: Assess maps to performance evaluation (clause 9), Prevent to planning and operation (clauses 6 and 8), Prove to documented information (7.5), and Detect to monitoring and improvement (9.1, 10).