Governance

Governance is the part of AI work that gets talked about least and decides most. It answers one question: how do you know what the agent is actually doing?

Not what it was designed to do, and not what it did in the demo. What it does on a Tuesday, on the cases nobody anticipated.

What is AI governance?

AI governance is the set of practices that let you say what an automated system is actually doing, rather than what it was designed to do. In this context it comes down to three things: a written standard to measure against, a way of testing against it on purpose, and a record complete enough to reconstruct any decision afterwards.

Compliance frameworks describe the paperwork. This page describes the work.

Three separate things

Boundaries are what the agent is measured against: the written statement of what it may decide alone, prepare for approval, or never touch. Without that document there is no standard to test against, only opinions about whether the output looked reasonable.

Adversarial testing is deliberately trying to make it behave badly, before a customer does it by accident. Covered under adversarial testing.

Audits and logs are the record that lets you reconstruct any decision afterwards. Covered under audits and logs.

All three assume someone is watching. Where that person sits and how the work reaches them is under interfaces.

The failure rate is a reported number

Every report includes what the agent got wrong: the cases it handled that a person had to correct, and the ones it escalated that it should have handled. Both directions matter, and the second is the one that quietly erodes the business case.

A supplier who reports only successes is reporting on their own performance rather than on your operation. That is a different document and it is worth less.

Why this is not a compliance exercise

It is tempting to treat governance as paperwork for the audit. It is not: it is how you find out that your agent has been misreading a category of invoice for six weeks.

An agent that fails does not usually fail loudly. It keeps running and starts being wrong, and the interval between those two states is exactly as long as it takes someone to check. Governance is what shortens that interval.