AI Governance

Governance built in, not bolted on

SMB buyers rarely have an AI governance function, and enterprise buyers need evidence for one. AI Governance, planned for W1, gives both the same controls.

Know every agent

The agent register lists every agent, whether rented, tenant-built or utility, with owner, supervisor, class, template version, skills, maximum risk tier and autonomy distribution. An agent map shows each agent's owner, skills, knowledge scopes and connections. Monthly access reviews cover agents with R3 skills and flag unused skills for removal.

Assess before access

A risk assessment runs before any data access: skills times risk tiers times data classification times external exposure gives a score and band, and production needs approval. Tenant AI policy sets allowed model providers and classes, data classification limits and prohibited skill categories such as covert employee monitoring. Non-configurable hard policies apply everywhere: never claim to be human, R4 never above A2, agents never approve their own proposals.

Stop it fast

Kill switches work at four levels: K1 skill, K2 agent and K3 tenant from W1, with K3 scoped to a department and quarterly drills later, and K4 platform-wide for One3. A drill scheduler records measured stop times as audit evidence. Runtime detectors catch runaway cost and repetition loops, with message storms, deadlocks and oscillation added later.

When something goes wrong

The AI incident log has severities S1 to S4 with automatic responses from a discipline matrix: log, demote, suspend a skill and external channels, or trigger a kill switch. The incident workflow contains, reverses or compensates per reversibility class, and notifies the tenant and, where a personal-data breach requires it, authorities (to be verified). A blast-radius query finds every object an agent changed in a time range and proposes bulk reversal grouped by reversibility class. Just-in-time elevation is bound to one object and expires after use.

Evidence and fairness

Model cards document models, eval results, limitations, data sources and intended use. Bias audits are planned for HR screening, review and credit-adjacent roles, and people-affecting roles need a deployment checklist. ISO 42001 control mapping and EU AI Act documentation are planned (requirements to be verified with auditors). A governance dashboard shows autonomy distribution, promotions, demotions, incidents and drill results.