TBW / AI SECURITY / GOVERNANCE
AI Governance
Define who owns AI decisions, how risks are classified, which uses are approved and what evidence must be maintained.
Governance Is an Operating Model
A policy document alone does not govern AI. A workable model names owners, enforces decisions, reviews outcomes, retains evidence, escalates incidents and handles exceptions. Architecture, access controls, model routes and operational procedures must reflect those decisions.
Roles, Decision Rights and Ownership
| Role | Responsibility / decision right |
|---|---|
| Business owner | Sponsor the use case; accept business risk within delegated authority. |
| Data owner | Approve data use, classification and access conditions. |
| Security | Review threats and controls; recommend approval, rejection or remediation. |
| Privacy | Review personal-data processing, notices and retention. |
| Legal | Assess contractual and applicable legal constraints. |
| Platform owner | Operate shared model routes, access and configuration controls. |
| Application owner | Own the deployed use case and its change requests. |
| Reviewer | Review proposed outputs or actions and record decisions. |
| Operations | Monitor the service, respond to incidents and trigger escalation. |
Define who may sponsor, approve, reject, review, operate and accept residual risk in a written role matrix. A reviewer may reject an individual output without owning the overall use-case approval; risk acceptance belongs to an authorized owner, not the model.
Structured Use-Case Intake
Capture the business problem and expected impact; users and affected people; data classes and owners; systems and deployment location; proposed model/provider and tools; permitted actions and external exposure; human review points; failure consequences and escalation owner. This intake becomes the basis for an architecture review and an inventory entry.
Decision record
Document the proposed purpose, alternatives, decision maker and conditions.
Technical map
Trace data, model route, integrations and action permissions before access is granted.
Operational owner
Assign an owner for reviews, changes, incidents and retirement.
Contextual Risk Tiers
Lower risk
Internal drafting or summarization of low-sensitivity material, with review before use.
Moderate risk
Business recommendations or internal automation where an error could alter a process.
Higher risk
Consequential external action, regulated data or privileged tool use; require stronger scrutiny and controls.
These are illustrative operating tiers, not universal legal categories. Final criteria and approvals depend on the organization’s regulatory, contractual and business context. Reassess a tier when data, users, tools or autonomy change.
Approvals and Exceptions
Normal approval should record the authorized decision maker, scope, conditions and review date. A temporary exception needs an expiry, named risk owner, compensating controls and re-review. Emergency exceptions should follow a defined escalation path, be time-bound and receive retrospective review with evidence. Expired exceptions must not silently become permanent.
Enforce the outcome through access rules, deployment gates and model routing rather than relying solely on policy acknowledgement.
Policy Set and Shadow AI
Build a usable policy set for acceptable and prohibited AI use; approved tools; data handling and retention; provider review; agent/tool permissions; human oversight; logging; incidents and exception management. For unreviewed tools, define approved, limited-use and prohibited categories and offer practical approved alternatives so staff can complete legitimate tasks without bypassing the process.
AI Inventory and Lifecycle
Maintain an inventory of each application, model, provider and endpoint; owner and business use; data classes and tool access; deployment location and user population; approval conditions and next review date. Connect changes in provider, permissions, data source or user group to a renewed review. At retirement, revoke access and apply the retention plan.
Evidence and Frameworks
Keep approval records, risk decisions, provider reviews, policy acceptance, configuration evidence, appropriate logs, evaluation results, access reviews and incident records. Evidence should be accessible to authorized reviewers without exposing unnecessary sensitive content.
Frameworks such as the NIST AI Risk Management Framework can help structure governance activities; referencing a framework does not claim TBW certification or conformance. The Trust Center is a place to consult verified published evidence, not a substitute for a customer-specific review.
Implementation Approach and Deliverables
Start with current AI uses and decision owners; map intake and tiers; test the approval/exception path on a bounded use case; connect decisions to technical enforcement; then establish a regular review cycle and evidence collection.
Decision system
Governance operating model, role matrix and risk-tier model.
Working templates
Intake template, policy structure, inventory template and exception workflow.
Review practice
Review calendar, evidence checklist and escalation path.
Related: AI Security · Identity, Permissions and Guardrails · Secure Employee AI Adoption · AI Readiness Assessment
Frequently Asked Questions
Who approves a new AI use case?
An organization should designate decision makers by risk tier, with business ownership and input from data, security, privacy and legal roles where relevant.
Can a policy document alone govern AI?
No. Decisions need owners, enforceable access and model routes, review gates, evidence and a process for exceptions and incidents.
What happens when a use case changes?
Changes to data, provider, tools, audience or action permissions should trigger an updated inventory entry and risk review before promotion.
How should an emergency exception work?
Limit its scope and duration, record an authorized risk owner and compensating controls, then perform retrospective review and close or renew it explicitly.
Does referencing NIST AI RMF mean certification?
No. It can provide a useful structure for risk discussions, but this page makes no claim of certification or formal conformance.
Define Your Governance Path
Bring a proposed AI use case, its data and the people accountable for its decisions. We can map the intake, approval and review model.