Operational frameworks for enterprise AI governance.

Download Word version View on Zenodo

Start here

Find your starting point.

Answer two questions. Land on the right place to begin.

The five stages, in order.

Governance works as a sequence. Name the problem, measure what exists, decide before go-live, govern after, keep the record.

015 concepts
Name the risk
Learn the problem language.
The concepts that make the governance failure visible.
023 frameworks
Diagnose
Measure what you already have before designing anything new.
Find the gap between deployed agents and approved records.
034 frameworks
Authorize
Decide and record what an agent may do before it goes live.
Create the decision structure before deployment.
042 frameworks
Operate
Govern drift, detection, and coverage after an agent is live.
Keep authorization current as systems change.
051 document
Keep the record
Turn the decision into the artifact an examiner reads.
Make the authorization evidence inspectable.

All five stages design one thing the operational governance stack assumes already exists: the authorization layer.

Core concepts

5 concepts

The language of the governance problem.

Start here. These concepts name the failure patterns that make agent governance visible before the organization tries to control them.

Use this section to diagnose what kind of governance failure you are seeing. Then move to the frameworks section to choose the control that addresses it.

5 concepts

The Governance Debt

The accumulated accountability design work deferred while deploying AI at speed. It builds the moment a deployment goes live without authorization, a named owner, or a compliance review. It becomes visible when an examiner asks a question nobody can answer.

Intent Gap

The unplanned divergence between what an organization genuinely intended an AI system to do and what it actually does in production. Not deliberate misrepresentation, but a runtime gap governance must measure after use begins.

The Accountability Assumption

The implicit belief that accountability for an AI agent's decisions resides with the vendor, the platform, or another team. It doesn't. And regulators have started saying so explicitly, regardless of what contracts say.

Agent Sprawl

Three tiers of uncontrolled AI proliferation: employee shadow AI, organizational procurement without central visibility, and authorized agents with over-permissive operational scope. Each tier requires a different governance response.

Intent Architecture

The organizational design layer that defines purpose, boundaries, and accountability before any agent goes live. The difference between a governance posture that holds under examination and one assembled under pressure after something goes wrong.

Operational frameworks

9 frameworks

Operational control points for enterprise AI.

Use these when the organization needs a decision structure, an authorization record, or a repeatable governance process.

Use this section to select the control point: pre-deployment authorization, post-deployment response, ownership, reconciliation, or audit evidence.

9 frameworks

Diagnose

Measure what already exists before you design anything new.

Diagnose

The Governance Readiness Matrix

Agent count versus authorization coverage. Designed for environments where the agent inventory and the authorization record had never been compared.

Diagnose

The Tenant Agent Reconciliation Framework

Five steps for reconciling what your tenant actually contains against what your organization formally approved. Designed for situations where platform visibility and formal approval records do not match.

Diagnose

Agent Substrate Readiness Model

A two-tier diagnostic for regulated enterprises deploying AI agents across systems of record. Built for the case where the substrate becomes governance infrastructure before it is ready.

Authorize

Decide and record what an agent may do before it goes live.

The Intent Architecture Stack

The three organizational layers every enterprise must design before any agent goes live. Built for the case where the authorization question arrives after go-live, not before.

The Organizational Agent Controls

Five governance decisions every enterprise must make before any agent goes live. Built for the case where access enforcement exists but organizational permission has not been written down.

The Deployment Accountability Map

Three tiers. One deployment. A map of who owns what across the provider, the platform, and the deploying organization. Designed for situations where the deployment decision creates accountability that cannot be delegated.

Chain Authorization Gap

When the chain acts, which authorization record covers it? Designed for deployment patterns in which several agents act together and no single approval record covers the chain.

Operate

Govern drift, detection, and coverage after an agent is live.

Operate

The Disposition Protocol

Six requirements that convert a signal into a formal governance decision. Designed for situations where detection infrastructure is mature and decision infrastructure does not exist.

Operate

The Authorization Coverage Lifecycle

Three phases every organization moves through as its ratio of governed agents to total agents changes. Built for the case where authorization coverage lags behind agent growth.

Quick checks

6 reference cards

Working-session reference cards.

One-page instruments for board reviews, team workshops, audit preparation, and fast governance triage.

Use this section when the question has moved from understanding to action. These are designed for meetings, workshops, and fast internal reviews.

6 reference cards

Quick check

Governance Readiness Matrix

Calculate your Governance Debt Ratio and identify your quadrant.

Quick check

Intent Architecture Stack Checklist

Twelve governance items across three layers before any agent goes live.

Quick check

Governance Debt Calculator

Four steps from deployment count to ratio to remediation priority.

Quick check

Deployment Accountability Map

Three tiers. Map who owns what before the agent goes live.

Quick check

Tenant Agent Reconciliation Sprint

Five steps from M365 inventory to shadow agent count.

Quick check

Intent Gap Monitoring Check

Baseline, comparison, and trigger conditions for every agent in production.