AI operations
Governance
AI governance model
A scalable governance model for agentic workflows: autonomy per action, fail-closed controls, auditability, and safe reruns.
Principles
These keep AI usable and safe for real operations.
- AI assists, does not silently decide: anything that commits budget or changes financial truth routes to approval.
- Explicit autonomy per action: choose assist, execute, or approve, and document why.
- Traceability: every action stays tied to an identifier and audit trail.
- Deterministic fallback: when AI fails, the workflow falls back to deterministic behavior or fails closed.
Assist (draft-first)
assist
AI drafts suggestions. Humans review and decide. Nothing is silently committed.
Examples
- Draft a vendor quote summary for review
- Suggest line matching across vendors
- Draft a reply for operator approval
Execute (low-risk, reversible)
execute
AI can execute low-risk steps automatically when they are reversible and auditable.
Examples
- Extract structured fields into a draft record
- Queue exceptions and missing evidence
- Notify operators of deterministic failures
Approve (commitment/money)
approve
Humans must explicitly approve before money-impacting actions or commitments.
Examples
- Award decisions that commit budget
- Issuing purchase orders
- Payments and postings
Fail-closed permissions
Authorization must deny by default.
- Permission checks are required for each action category.
- Tenant isolation is explicit (platform_user_id scoping).
- Never trust client-side claims for permissions or tenant context.
Evidence-first reviews
Make review decisions fast and consistent.
- Attach source documents and references to the action chain.
- Surface uncertainty as flags (not hidden probabilities).
- Keep an audit trail of draft changes and final approvals.
Safe re-runs
Assume failures; design for retries.
- Retries must not create duplicates or erase history.
- Prefer idempotent operations with stable keys where applicable.
- Operators should be able to explain “what ran” and “why it failed”.
Follow into workflows
Concrete operational docs, not theory.