10.4 Organizational policy, and what to do without one

In everyday life. A building's fire exit is always locked, so people who need a way out keep a side door open. Another sign about the side door will not fix the problem. Unlocking the fire exit will.

What you will learn. How to follow your organization's AI policy, what to write when it has none, and how to keep a one-page record of the answers for each kind of work that matters. You practice it in step 8 of the lab.

Why it matters. Written answers, each with an owner, show what was decided and when to look again.

An AI policy is the organization's answer, given in advance, to the questions in 10.1 to 10.3: which uses are allowed, what data may go in, and by which route, the way the data reaches the AI. Follow it as written. When it is unclear, ask its owner. Do not read it in your own favor.

Brightline, the book's example company, had no AI policy. When there is none, do not invent one and call it official.¹ Instead, write an interim proposal, a proposed temporary policy, for the person who owns the risk to approve. That is the manager who answers if something goes wrong: at Brightline, Dave, the controller. Until that person approves it, it is only a proposal. One page is enough:

• the approved AI products and routes for work data
• the kinds of data that someone must check before use
• the review rule for anything the worker produces that leaves the company or affects someone
• the review rule for new connectors, skills and actions, which let the worker reach or do more, and who may switch on settings that skip approvals (Chapter 7)
• one named person for questions, and for reports when something goes wrong

Once approved, the policy is knowledge like any other. It goes into the KSoR, the Knowledge System of Record, as concepts, short files that each hold the rules for one topic. Each has an owner and an approval. So AI Workers answer from the approved version (10.6).

A policy can also fail by being harder to follow than to ignore. Maria, the office manager, used her personal AI account because the company's AI workspace felt slow. Work data flowing through tools or routes the organization never approved is shadow AI. Shadow AI grows wherever the approved way takes ten steps and an unapproved tool takes one. A slow approved way does not excuse shadow AI. But it does tell you what to fix. Ask, "What makes the approved way harder than the unsafe way?" Fixing the slow way removes more risk than another email reminding people of the rules.¹

For each workflow that involves someone else's data, money or a decision about a person, write the answers down. A workflow is the series of steps a team follows to finish a piece of work. A Governance Record is one page per workflow. It holds the classification and its deciding factor, the data tier and route, and the capabilities turned on, such as connectors, skills and actions. It also holds who is affected, the evidence that the controls work, an owner, and what triggers a re-check. Re-check when any of these change:

• the model, the AI the worker runs on
• a product feature, a connector or a permission
• the data, or the audience, the people who get the work
• the policy, or the AI vendor's terms
• the business consequence, what a mistake would cost

"We approved it last year" means nothing if the thing approved has changed. If you do not know an answer, leave its field blank and mark it open. Do not guess.¹

Governance, the decisions behind how you use an AI Worker, weakens over time. A review becomes a quick look, and a connector keeps access after the project ends. So every three months, audit a small sample of what people actually do. Audit the process, not the person, or people will show only their cleanest work.