How we govern AI
Controls built into how the automation runs.
Authority is set for each action, checked by something other than the AI that proposed it, and recorded every time. The same controls apply whether the AI runs on a commercial model, on infrastructure you control, or both.
Artrilogic AI
Answers from our published service information
Artrilogic AI
Answers from our published service information
01 / Human authority
Automation should increase human capability without removing human authority.
We decide authority one action at a time. One process usually has steps at every level. Here is a supplier invoice process as an example.
| Level | What it means | Example (illustrative) |
|---|---|---|
| Execute | AI acts within categories approved in advance. | The invoice matches its purchase order within tolerance, so it is posted. |
| Prepare | AI prepares the action and a person approves it. | A payment above the approval threshold is drafted and queued for sign-off. |
| Assist | AI recommends and a person decides. | AI suggests the ledger coding for an unfamiliar invoice line. |
| Escalate | Available from every level. Outside policy, confidence or authority, it stops and asks. | The supplier's bank details have changed, so the invoice goes to accounts payable. |
The rule of thumb: actions that are reversible and low-impact can run automatically. Actions that are irreversible, high-value or seen by customers are prepared for a person to approve. Anything outside policy, outside the AI’s confidence or outside its authority is escalated.
02 / The execution path
The system that does the work does not check its own work.
Every automated action follows the same path. The AI proposes. Policy and an independent check decide whether it can go ahead. Anything outside its authority goes to a person, and every step is recorded.
- 01IntentWhat the business is trying to do
- 02ContextWhat the AI is allowed to use
- 03ReasoningWhat it thinks should happen
- 04PolicyGATEWhether that action is permitted
- 05ValidationGATEChecked independently
- 06ExecutionThrough controlled systems and APIs
- 07EvidenceWhat happened, why, and on what basis
GatesPolicy decides whether an action is allowed. Validation checks the result, and it is done by something other than whatever proposed the action.
EscalationLow confidence, missing authority or a failed rule sends the decision to a named person.
EvidenceEvery step is recorded in a form your risk and audit teams can read.
03 / The controls
What governance is made of.
Specific mechanisms, each with an owner, each visible to your risk and audit teams.
Identity and permissions
What each automated step may read and change, enforced at the integration layer through identity, roles and least privilege.
Policy
The rules that decide whether a proposed action is allowed at all, written down, versioned and enforced in one place.
Validation
A check that the action meets your business rules, done by something other than whatever proposed it.
Execution limits
Value thresholds, rate limits and scopes that cap what automation can do in one step, revocable at any time.
Data boundaries
Which classes of data each step may use, and which models each class may reach.
Approvals and escalation
Defined routes to a named person when confidence, authority or policy requires it. The decision returns with their authority attached.
Evidence
A record of what happened, why, on what information, under what authority, and who approved it.
Evaluation and monitoring
Evaluation against agreed criteria before and after go-live, with drift detection, named owners and response paths.
Incident handling and rollback
A defined response when something goes wrong, and actions designed to be reversible so a wrong one can be undone as routine.
Accountable owners
A named person in your business for each automated process, the authority it holds, and the decision to change either.
Evidence record
Illustrative- Action
- Post supplier invoice to accounts payable
- Done by
- Matching rules, with a language model reading the invoice
- Authority level
- Execute, within the approved tolerance
- Information used
- Invoice, purchase order, goods receipt
- Policy checked
- Three-way match and supplier status
- Independent check
- Match confirmed
- Approver
- Not required at this authority level
- Outcome
- Posted. Record kept with the transaction.
Permissions are enforced where automation meets your systems: MCP servers, API gateways and identity, and the infrastructure controls underneath them.
04 / Where AI runs
Three deployment options, one set of controls.
Where AI runs and what it may do are separate questions. Private deployment decides where sensitive work is processed. It does not by itself make a use of AI governed or compliant, and cloud-hosted AI can be governed just as well.
Approved commercial models
Commercial models under contract, reached through the same gateway and policy. Enough for many processes, and for most internal and public information.
Hybrid
Sensitive steps run on infrastructure you control; everything else uses approved commercial models. Policy decides which route each class of data takes.
Private AI
Models in your data centre, on dedicated infrastructure we run for you, or fully air-gapped, for workloads where the data should not leave your boundary.
About Private AI
Security, privacy, data residency and compliance are four different claims. We state each at its actual scope: a private deployment can settle residency, but whether a use is compliant depends on what the AI is allowed to do with the data, and that is what the controls above decide.
05 / Our governance baseline
A starting point we maintain and tailor.
We start from a governance baseline we maintain and refine, then tailor it to your processes, systems and risk. Each engagement builds on what earlier ones refined.
The baseline includes
- An authority model with Assist, Prepare and Execute levels and escalation routes
- Policy and validation patterns for common action types
- An evidence record design your audit team can read
- Integration controls: identity, permissions, rate limits and audit at the edge
- Observability, evaluation and drift detection
- Data classification and model routing for private and commercial inference
We tailor it to
- Your processes and who holds authority in them
- Your systems and how they can be reached
- Your risk appetite and approval thresholds
- Your regulators and audit expectations
- Where your data is allowed to go
06 / Across all our work
These controls are not reserved for a separate governance engagement. They apply when we automate a process, when we modernise a system with AI-assisted engineering, and when we build a product with AI features that touch customer data.
The same approach, applied to modernising .NET systems.
Work goes to the best tool for each task, every result is checked independently, and a change is accepted only on evidence agreed before the work started. A named senior engineer makes the decisions no tool should make.
Common questions
What risk and audit teams ask.
What will our auditors see?
For every automated action: what was proposed, the information used, the policy applied, the validation result, the approver where one was needed, and the outcome. We design the record with your risk and audit teams so it answers the questions they already ask.
Do we need Private AI for this?
Not necessarily. Governance controls what AI is allowed to do. Private AI controls where sensitive inference happens. Some processes need both. Many can use approved commercial models through the same gateway and policy.
Can we change an authority level later?
Yes. Authority is set one action at a time and owned by a named person. Moving a step from Prepare to Execute, or back, is a recorded decision, usually made once the evidence shows how the step performs.
More on governance
Keep reading.
- WhatWhat AI governance isDeciding what AI may see, recommend and do, under whose authority, with a record of what happened.Read more
- WhyWhy govern AISecurity and compliance risk, traceability for audit, and the confidence to adopt useful AI.Read more
- WhoWho it is forWhat governance gives each of four roles in a business.Read more
Start with one process
Set the limits before the AI acts.
Bring one process, or the AI tools your team already uses. We will show you the authority each step needs, the controls that enforce it, and the record it should leave.