6 Guidelines for Governing AI

For years, the standard path for a builder was simple: write the queries, build the models, and ship the pipelines. You were the one pulling numbers out of the ether to predict what a customer might do next. I spent the early part of my career doing exactly that, scaling teams at massive retailers like Best Buy and Target. The goal back then was purely execution.

But the ground is shifting. Today, leading AI transformation at a place like Lowe’s, I see a different reality. The job isn’t just to sell a shiny AI tool; it’s to embed utility into the exact moment a customer is staring at a leaky faucet. As these agents become the frontline, the role of the technologist is changing. We are moving from building systems to governing them. If you are a founder or an engineer, you need to understand the "governor shift.”

The GenAI Divide

There is a massive gap in the market right now. A recent report from MIT Media Lab’s Project NANDA pointed out that despite $40 billion flowing into enterprise generative AI, only about 5% of organizations are seeing actual, measurable profit. This is the GenAI Divide. The losers aren’t losing because they lack technology; they’re using the same models as everyone else. They are losing because they lack the people capable of directing those systems and standing behind the output.

To cross that divide, you have to stop being "human middleware." We’ve all been there—spending half our week pulling data from one tool, reformatting it, and shipping it to another. That is the administrator trap. AI agents are great at relaying information, but they are terrible at judging which risks are real. Your value isn’t in the transfer; it’s in the judgment.

Principles Over Rules

In the old world, we managed with rules. If a refund hit a certain dollar amount, you needed a manager's signature. If you wrote code, you needed two reviewers. Rules are fine for human speed, but they shatter when a system makes thousands of decisions per hour. When a customer complaint touches three different policies at once, a rulebook freezes.

Governing AI means trading those rules for a library of principles. You have to write them in priority order so the agent can resolve its own conflicts. For example: 1. Never harm the customer. 2. Tell the truth, even if we lose the sale. 3. Protect the margin. This is core leadership work. You aren’t just writing code; you are writing your culture into that code.

The Three-Layer Governance Stack

• The Constitution: These are the unbreakable laws. The agent must never state a fact it cannot support with data.
• The Doctrine: This defines how you compete. Do you value a long-term relationship over a quick buck? This layer guides the trade-offs.
• The Playbook: These are the specific tactics for individual tasks.

The Trust Thermostat

Most AI deployments stall because someone in leadership asks: "What if it quotes the wrong price to our biggest client?" Usually, companies respond with two extremes: they either let the AI run wild or they force a human to review every single output. The latter kills the ROI of automation entirely.

The solution is a trust thermostat. Every decision an agent makes gets a confidence score based on your principles. If the score is high, it ships. If it’s low, it hits a human for review. The beauty of this is the feedback loop; the human’s decision is fed back into the system, raising the thermostat for the next time. This creates a "glass box" where every action is auditable and explainable.

The CCRAG Framework

You cannot govern what you cannot see. Most enterprise AI fails because the data is scattered across incompatible silos. I look at this through the lens of CCRAG: Connections, Context, Reasoning, Actions, and Governance. Most people obsess over the "Reasoning" (the model) and ignore the rest.

You need a context graph that weaves raw information into a single picture of the business. This gives the AI a form of memory. Governance sits at the end of this chain, ensuring that the actions taken are aligned with the original intent. The more context you feed the system, the harder that system is for a competitor to replicate. Context compounds.

Managing by Exception

The hardest habit to break is the urge to check every number. We’ve been conditioned to hunt for errors in every report. But in a governed system, you have to learn to lead by exception. The machine handles the routine; you handle the ambiguous, the high-stakes, and the unfamiliar.

This feels like losing control, but it’s actually the only way to scale. It allows a company to grow its output without ballooning its headcount. You aren’t being removed from the process; you are being raised above it. Your job is no longer to do the work, but to exercise judgment and taste.

Doing was never really the job. Judgment was. Doing was just how we expressed it.

Judgment tells you if an answer is technically sound. Taste tells you if the question was even worth asking. A machine can generate a hundred defensible options, but it can't tell you which one is best for your brand. This transition rewards the systems thinkers and the people who are honest about failure modes. The tools are new, but the discipline of engineering remains the same. If you treat governance as the work itself, rather than a distraction from the work, you'll be the one building what's next.

Read the original at IEEE Spectrum →