AI Governance Controls

AI System Risk Classification

Assign every AI system a risk tier that determines the oversight requirements, review frequency, and documentation standards applied to it.

HOC-002

Human Approval Gate for Consequential AI Decisions

Require a qualified human to review and approve AI-generated recommendations before they produce irreversible or high-stakes outcomes.

HOC-005

Reviewer Competency Requirements

Define minimum competency requirements for humans who review, approve, or override AI-generated outputs in high-risk contexts.

HOC-006

Override and Escalation Procedures

Document the procedures, authority levels, and logging requirements when humans reject, modify, or escalate AI-generated decisions.

AGT

Agentic AI

24 controls

AGT-001

Agent Permission Boundaries

Apply least-privilege principles to AI agents by explicitly defining and enforcing the tools, APIs, data sources, and actions each agent is authorized to access.

AGT-002

Agent Prompt Injection Defense

Protect AI agents from prompt injection attacks — adversarial instructions embedded in external content that hijack agent behavior.

AGT-003

Agent Memory and Context Governance

Define policies governing what AI agents store in memory or persistent context, how long it is retained, who can access it, and under what conditions it is deleted.

AGT-004

Multi-Agent Trust Hierarchy

Define explicit rules for which agents can instruct, invoke, or delegate authority to other agents in multi-agent systems.

AGT-005

Human Approval Gate for Irreversible Agent Actions

Require explicit human approval before an AI agent takes actions that are difficult or impossible to reverse, such as sending communications, modifying records, executing transactions, or deleting data.

AGT-006

Agent Action Audit Trail

Log every tool call, decision step, memory read/write, and external interaction made by an AI agent so that the full action sequence can be reconstructed after the fact.

AGT-007

Agent Scope and Task Boundaries

Define and enforce the boundaries of what an AI agent is permitted to do, preventing it from expanding its activity beyond its intended purpose.

AGT-008

Agent Environment Isolation

Run AI agents in isolated execution environments that limit their ability to access host systems, network resources, or data beyond what their task requires.

AGT-009

Agent and Non-Human Identity Management

Issue every AI agent a distinct, bounded identity with scoped credentials, a defined lifecycle, and access controls — rather than sharing service accounts or running under user identities.

AGT-010

Agent Knowledge Source Integrity

Validate that documents, databases, and external sources retrieved by AI agents during task execution have not been tampered with, poisoned, or substituted with adversarial content.

AGT-011

Agent Behavior Monitoring and Anomaly Detection

Continuously monitor deployed agents for behavioral drift, unusual tool call patterns, unexpected resource consumption, and actions outside their defined operational envelope.

AGT-012

Agent Kill Switch and Emergency Stop

Maintain the operational capability to halt any running agent session, workflow, or agent class immediately — without relying on the agent itself to stop — and recover to a known-safe state.

AGT-013

Kill-Switch Propagation Testing

Regularly test that halt commands propagate correctly through all subagent layers and parallel orchestration environments, stopping all agent activity within a defined time window.

AGT-014

Multi-Agent Delegation Chain Logging

Log and attribute every action in a multi-agent system with sufficient detail to trace any action back to its originating instruction, authorized agent, and human principal.

AGT-015

Agent OAuth Scope Drift Detection

Monitor OAuth token scopes granted to AI agents and alert when scopes exceed the originally authorized set or when new permissions are acquired outside the formal provisioning process.

AGT-016

Agentic AI Deployment Readiness Assessment

Require a structured pre-deployment readiness assessment for tool-enabled AI agents, verifying that key governance controls are in place and that the agent's impact on connected systems has been evaluated before go-live.

AGT-017

Agentic Autonomy Expansion Criteria

Define standardized criteria for incrementally widening an AI agent's autonomy thresholds after initial deployment, ensuring that autonomy expansions are deliberate, evidence-based, and approved through the same governance process as initial deployment.

AGT-018

Agent Data Modification Blast-Radius Containment

Define and enforce limits on the scope of data resources a single AI agent can modify, ensuring that an agent malfunction, misuse, or prompt injection cannot propagate data corruption beyond a bounded and recoverable scope.

AGT-019

AI Tool and Plugin Supply Chain Risk Assessment

Assess and manage supply chain risk from third-party tools, plugins, and extensions used by AI agents, including AI-generated code committed to production repositories, applying software supply chain security controls at the AI extension layer.

AGT-020

RAG Retrieval Boundary Controls for Regulated Data

Implement retrieval boundary controls in RAG (retrieval-augmented generation) pipelines to prevent regulated, classified, or out-of-scope data from entering an AI agent's context window, reducing the risk of unauthorized disclosure or cross-contamination of sensitive information.

AGT-021

Human Oversight Classification Rationale Log

Require documented rationale for each decision to classify an agentic AI action as requiring human-in-the-loop (HITL) or human-on-the-loop (HOTL) oversight, creating an auditable record of the reasoning behind oversight design choices.

AGT-022

Agentic AI Governance Tooling Attestation

Require vendor attestation for platform-level tools used as primary agent oversight controls, validating that telemetry is complete, tamper-evident, and sufficient for governance purposes before the tool is relied upon as a control.

AGT-023

Agentic AI Security Assessment — CBRN and Cyber Espionage

Conduct a threat-model assessment of agentic AI deployments covering high-consequence misuse vectors, including chemical, biological, radiological, and nuclear (CBRN) facilitation and AI-orchestrated cyber espionage, and implement mitigations proportionate to the identified risk.

AGT-024

AI Permission Escalation Tabletop Exercise Program

Conduct recurring tabletop exercises that simulate AI agent permission escalation and propagation scenarios, testing whether existing controls contain the escalation, incident response teams can detect and respond effectively, and governance processes are sufficient.

SEC

Security

5 controls

SEC-001

Prompt Injection Prevention

Detect and block adversarial inputs designed to override AI system instructions, extract sensitive information, or cause the model to behave in unintended ways.

SEC-002

AI System Access Controls

Apply authentication, authorization, and role-based access controls to AI systems, APIs, and the sensitive data they process.

SEC-003

Sensitive Data Handling in AI Pipelines

Prevent personally identifiable information, credentials, health data, and other sensitive content from entering AI models, prompts, or logs inappropriately.

SEC-004

AI API Credential Management

Securely manage, rotate, and audit API keys and credentials used to access AI services and model providers.

SEC-005

Adversarial Robustness Testing

Systematically test AI systems against adversarial inputs, edge cases, and known attack techniques before deployment and on a recurring basis.

ALC

Audit & Logging

2 controls

ALC-001

AI Decision Logging

Record AI system inputs, outputs, model version, confidence scores, and contextual metadata for every decision that affects individuals or business outcomes.

ALC-002

High-Risk AI Audit Trail

Maintain a comprehensive, tamper-evident audit trail for AI systems operating in regulated domains, covering the full lifecycle from input to decision to outcome.

CHM

Change Management

3 controls

CHM-001

AI Model Version Control

Track model versions, configurations, prompts, and deployment history so that any production state can be reproduced and compared.

CHM-002

Model Deployment Gate Process

Require formal approval before new model versions, prompt changes, or configuration updates are deployed to production AI systems.

CHM-003

Model Rollback and Emergency Shutdown

Maintain tested procedures to rapidly revert an AI system to a prior version or disable it entirely in response to detected failures or safety events.

DGC

Data Governance

3 controls

DGC-002

PII Handling in AI Systems

Establish controls governing how personally identifiable information is handled when it flows through AI inputs, outputs, training pipelines, and logs.

DGC-004

AI Output Retention and Deletion

Define and enforce retention schedules and deletion procedures for AI-generated content, decisions, and the personal data contained within them.

DGC-006

AI-Generated Code and Open-Source License Compliance

Establish controls to identify, track, and manage open-source license obligations and supply chain risks introduced by AI-generated code before it is committed to production systems.

MON

Monitoring & Drift

2 controls

MON-004

AI Output Anomaly Detection

Automatically detect unusual, unexpected, or potentially harmful AI outputs in production for investigation and response.

MON-006

Behavioral Anomaly Detection for Agentic Systems

Implement monitoring that detects when AI agents deviate from their expected behavioral envelope — unusual action sequences, unexpected resource access, or goal-directed behavior inconsistent with assigned tasks.

SAF

Safety & Reliability

6 controls

SAF-001

Hallucination Detection and Mitigation

Implement controls to detect, reduce, and manage AI-generated factual errors and fabrications before they reach end users or inform decisions.

SAF-002

AI Output Validation

Validate AI-generated outputs against defined quality, safety, and format criteria before they are presented to users or used in downstream processes.

SAF-003

AI Graceful Degradation

Define and implement fallback behavior for AI systems when they are unavailable, underperforming, or producing outputs below acceptable quality thresholds.

SAF-004

AI Reliability Testing

Systematically test AI systems for consistency, repeatability, edge-case handling, and behavior under load before deployment and on a recurring basis.

SAF-005

Harmful Content Filtering

Apply input and output filtering to prevent AI systems from generating or acting on harmful, toxic, illegal, or policy-violating content.

SAF-006

Post-Deployment Adversarial Testing Cadence

Schedule and execute recurring adversarial testing of production AI systems on a risk-tiered cadence, separate from and in addition to pre-deployment red-teaming.

IRC

Incident Response

6 controls

IRC-001

AI Incident Classification

Define a taxonomy for AI incidents that categorizes events by type and severity, determining the appropriate response urgency and notification requirements.

IRC-002

AI Incident Response Playbook

Document step-by-step procedures for identifying, containing, investigating, and resolving AI system incidents, including role assignments and escalation paths.

IRC-003

AI Harm Notification Procedures

Define procedures for notifying regulators, affected individuals, and other required parties when an AI system causes or contributes to harm.

IRC-004

AI Post-Incident Review

Conduct a structured review after every significant AI incident to identify root causes, contributing factors, and systemic improvements.

IRC-005

AI Incident Log and Tracking

Maintain a centralized, structured log of all AI incidents, near-misses, and governance concerns, accessible to the AI governance function.

IRC-006

Cross-Jurisdictional Incident Reporting Tracker

Maintain a live tracker of incident notification deadlines across all jurisdictions where the organization operates AI systems, pre-mapped to the incident categories that trigger each obligation.

MGV

Model & Program Governance

7 controls

MGV-001

AI Model Preview and Staged Release Policy

Establish an internal policy that distinguishes preview and experimental AI system access from approved production deployment, and requires documented governance sign-off at each release stage before a system advances to broader use.

MGV-002

AI System Intake and Approval Workflow

Define a standardized intake process for all new AI system deployments that captures use case, data classification, risk tier, and ownership before the system enters the organization's environment, with cross-functional approval routing and GRC recordkeeping.

MGV-003

AI Governance Program Milestone Framework

Define structured governance milestones — evaluated at intervals across a deployment's lifecycle — that must be completed before an AI system advances to the next stage, treating governance readiness as a project dependency rather than a parallel or post-hoc activity.

MGV-004

Continuous AI Assurance Function Design

Design and operate an ongoing AI assurance function that generates regular evidence of control effectiveness across the AI governance program, moving beyond point-in-time audits to a continuous model that provides the board, regulators, and enterprise customers with current assurance on AI governance posture.

MGV-005

Generative AI Input Data Classification

Establish a classification policy for data entering generative AI systems as inputs — prompts, context windows, retrieved documents, tool outputs, and conversation history — addressing privacy, confidentiality, and regulatory risks specific to the generative AI input surface that general data classification policies do not cover.

MGV-006

RAI Benchmark-Aligned Evaluation Framework

Map internal AI system evaluations to published responsible AI benchmarks and standards (HELM Safety, AIR-Bench, FACTS, and equivalents) to produce evaluation evidence that is interpretable against an independent external standard by regulators, auditors, and enterprise customers.

MGV-007

Emerging AI Modality Classification and Governance Extension

Establish a process for detecting when new AI modalities — ambient AI, multimodal agents, brain-computer interfaces, always-on AI assistants, and other emerging capability types — enter the organization's environment, and for extending governance coverage to those modalities before they are widely deployed.

SCT

Sector-Specific & Emerging

7 controls

SCT-001

Anthropomorphic and Companion AI Safeguards

Establish design requirements and governance review processes for AI systems that simulate human personality, emotional connection, or companionship, addressing psychological influence risks, minor user protections, and disclosure obligations that apply to AI products designed for ongoing interpersonal interaction.

SCT-002

Clinical AI Governance Committee Charter

Establish a healthcare-specific AI governance committee with clinical and technical expertise, defined quorum and decision rights, escalation authority over AI systems involved in clinical decision support and patient care, and a review cadence aligned to FDA Software as a Medical Device (SaMD) guidance and applicable state clinical standards.

SCT-003

Critical Infrastructure AI Risk Assessment and Containment

Define a sector-specific risk assessment process for AI systems deployed in critical infrastructure environments — including energy, water, transportation, and financial market infrastructure — that addresses operational technology (OT) blast-radius containment, consequence-of-failure analysis, and cross-sector dependency risk distinct from standard enterprise AI risk frameworks.

SCT-005

National Security and Dual-Use AI Risk Assessment

Establish a risk assessment process for AI systems and AI research activities that could constitute dual-use technology — with applications in both commercial and national security or weapons contexts — addressing BIS export control obligations, ITAR compliance for defense applications, dual-use research of concern protocols, and foreign adversarial misuse monitoring.

SCT-006

Self-Hosted Open-Weight AI Model Governance

Establish an intake policy and governance controls for AI model weights downloaded from public repositories and deployed in the organization's own infrastructure, addressing integrity verification, license compliance, safety evaluation before deployment, and ongoing update management distinct from vendor-hosted AI procurement.

SCT-008

AI-Specific External Complaints and Redress Mechanism

Design and operate a formal mechanism for external parties — customers, employees, subjects of AI decisions, and members of the public — to submit complaints about AI system outputs or decisions, receive timely responses, access human review of AI-assisted decisions upon request, and obtain meaningful redress where the AI decision was incorrect or unfair.

SCT-009