Iron Brick AI Field Guide · Governance ·
Governance works best as a lifecycle, not a one-time approval: lighter paths for low-risk productivity tools, stronger evidence and oversight for high-impact uses.
Guardrails first
Start with agency-wide guardrails: principles, approved platforms, risk appetite, and reference architectures. They let teams move quickly on low-risk uses because the hard decisions are already made.
Six stages, four gates
Each use case moves through discover, assess, design, approve, deploy, and operate. Four decision gates (intake, design review, production approval, and periodic recertification) scale with the risk tier, so a writing assistant is not reviewed like a benefits decision tool.
Controls that never switch off
Identity and access, data privacy, model evaluation, prompt and injection security, human oversight, audit trails, and cost tracking apply at every stage. These map naturally to NIST SP 800-53 control families and the NIST AI Risk Management Framework.
Roles
A mission owner, the AI platform team, enterprise architecture, security, risk and legal, and a model owner each have a defined part at each gate.
Key takeaways
- Set guardrails once so low-risk uses move fast.
- Scale review depth by risk tier at each decision gate.
- Keep identity, privacy, evaluation, oversight, and audit controls on throughout.
- Recertify systems periodically; models and data drift.