Every AI governance framework rests on a foundation that is rarely discussed with the seriousness it deserves: knowing what you actually have. Policies, review boards, and control standards are all downstream of the inventory. Without it, an organization is governing the systems it happens to know about, which is a different and much smaller population than the systems it is running.
This article covers the two mechanisms that make the second line operational, a complete inventory and a defensible risk-tiering rubric, and the pipeline that connects them to a decision.
You Cannot Govern What You Cannot See
The lesson here is not new, and it did not originate with AI. Financial institutions spent years discovering that critical processes ran on thousands of undocumented spreadsheet models with no named owner and no review. When I led the remediation of that problem in a large finance organization, the hardest part was never the technology of replacement. It was establishing, for the first time, an honest picture of what existed.
Generative AI recreates the problem with three aggravating factors:
The artifacts are easier to create, so they proliferate faster.
They are harder to inspect, because correctness cannot be verified by reading a formula.
They are easier to hide, because a prompt-driven workflow leaves a fainter footprint than an application deployment.
The critical insight from the spreadsheet era transfers intact: an inventory built by mandate will be incomplete, and an inventory built by incentive will be closer to true. When we made registration the gateway to support, better tooling, and a supported platform, registration stopped being a tax and became the on-ramp to something people wanted. Thousands of models were registered and tiered; more than four hundred were remediated into governed platforms. Enforcement alone would not have produced that.
What the Inventory Must Capture
An inventory that records only a name and an owner is a list, not a control. To support tiering, monitoring, and eventual audit, each entry needs enough substance to answer the questions that will be asked of it later.
Identity and ownership. System name, business owner, technical owner, and the executive accountable for the risk.
Purpose and intended use, stated specifically enough that a use outside it is recognizable as such.
Out-of-scope uses, stated explicitly. What the system must not be used
Model and version, including provider, whether it is hosted internally or externally, and how version changes are detected.
Data: what the system reads, what it is trained or fine-tuned on, what it retrieves at inference, and the sensitivity classification of each.
Actions and tool permissions. For agentic systems, this is the single most important field:what can this system actually do, to which systems, with what authority?
Human checkpoints: where they exist in the workflow and what the reviewer is expected to verify.
Assigned risk tier, the date assigned, and by whom it was validated.
Evaluation evidence: what was tested, against what threshold, with what result.
Conditions of approvaland their compliance status.
Third-party dependencies, including the contractual position on data use and model changes.
Two of these deserve emphasis because they are commonly omitted: Recording out-of-scope uses creates the reference point against which scope creep becomes visible. And for agentic systems, recording tool permissions is the difference between governing a description of a system and governing the system. An agent's risk is very largely a function of what it is permitted to touch.
Tiering: The Engine of Proportionality
Once the inventory exists, tiering makes it useful. Without tiering, an oversight function has only two settings: review everything with equal intensity, which is unaffordable and breeds resentment, or review by intuition, which is indefensible when challenged. Tiering converts a list into a prioritized queue and lets control intensity scale with actual risk.
A rubric that holds up under challenge scores each system on multiple independent dimensions rather than producing a single subjective judgment.
Eight dimensions cover the ground well.
Action authority: What can the system do? This is the dominant dimension for agentic systems and is developed in detail below.
Goal boundedness: How tightly is the objective specified, and how much latitude does the system have in pursuing it? A narrowly bounded goal with a fixed method is materially safer than an open objective the system may pursue by means of its own selection. Loosely bounded goals are where drift originates.
Reversibility: Can the effect be undone, and how easily? An action that writes to an immutable record, sends an external communication, or moves money is categorically different from one that populates a draft.
Data sensitivity:Confidential, personal, material non-public, or client data raise the tier regardless of the system's other properties.
Client or external exposure:Does output reach a client, a counterparty, a regulator, or the public, and is it attributable to the organization?
Decision materiality: What is the consequence if the system is wrong? A drafting aid and a system informing a credit, pricing, or reporting decision are not comparable.
Self-modifying behavior: Does the system change its own instructions, rules, prompts, or objectives at runtime?
Third-party dependency:Is the underlying model controlled by the organization or by a vendor who may change it without notice?\
The Action Tiering Ladder
For agentic systems, the crude question of whether a system is autonomous is not useful. Autonomy is a spectrum,and the tier should follow position on that spectrum.
A five-step ladder makes it concrete.
Read-only:The system retrieves and displays information. It changes nothing.
Summarize, draft, and synthesize: The system produces derived content from retrieved material. The risk is misrepresentation, not action
Recommend: The system proposes a course of action for a human to accept or reject. It has influence but no authority.
Act with approval: The system prepares and stages an action, which executes only after explicit human authorization. Authority is real but gated.
Fully autonomous: The system acts without a human in the loop. Authority is unconditional within its permission set.
The ladder is useful precisely because it separates influence from authority, and because it gives the second line a vocabulary for conditional approval. The most common productive outcome of a review is not rejection but a step down the ladder: a system proposed at step five approved at step four.
Mandatory Top-Tier Triggers
Some characteristics should escalate a system to the highest tier automatically, regardless of how it scores elsewhere. Bright lines of this kind are valuable because they remove the argument.
Self-modifying behavior at runtime: A system that alters its own rules or objectives while operating cannot be validated once and trusted thereafter, because the thing that was validated is not the thing now running.
Irreversible action with external effect: Anything the organization cannot take back, and that a third party has already seen or acted upon.
Writing to a book of record or a regulatory reporting system: This is a line worth stating in absolute terms, and I have enforced it as such: no AI or machine-learning output posts to the general ledger, or to any system supporting regulatory reporting, without a human checkpoint and validation.
Autonomous action affecting a client relationship: including communications sent under the organization's name.
The Pipeline: Inventory to Tier to Gate to Approval
The mechanisms combine into a single operating pipeline, and its value lies in being routine rather than exceptional.
Register. Mandatory intake at design time. Nothing proceeds unregistered.
Tier. The first line self-assesses against the published rubric; the second line validates the score. Validation matters because builders systematically under-tier, scoring against intended use rather than possible use.
Gate. Low-tier systems proceed with documentation and standard guardrails. High-tier systems cannot proceed without independent review, evaluation evidence against a defined threshold, and explicit approval.
Approve, condition, or decline. The outcome is documented with reasoning, and any conditions are recorded as tracked obligations rather than advice.
Re-tier on change. A material change to purpose, data, model version, or action authority returns the system through the pipeline. Without this step, the approved risk profile and the operating one drift apart silently.
Coverage Is the Indicator That Matters Most
A tiering rubric is only as good as the population it is applied to.The most important early indicator for a second-line AI function is therefore not the number of reviews completed but coverage: the proportion of the organization's actual AI estate that appears in the inventory at all.
Coverage cannot be measured directly, the unregistered population is by definition unknown, but it can be estimated triangulating from enterprise model API consumption, procurement and vendor records, code repository signals, and periodic discovery exercises. A program reporting a hundred percent condition compliance across forty registered systems, in an organization where API telemetry suggests hundreds of distinct applications, is not reporting strength. It is reporting the size of its blind spot.
Design Principles That Determine Whether The Process Works
Make the governed path the easiest path.Registration should unlock access, tooling, and support. Compliance driven by self-interest survives; compliance driven by mandate erodes.
Tier at design time, not at release. A tier assigned early shapes architecture. A tier assigned at launch produces either an expensive redesign or a waived control.
Publish the rubric. When builders can see how they will be scored, they design to the standard, and the second line's work shifts from correction to confirmation.
Keep the rubric stable and version it. A rubric that changes constantly cannot be designed against and cannot support consistent decisions over time.
Generate the audit evidence automatically. Registrations, tier assignments, approvals, conditions, and evaluations should be captured as a byproduct of the process. A control that requires a separate effort to evidence will not be evidenced.
With visibility and proportionality established, the second line can turn to the activity that defines it: examining a specific system, forming an independent judgment, and deciding whether it may proceed. That is the subject of the next article.
Explore more: Start Here · Topics · Archive · About