Ten signs your AI program is running without real governance
None of these on their own are unusual at an early stage. Several of them together mean AI access to data is growing faster than anyone's ability to control it.
The checklist
- “We use encryption” is the whole security answer — access control and policy are probably missing too
- One pipeline or script handles data movement, model calls and logging together, with nothing to audit separately
- A model or team has broader data access than any single job actually needs
- Logs exist, but nobody reviews them or ties them to a decision
- Files and prompts reach a model with no check for sensitive content first
- Every new model or data source means another custom script, not a policy change
- A bad model response or an outage has no defined fallback
- Token and compute spend is a surprise at the end of the month, not something tracked per job
- Nobody can say when training data or model outputs get deleted
- Claims about reliability or accuracy have nothing recorded to back them up
Reading the result
Each line maps to a harness: access and policy, security, audit, guardrails, reliability, cost and token. A program that is missing several of these is not missing discipline so much as a layer that should be enforcing it automatically.
In the harness
This checklist is organized around the ten harnesses: Policy, Security, Audit, Guardrails, Reliability and Cost and token cover it end to end.