- Govern one workflow at a time: define its purpose, boundaries, owner and acceptable outcome before selecting controls.
- Place human review according to uncertainty, consequence and authority—not simply because the workflow uses AI.
- Treat exception recovery, monitoring and controlled change as part of the operating design rather than post-launch support.
Govern one business workflow—not AI in the abstract
A useful AI governance framework turns broad principles into operating decisions for a specific workflow. It identifies what the system is allowed to do, what evidence it may use, when a person must decide and what happens when the normal path cannot continue safely.
Begin with the work as it happens today. A current-state map should show triggers, inputs, systems, decisions, handoffs, approvals and exceptions. OpSmith’s guide to how to map a business workflow for automation provides the planning structure.
Governance should be proportionate. A system that drafts an internal summary does not need the same controls as one that changes a customer record, recommends a price or sends an external commitment.
Named outcome
State the business result the workflow must produce and how a successful run is recognized.
Defined boundary
Record the actions, decisions and data uses that remain outside the automated scope.
Consequence
Describe what can happen if the output is late, incorrect, duplicated, disclosed or acted on without authority.
Evidence
Identify the records, logs and measurements needed to explain what occurred.
Control 1–2: define purpose, boundaries and ownership
The first control is a plain-language purpose statement. It should be narrow enough that a reviewer can decide whether a requested feature or new data source belongs inside the workflow. Purpose prevents a useful automation from quietly expanding into decisions it was never designed to make.
The second control is an accountable business owner. This person does not need to maintain the software, but must have authority to approve the operating rules, accept the remaining risk, respond to material incidents and stop the workflow when its assumptions no longer hold.
Purpose statement
Describe the input, intended output, beneficiary and decision the workflow supports.
Prohibited actions
Write down what the workflow must never send, change, approve or infer on its own.
Business owner
Assign the role accountable for the outcome, rules and acceptable operating risk.
Technical owner
Assign responsibility for availability, access, integrations, recovery and implemented changes.
Control 3: approve the data and preserve its source
List the sources the workflow may use, the fields it needs and the destinations it may update. More data is not automatically better. Each source creates questions about accuracy, access, retention, sensitivity and whether the information is appropriate for the intended purpose.
Preserve enough source context to verify important outputs. When a document, email or system event leads to an automated action, a reviewer should be able to find the original input and understand which rules or model output influenced the result.
Approved sources
Allow only documented systems, documents and fields required for the workflow’s purpose.
Minimum necessary data
Avoid collecting or passing information that does not change the operating outcome.
Source trace
Retain references that let a reviewer verify the input behind a material output or decision.
Access and retention
Define who can see the data, where it travels and how long workflow records are kept.
Control 4: place human review where it changes the decision
A generic approval on every run often creates a new bottleneck without adding real control. Decide what the reviewer contributes: judgment, authority, resolution of uncertainty or accountability for a material consequence.
Use the consequence of a wrong action and the quality of available evidence to select approval-before-action, review-by-exception, sampling or automatic completion. The detailed human-in-the-loop automation guide shows how to design that decision experience.
Material commitment
Require an authorized person before customer, contractual, financial or irreversible action.
Uncertain evidence
Route missing, conflicting or low-confidence information for review instead of inventing certainty.
Decision context
Show the reviewer the source, proposed action, reason for review and available approved choices.
Decision record
Record who reviewed the item, what changed and which final action was accepted.
Control 5: contain exceptions and make recovery explicit
An exception is not merely a technical error. It is any item the standard path cannot complete safely because an input is incomplete, rules conflict, a dependency fails or the business case requires different authority.
Containment keeps uncertain work visible and prevents downstream side effects. The workflow automation exception handling guide covers categorization, routing, safe retry and recovery measurement.
Detect
Define observable conditions that move an item out of the standard path.
Contain
Stop unsafe downstream actions while preserving the original input and completed steps.
Assign
Route the item to the role with the information and authority required to resolve it.
Recover
Resume from the last safe state and verify the final outcome without duplicate effects.
Control 6–7: monitor outcomes and control change
A workflow can be technically online while producing stale records, growing a review queue or failing to deliver a useful business result. Monitor completion, cycle time, exception health and downstream acceptance—not only uptime.
Models, prompts, business rules, source formats and integrations change. The automation monitoring and maintenance guide explains actionable alerts, recovery runbooks, regression testing and change records.
Every material change should have a reason, an approver, representative test cases and a safe rollback path. Operating evidence—not novelty—should determine which improvement is made next.
Outcome health
Measure whether the intended business result completed within the expected time.
Control health
Track approval, correction, exception and recovery patterns that reveal weakening assumptions.
Regression set
Retest representative normal, boundary and exceptional cases before production changes.
Change record
Document what changed, why, who approved it, when it took effect and how to reverse it.
Scale governance according to business consequence
Do not apply one control pattern to every use of AI. Classify the workflow according to the consequence of a wrong, delayed or unauthorized action. Increase approval, testing, traceability and review frequency as consequence and irreversibility rise.
A low-consequence internal draft may use source references and periodic sampling. A customer-facing or financial action may require explicit approval, stronger access restrictions, complete decision records and immediate containment when a critical control fails.
Low consequence
Internal, reversible assistance with sampling, source visibility and a clear correction path.
Moderate consequence
Operational updates with validation, exception queues, named ownership and regular review.
High consequence
Material external actions with explicit authority, pre-action approval and detailed traceability.
Unsuitable scope
Leave the decision human when evidence, authority or recoverability cannot be made dependable.
Turn the framework into an operating record
The framework becomes useful when its decisions live with the workflow documentation and are reviewed during design, testing and operation. Record the owner, purpose, sources, prohibited actions, control points, exception paths, measures and change history in one place.
If those decisions cannot be made confidently, begin with a business process automation audit. Mapping one real process often reveals whether the next step is automation, process cleanup, a narrower pilot or no build at all.
Test one workflow against seven governance controls.
Check a control only when it is documented and someone is responsible for it. This is a planning aid, not a compliance certification.
Important governance decisions are still undefined. Keep the workflow in discovery or controlled testing.
Frequently asked questions
Does a small business need an AI governance framework?
A small business does not need enterprise bureaucracy, but it does need clear ownership, approved uses, human-control points, recovery procedures and evidence that a workflow is producing the intended result. The framework should be proportionate to the consequence of the workflow.
Is AI governance only about privacy and compliance?
No. Privacy and compliance matter, but operational governance also covers whether the workflow has a valid purpose, uses dependable inputs, assigns decision authority, handles failures and remains observable after launch.
Who should own an automated workflow?
Ownership should sit with a business role that understands the outcome and has authority to approve changes or stop the workflow. Technical support can maintain the system, but it should not silently inherit accountability for the business decision.
When should a person review an AI-generated output?
Human review is most useful when evidence is uncertain, consequences are material, professional judgment is required or only an authorized person may make the commitment. Low-risk, reversible actions may use sampling or exception-based review instead.
How often should the governance framework be reviewed?
Review it whenever the workflow, source data, integration, model, policy or business consequence changes. Production workflows should also have a scheduled review based on their volume, risk and rate of exceptions.
Sources and further guidance
These external references provide broader risk-management and accountability guidance. OpSmith’s framework applies those ideas to the operation of one business workflow.
- AI Risk Management Framework CoreNational Institute of Standards and Technology
- AI Risk Management Framework PlaybookNational Institute of Standards and Technology
- Voluntary Code of Conduct on Advanced Generative AI SystemsInnovation, Science and Economic Development Canada
- OECD AI Principle: AccountabilityOECD.AI