The First 90 Days of AI Governance: What to Inventory, Contain, and Report

By Scott Andersen, Head of AI Services and Co-Founder August 14, 2026 Leave a comment

Questions executives should ask now

Which AI systems can take an external action without a human approval event?
Can we reconstruct every tool call, credential use, data transfer, and state change after an incident?
Who verifies the configuration of third-party sandboxes and evaluation environments?
Which generated assets require visible or machine-readable disclosure, and who owns that decision?
Do our AI contracts allocate responsibility for model changes, incidents, provenance failure, and regulator inquiries?
Are cost budgets, runtime limits, and tool-call ceilings enforced as policy or merely observed after the fact?
Does the safety organization have independence from the product organization’s release schedule?

Window	Focus	Management action	Evidence produced
Days 1–30	Inventory	Identify every agent, model, tool, network path, content generator, and third-party evaluator.	Approved AI system and agent register
Days 1–30	Authority	Classify actions by reversibility, external impact, privilege, and human approval requirement.	AI action-class and approval matrix
Days 31–60	Containment	Test deny-by-default network and tool policies, short-lived identity, stop conditions, and kill switches.	Agent containment test evidence
Days 31–60	Provenance	Map generated content from creation through editing, approval, publication, and retention.	Synthetic-content chain-of-custody design
Days 61–90	Assurance	Add vendor audit rights, incident notice, configuration standards, and evidence-retention clauses.	Updated procurement and testing terms
Days 61–90	Board metrics	Report agent incidents, unauthorized attempts, human overrides, AI spend, and provenance failures.	Quarterly governed-action dashboard