Workshop contents
Session 1 · Guardrails and Authority
Guardrails and Human Authority
What it may decide, and who signs
AI capability is no longer the main constraint. The question is now: when is AI allowed to act, what proof must it show, and who has the authority to approve the decision?
Decision Control Map
| Control | Plain meaning | Why it matters |
|---|---|---|
| Permission | What AI may and may not do | Prevents the system from acting outside its role |
| Evidence | What proof must support a recommendation | Makes the answer reviewable, not just persuasive |
| Approval | Who must sign off before action | Keeps accountability with the right leader |
| Audit | What gets recorded for later review | Helps the company learn and defend decisions |
What could go wrong?
| Scenario | What went wrong |
|---|---|
| AI recommends cancelling all First Class shipping | No cost or contract rule is applied, so it breaks customer commitments |
| AI sends the alert to the wrong executive | No access control, so sensitive information leaks |
| AI bases a recommendation on corrupted data | No data validation, so bad data becomes a bad decision |
| AI recommendation violates a vendor contract | No legal or compliance context, so the company creates liability |
| AI optimizes for speed and ignores carbon | No sustainability rule, so the recommendation misses company targets |
Which of these has already happened in your organization: or could happen tomorrow?
Set the decision rules
DECISION AUTHORITY: - AI MAY: Generate reports, send alerts, draft recommendations - AI MAY (with approval): Change the mix of shipping services up to 10% - AI MAY NOT: Change carrier contracts, override customer delivery promises, communicate to external partners DATA RULES: - Must use data less than 24 hours old - Must flag if any data source is missing or incomplete - Must show confidence level for predictions EVIDENCE REQUIREMENTS: - Every recommendation must cite specific data points - Must show "what if" comparison (current vs recommended) - Must include risk assessment for each action ESCALATION: - If late delivery rate exceeds 60%: escalate to COO immediately - If recommended action exceeds budget by >5%: requires CFO approval - If pattern is unprecedented: flag for human review, do not auto-act AUDIT: - Log every decision, recommendation, and data source - Weekly governance review of all AI-generated actions
Outcome. Guardrails define what AI may do, under what conditions, and with whose approval. Without them, no AI deployment is trustworthy enough to operate.
Executive self-assessment: the AI Readiness Check
Each participant evaluates one of their own AI initiatives against six dimensions.
| Dimension | Early | Structured | Enterprise-ready |
|---|---|---|---|
| Instructions | Vague, generic prompts | Specific, formatted, role-based | Constraints, reasoning direction, output standards |
| Context | None, general knowledge only | Dataset provided | Business rules, history, targets, constraints |
| Tools | Chat only | Data analysis | Connected workflow: query, visualize, draft, send |
| Operation | Human runs every request | Scheduled tasks | Agent monitors and acts within defined authority |
| Decision control | None | Basic access control | Decision authority, evidence rules, escalation, audit |
| Evidence | “AI said so” | Supported by data | Cited, compared, confidence-scored, peer-reviewed |
Reflection exercise. Pick one AI initiative you are responsible for. Where does it sit on this readiness check today? Where does it need to be in six months, and what is the first gap to close?