What AI governance should control: from inventory to evidence

Many organisations begin AI governance with a register. That is necessary, but it is not the same as control. A register can show that an AI system or agent exists; it does not automatically show who is accountable, what the system can reach, what it is doing now, or whether a corrective action worked.

A more useful model treats governance as a continuous chain: discover the AI estate, understand authority and risk, control behaviour, verify the result, and retain evidence. Each link answers a different management question.

1. Discover the real AI estate

The starting point is visibility across models, applications, copilots, agents, tools and connections. Manual intake captures approved projects, but it can miss embedded AI features, experiments and unsanctioned agents. Buyers should therefore distinguish a declared inventory from automated or cross-platform discovery.

The useful output is not merely a count. Each item needs a purpose, owner, lifecycle state and relationships to data, tools, identities and other systems. Without these connections, an inventory is difficult to use for risk decisions.

2. Understand authority, exposure and consequences

For agentic AI, the key question is not only what the model can answer. It is what the agent can do. Effective authority may be broader than its written role because access can be inherited through a user, service account, connector, API or MCP tool.

A governance platform should help a team reconstruct that authority: who sponsors the agent, which identity it uses, which data and tools it can reach, what actions it is allowed to take, and whether delegation continues from one agent to another. This turns a general concern about “AI risk” into a concrete exposure.

3. Control behaviour at the point of action

Policies matter only when they influence decisions. Controls may include approval gates, least-privilege access, data-loss protections, limits on tools and actions, or runtime decisions to allow, deny, restrict or escalate an activity.

Not every product needs to perform every enforcement action itself. Some platforms orchestrate controls in identity, security, data governance or workflow systems. The procurement question is therefore both what can be controlled and where the control is actually enforced.

4. Verify that risk was reduced

Closing a ticket is not proof that a risk changed. Verification should test whether access was removed, a policy now blocks the relevant behaviour, an owner accepted residual risk, or the system was suspended or retired. This is where governance moves from workflow administration to control assurance.

Useful evidence can include the original finding, the decision, the authorised action, the system response and the post-action state. Together they allow an organisation to explain not only what it intended to do, but what actually happened.

5. Preserve a defensible decision record

Auditability should cover more than model outputs. The record should connect the system, owner, assessment, policy, evidence, decision, remediation and verification. It should also retain meaningful changes over time: new tools, altered permissions, owner changes, material model updates and reassessments.

This evidence supports several audiences. Operators need worklists and status. Risk and compliance teams need traceability. Leaders need a view of exposure, remediation progress and residual risk. Procurement needs proof that a supplier capability exists and can operate in the intended environment.

How to use the chain in procurement

1. Define the outcomes that matter before comparing feature lists.
2. Ask suppliers to demonstrate one scenario across the full chain.
3. Identify where each control is native, integrated or only described.
4. Request evidence of the final state, not just an alert or recommendation.
5. Score fit against the organisation’s stack, region and operating model.

The strongest product is not necessarily the one with the longest feature list. It is the one that closes the most important control gaps with credible evidence and workable integration.