Back to Mind & Machine

AI Governance Framework

Five Pillars, Five Plain Questions

Jiuhe Wang  |  Created: Aug 23, 2026

Rules of the Road (30-Second Version)

1
Approved models only — from the approved list, via the intake process.
2
Approved providers only — data policy, region, and law checked before onboarding.
3
Go through the gateway — no direct provider access, no personal API keys, budgets enforced.
4
Guardrails always on — content safety, grounding, topic control, hard limits on agents.
5
No observability, no production — metrics, traces, red teaming, and re-validation are mandatory.
Pillar 1

Approved Models

"What LLM can we use?"

Scope

  • Text/chat, multimodal, and audio models — plus embeddings, which see your data too

Sourcing

  • Open-source: verify provenance and license, record the model card
  • Commercial: check contract terms; silent provider upgrades are a change event

Deployment

  • MaaS: fastest path, but requires data-policy review (Pillar 2)
  • Self-hosted: full control; required for the most sensitive data or residency rules
One authoritative approved model list. Anyone can request a new model through lightweight, time-boxed intake. Unlisted models aren't banned — they're not yet approved.
Pillar 2

Approved Providers

"Where can the model run?"

Before approving a provider, answer in writing

  • Data policy: no training on your data (or verified opt-out); known retention and access
  • Region & law: inference regions pinned where possible; jurisdiction and residency mapped
  • Operational: private connectivity, audit logging, SLA, deprecation notice period

Self-hosted baseline

  • Private network, no public endpoints, encrypted at rest and in transit
  • Official model sources only, with checksum and container verification

AI tools — end-user SaaS

These never touch your gateway — govern them as providers, at the tenant level:

Tool What to Review Key Controls
Copilot Pro (M365) M365 content grounding; commercial data protection terms SSO, admin controls, web grounding off for sensitive tenants
ChatGPT Enterprise Training-on-your-data terms (must be off), retention SSO, workspace retention settings, no plugin data sharing
Gemini for Workspace Workspace data used for training or human review Opt-out via admin console, region mapping
Notion AI Workspace content access by AI features Enterprise data controls, disable for restricted spaces
Perplexity (Enterprise) Web-grounded answers; query retention and training terms SSO, data retention controls, no training on org data
Manus Autonomous agent with broad tool & web access Restrict to non-sensitive tasks, sandboxed credentials, activity review

LLM cloud providers — model APIs & platforms

Where your applications run inference — apply the data-policy, region, and law review above:

Provider Governance Focus
DeepSeek Open weights (MIT) enable self-host; review API data policy separately
Zhipu (GLM) API terms and enterprise data policy; region and retention
MiniMax API retention and training terms; region availability
Kimi (Moonshot) Long-context API; retention and region review
Anthropic No-training-by-default terms; data usage and region pinning
OpenAI API data not used for training by default; zero-retention options
AWS Bedrock Governed by your AWS terms; model-level policies vary by supplier
GCP Vertex AI Google data-processing terms; supplier-specific terms apply
Alibaba Cloud Region and residency; PIPL cross-border transfer rules
Azure OpenAI Enterprise terms, regional deployments, content-filter defaults
Keep an approved provider register — and re-review on policy changes, new regions, incidents, or annually.
Pillar 3

Access Control

"How do we reach the model?"
  • Central gateway: single entry point for routing, policy, quotas, logging, and failover — apps never call providers directly
  • Credentials: provider keys live only in the gateway; apps authenticate with their own short-lived identity
  • Budgets: per-app and per-team quotas, alerts at 50/80/100%, hard caps and anomaly detection
  • Applications: every app is registered with owner, purpose, and allowed models — unregistered apps get nothing
  • Users: SSO with role-based access; per-user attribution in logs for audit
Pillar 4

Guardrails

"What is the model allowed to do?"

Model behavior

  • Responsible AI: content safety filters, PII/secrets redaction, AI transparency with human accountability
  • Hallucination control: ground answers in approved evidence (RAG + citations); if evidence is insufficient, say so
  • Topic control: per-app allowed/blocked domains, enforced by rules + classifier — not prompt text alone

Agent control — hard limits, not suggestions

  • Max tool calls and reasoning iterations per task; token and cost caps
  • Injected instructions can never raise limits, change tools, or redirect goals — breaches terminate and alert
  • Tool allowlists per agent; sandboxed file access; default-deny network egress
Pillar 5

Observability & Assurance

"How do we know it's safe in production?"
  • Monitoring: end-to-end traces, core metrics (tokens, cost, latency, guardrail hits), security signals — logs structured and redacted
  • Production readiness: registered app, gateway integration, budgets, tested guardrails, live dashboards, and a tested kill switch
  • Red teaming: adversarial testing before launch — injection, jailbreaks, exfiltration, tool misuse
  • Re-validation: triggered by model/tool/prompt changes or incidents; re-test periodically anyway — models and attacks both drift

Registers at a Glance

Register What It Tracks Owned By
Model list Approved models, versions, data classes Platform / AI team
Provider list Approved providers, regions, data-policy evidence Platform + Risk
Application register Apps/agents, owners, allowed models & tools Platform / AI team
Tool registry Tools, schemas, risk levels, approval rules Platform + Security

Key Takeaways

Start small: a shared table per register is enough on day one.

The framework works when the path of least resistance is the compliant path.