Playbook

The AI Governance Playbook

How disciplined organisations implement AI without surprises — the illustrative standard TRIAI uses to assess, design, and verify.

Purpose

This playbook sets out the discipline TRIAI applies when helping enterprises implement AI in core processes — illustrated here through an invoice processing exemplar. It is written for senior leaders who want AI to deliver material value without losing control of accountability, risk, or audit.

Guiding principle

Enterprise AI should be designed to improve important decisions and outcomes — not to deploy technology for its own sake.

AI may execute autonomously within defined boundaries. Accountability cannot be delegated to a machine — this is the same principle underpinning TRIAI's Judgement Architecture: routine, repeatable work moves to machine execution; trade-offs, accountability, and risk ownership remain with named humans.

Human in the loop

Named humans remain accountable. Machines prepare — and may execute within bounds.

Autonomy is set by risk tier. Low-risk work may run a controlled path; high-risk work keeps an explicit human gate. In every case a named human owner remains accountable — with a defensible audit trail.

Step 1
Work arrives
Request enters the process
Step 2
Machine prepares
Classify · draft · score — and may act within the tier
Step 3
Human judgement
Gate when risk requires it; accountability always stays here
Step 4
Action completed
Controlled path or after explicit approval — by design
Step 5
Audit recorded
Decision trace stored

Risk tiering

Risk tier	Examples	Control	Assurance
Low risk	Retrieval, drafting, triage within guardrails	Controlled autonomy permitted	Periodic deep-dive audits force full human review
High risk	Payments, legal approvals, contractual commitments	Mandatory human gate — no autonomous execution	Override rationale required; escalate if uncertain

Core rules

Bounded autonomy: AI may execute within defined boundaries; it does not replace accountability.
Named owner accountable: Authority and accountability cannot be delegated to a machine.
Humans judge — not ratify: Where a human gate applies, reviewers must actively judge outcomes; rubber-stamping defeats the control.
Watch for rubber-stamping: Declining review times without complexity change, weak override rationale, language like "the system says…" are all red flags.

Agentic AI

Governed, not unbounded

Systems are moving from one-turn Q&A to programmes that receive a goal, plan steps, use tools, and leave an audit trail. This is agentic AI — and it does not relax the rules above. Human accountability and defensible logging are prerequisites before autonomy expands.

The maturity path — earning the right to move right

Stage	Capability	What must be proven first
Assist	Classification, extraction, drafting, triage within guardrails	A controlled pilot with defined confidence thresholds
Route	Sensitivity-based routing and model selection	Architecture and security sign-off
Act	Tool-backed steps with decision logging	A verified decision trace and risk review
Orchestrate	Multi-step or multi-agent programmes	Evidence from a successful pilot, not intention
Govern	Full audit, residency, and human sign-off at scale	An operating model with defined ownership

Multi-step or tool-backed autonomy expands only after a successful pilot and explicit sign-off. Pausing or narrowing scope is good governance — not failure.

Worked pattern

Invoice processing

Presented in the same Before → After → Boundary structure as the Patterns Library.

Before

Every invoice queues for manual classification, data entry, and matching — regardless of complexity or risk.

After

AI classifies invoices, extracts fields, and matches them. Where the process defines what low value means, it may place those invoices in a separate queue so a person can approve them more conveniently.

Judgement boundary

No payment is triggered until a human approval is recorded. A low-value queue, a confidence score, or a named controller does not replace that record. The AI does not own the approval or release the funds.

How this gets proven, not assumed: a controlled pilot first — typically 10–15% of volume, time-boxed to 6–8 weeks, with confidence thresholds and override logging agreed upfront. A pilot that proves AI doesn't deliver value here is still a successful pilot.

Adoption Framework

How this maps to Assess, Redesign, and Scale

This playbook isn't a separate methodology — it's the operating detail behind the Adoption Framework stages below.

Framework stage	What this playbook contributes
Assess	The risk-tiering logic feeds directly into Governance & Responsible Adoption Architecture.
Redesign	The Judgement Architecture Sprint produces the Decision Specification this playbook describes — what's automated, what stays human, and where the escalation triggers sit.
Scale	Implementation Assurance verifies a built system against exactly this standard — the pilot-to-production discipline shown here.

Independence

What TRIAI does — and does not do

TRIAI designs the Decision Specification, the risk tiering, and the human-in-the-loop protocol. We verify that what gets built matches that design. We do not build the system, host it, or operate it. Whether your team or a chosen vendor implements the solution, this playbook is the standard we hold it to.

We advise on adoption. We do not supply the technology.

See how this applies to your process.

Book a Judgement Architecture Consultation →Explore the Adoption Framework →