AI Security & Governance · Session 7
How governed is your AI really?
A two-minute self-check across the nine control layers every AI system lives or dies on. Score yourself honestly - nobody sees this but you. You'll get a Trust Score out of 45 and where you stand.
Rate each statement for your organization, 0 to 5 - how true is it, today, in the running system (not the policy doc)?
0 Not at all / don't know1 Ad hoc2 Partial3 Mostly4 Strong5 Fully in place & verified
Trust what it does
Can you trust what the AI is doing while it runs?
Identity–
Every AI agent and model has its own verified identity - we always know exactly what is acting on our behalf (no shared or borrowed credentials).
Access & Privilege–
Agents run on least privilege - access is scoped to the task and revoked when done; nothing inherits a human's full access.
Oversight–
High-stakes or irreversible AI actions require a human checkpoint, tiered by risk - there's a circuit breaker before anything serious.
Prove what it did
Could you prove, after the fact, what happened and who owned it?
Monitoring & Auditability–
We log, trace and monitor AI behaviour - including drift and accuracy - and could reconstruct what an agent did, and why.
Data Protection–
Sensitive data flowing through AI is protected - PII handling, encryption, residency and AI-aware DLP are in place.
Accountability–
For every AI system, one named person is accountable for its risk and behaviour - not a committee, a name.
Survive an attack
If it were attacked or drifted, would you survive it?
Resilience–
We have a tested kill switch and rollback, and we have red-teamed our AI against misuse and attack.
Supply Chain–
We vet the provenance of models, datasets and tools (an AI-BOM) and scan for poisoning or compromised components.
Compliance–
Every AI system is classified by regulatory risk (e.g. EU AI Act band) and meets its disclosure and documentation obligations.
Nine control layers · Trust Score /45 · built on the Trust Perimeter model.
The weakest layer sets your ceiling - that's where the work starts.
The weakest layer sets your ceiling - that's where the work starts.