6 Guidelines for Governing AI

For the first 10 years of my career, I worked in product management and data analytics by myself.

I wrote database queries that pulled numbers out of corporate systems, built statistical models to predict what customers would buy, and shipped data pipelines that moved information between business systems.

I built and scaled analytics teams at Best Buy and Target, studying how customers shop and what stores should stock. Today I lead enterprise AI transformation at Lowe’s, the Fortune 100 home improvement retailer. The goal is not to sell artificial intelligence; it is to use it to deliver useful expertise at the moment a customer needs it.

In retail and other customer-facing industries, virtual assistants can help people address everyday questions—such as how to repair a leaky faucet—while guiding them toward relevant products, services, or next steps. As these capabilities become more common, technology roles are changing.

The work is no longer limited to building AI systems; it also includes defining how they operate: which decisions they can make autonomously, when they must escalate to a person, and which actions must remain off-limits. That shift—from building AI systems to governing them—is coming for anyone who is accountable for what such systems produce.

Not the casual user typing into a chatbot but the engineers, product managers, analysts, and business operators who sign off on work a machine drafted. It is the subject of the book I recently coauthored, The Enterprise Brain. I call the change the “governor shift,” from executing tasks yourself to setting the intent, principles, and boundaries within systems that execute them for you.

Business operators might not write code; they will decide which pricing exceptions an agent may approve and which it must escalate. That is governing. A 2025 report from MIT Media Lab’s Project NANDA found that, despite an estimated US $30 billion to $40 billion in enterprise generative-AI investment, the vast majority of organizations in its dataset had not yet demonstrated measurable profit-and-loss impact.

The report estimated that only about 5 percent of integrated pilots were generating substantial value, underscoring how difficult it remains to move from experimentation to scaled business outcomes. Researchers named the pattern the GenAI Divide, the term I adopted for the book. The companies rarely lack technology; they use the same models as the 5 percent that are winners.

But they lack people who can direct the systems and stand behind the results. Guidelines to follow Here are six guidelines. Recognize when you have become “human middleware.”

In software, “middleware” is the code that sits between two systems and passes information back and forth. Many of us have become its human version. Take an honest look at your week. How much time is spent pulling data out of one tool, reformatting it, and routing it to another team?

I call this the “administrator trap,” which is set by the architecture, not by the people caught in it.Relaying is what AI agents now do well. But they cannot judge which numbers deserve attention, which risks are real, or which compromises are worth making. Trade rules for principles. For many years, workers used rules to manage their work.

Refunds for a product over a certain amount needed a signature from upper management, for example. Writing code needed two reviewers. Rules work at human speed. But rules break when a system makes thousands of decisions per hour and meets situations no rulebook anticipated, such as a complaint covered by three different policies.

A rule says to do exactly this specific thing; a principle says to achieve the outcome without crossing certain lines.Governing AI means writing those principles in priority order so the system settles its own conflicts the way a well-led team does when the manager is not available. Never harm the customer. Tell the truth even if the company loses a sale. Protect the economics, and then move quickly.

Underneath sits a question of decision rights: the formal authority over who or what may make a given call. Writing down the answers in what I call a “library of principles” is now core leadership work, whether you’re a technologist or a business owner. Write your culture into your code. Many companies have turned their values into posters that hang on office walls.

But an AI agent cannot read the posters. Instead, write your governance as code. Include your values and policies as machine-readable instructions that the AI agent will follow automatically.Do so in three layers.

The top is the constitution, which states the rules an agent may never break, and never state a fact it cannot support. The second layer is the doctrine: how the business competes and the acceptable trade-offs to get there, such as protecting a long-term relationship over a short-term sale. At the bottom sits the playbook, which has the tactics used for one task.

Install a trust thermostat, not a trust switch. The question that stalls nearly every company’s AI deployment is some version of: “What if it tells our biggest customer something wrong, or quotes a price we will not honor?”

It might. Treating trust as a switch leaves two bad options: an unsupervised system or a human reviewing every transaction—which would cost more than the automation would save.The alternative is a thermostat. Every decision an agent makes carries a confidence score measured against the principles set. Above an agreed threshold, it proceeds alone; below it, a human decides.

That person’s answer is fed back into the learning loop so the next similar case clears the threshold on its own. Every decision stays transparent, auditable, and explainable—which is what I call a glass box. Fix context before you govern. You cannot govern a system that cannot see the whole picture.

Ask your best employee about a project, and they will pull together the budget, the contract clause, and the customer’s last complaint because they know it all by heart. Most enterprise AI fails that test, because the information sits scattered across applications that store it in incompatible formats. I describe the full loop as Connections, Context, Reasoning, Actions, and Governance (CCRAG).

Connections feed in raw information such as transactions and service records. Context weaves it into a context graph, which is a single connected picture of the business that gives agents something close to memory. Reasoning makes the decisions. Actions carry them back into the business systems.

Governance keeps things aligned with the company’s intent.Most organizations obsess over the reasoning in the middle and underinvest in context and governance, which is exactly where humans play a role. Context compounds: Every interaction makes the graph richer and harder to reproduce. Learn to lead by exception. The most important change in habit comes last.

Most of us have been trained to check every report and every number because we never knew where an error could surface. In a governed system, the machine tells you which cases it could not resolve confidently. Routine workflows go untouched, and your attention goes to the small portion that is ambiguous, unfamiliar, or high stakes.At first, that might feel like losing control, but it is the opposite.

It is what makes a self-scaling enterprise possible, an organization whose output grows without its head count growing in proportion. People were not removed from the loop; they were raised above it. The identity question When I talk with people about the shift, their resistance is rarely about technical issues.

More often it is about identity: If the AI does the doing, what do I do? I have watched capable people freeze on that question. I’ve also asked myself the question.

Doing was never really the job, though. Judgment was. Doing was just how we expressed it. AI has not made judgment less valuable.

It has made it the scarcest resource in the organization because, for the first time, one person’s judgment, written down well, can guide thousands of decisions each day. Judgment has a twin we talk less about: taste. Judgment tells you whether an answer is sound.

Taste tells you whether the question was worth asking and which of a hundred defensible options to offer the customer. A machine will happily generate all 100 options, but it cannot tell you which is best. The AI transition rewards instincts many IEEE members already have: systems thinking, precision about requirements, and honesty about failure modes.

The tools have changed, but the discipline has not. Governing is where taste and judgment stop being soft words and become the work itself. The people who treat it that way, rather than as a step away from engineering, will define the profession in the age of AI.