AI Governance Operations & Decision RightsSomeone approved it. Can you prove who—and why?
RAIC runs your governance program and enforces who is allowed to decide what — councils, registers, exceptions, and escalation on one side; a configurable authority matrix, risk-acceptance limits, and time-bounded emergency powers on the other. Every yes, every no, and every change to the rules is evidence.
What is AI governance operations?
AI governance operations are the recurring processes used to run an AI governance program: councils, decisions, actions, exceptions, escalation, reviews and evidence.
What are AI decision rights?
AI decision rights define who has authority to approve, reject, escalate, delegate or accept risk for an AI system or use case, and under what conditions.
Your governance program runs on email and goodwill.
Ask most organizations who approved their newest AI use case and you get a name. Ask what authority that person held, and the room goes quiet. Ask what happened to the three requests that were turned down, and there is no record at all.
Approvals live in inboxes. Exceptions live in a spreadsheet that nobody prunes. Authority lives in a RACI chart that no workflow enforces. Each of those is fine until a regulator, an acquirer, or your own board asks you to show the decision trail.
RAIC makes the decision the unit of record. Where a decision is made, who is allowed to make it, and what happened afterwards all live in one system that produces evidence as a by-product of running the program.
Run the governance program
The meeting, the register, the follow-up, and the calendar — the machinery your framework assumes you already have.
Governance council and meetings
Stand up the council your framework asks for, with a standing membership, agendas built from what is actually outstanding, and minutes that become evidence instead of a document nobody can find.
Decision register
Every governance decision is recorded once, with the question asked, the answer given, the authority behind it, and the date — so nobody reconstructs last quarter from memory.
Action register
Decisions produce work. Each action carries an owner, a due date, and a visible status, so the gap between deciding and doing stops being invisible.
Exceptions and waivers
Time-bounded departures from a control are registered with an owner, a reason, and an expiry date. Nothing lives forever by accident, and every exception surfaces before it lapses.
Escalation ladder
When a decision stalls or a risk grows, it moves up a defined path rather than waiting on whoever notices first. The escalation itself is part of the record.
Governance calendar
Reviews, attestations, meetings, and expiry dates sit on one calendar, so the cadence your framework expects runs on schedule instead of at audit time.
Operator cockpit
One ranked view of what needs attention now, with the reasoning shown — so your governance lead opens RAIC and knows the first thing to do, not just that there are twelve open items.
Council voting on the record
Each agenda item is voted individually — for, against, abstain, or recused — and the outcome is recorded against the decision with the quorum that produced it.
Decide with real authority
Decision rights — the rules that say who may decide what — stop being a slide and start being the thing that routes your approvals.
A configurable authority matrix
Define who can approve what in your organization — by role, by risk level, by asset type. The matrix is yours to configure, not a vendor's opinion about how your business is governed.
Approval routes generated from the matrix
Use cases, AI systems, controls, policy versions, risks, and exceptions each route to the approvers your matrix names. The route is produced from the rule, so it cannot drift from the policy that defines it.
Risk acceptance by residual level
Accepting residual risk is a separate authority from approving work. A low residual risk stops at the owner; a high one reaches the executive or council you named for it.
Delegation limits and separation of duties
Delegation is bounded, so authority passed down stays inside what the delegator held. Separation of duties keeps the person who requests something from being the person who approves it.
Emergency break-glass authority
Urgent situations get temporary authority on a visible countdown. The grant expires on its own and triggers a retrospective review, so speed never costs you the paper trail.
Impact preview before you publish
See what an authority change would do to in-flight approvals and future routes before it takes effect — no discovering on Monday that a quarter of your approvals now route to a vacant role.
Authority changes applied to work already in flight
When you change the matrix, re-route the approvals already open so in-flight work follows the new rule, not the old one. The run is reportable and safe to repeat.
Refusals recorded as governance events
A "no" is a governance outcome, not a dead end. Every refusal is written to the record with its reason and the authority behind it, so declining something is as provable as approving it.
Governance State and Continuity Pack export
Export the current state of the program — councils, decisions, actions, exceptions, and the authority model behind them — as one pack, so a handover, a board pack, or an audit request is a download rather than a project.
The record writes itself
Every approval, every refusal, and every authority change lands in your organization's audit trail and is mirrored to the platform log. Your governance history is a product of doing the work, not a project you run before an audit.
- Every approval carries a named authority, not an anonymous timestamp
- Every refusal is recorded with its reason and the authority behind it
- Every authority change is logged before and after publication
- Exceptions and waivers expire on a date the record can show
- Break-glass grants show the window, the holder, and the review that followed
- One export covers councils, decisions, actions, exceptions, and authority
Governance State & Continuity Pack
One export covering councils and meetings, the decision and action registers, exceptions and waivers, escalations, and the authority model in force across the period — carrying the same verifiable evidence lineage as the rest of your governance record. Find it alongside every other export in the Reports Catalog. Generate it on demand or on a monthly or quarterly schedule, delivered as both PDF and Word to the recipients you name.
Share a decision without sharing your platform
Send exactly what the reviewer needs: an auditor, acquirer, or regulator receives a single governance decision, authority decision, risk acceptance, or a full continuity pack through a link that hides what you redact, expires on the date you choose, and can be revoked the moment the review ends. No account, no export attached to an email.
Every AI framework asks who is accountable
ISO/IEC 42001: the standard expects defined roles, responsibilities, and management review of the AI management system. The authority matrix names the roles; the decision register and meeting minutes are the review.
NIST AI RMF: the GOVERN function asks for accountability structures and documented risk decisions. Risk-acceptance authority by residual level answers the first; the decision register answers the second.
EU AI Act: obligations assume a named responsible party and documented governance over the system's lifecycle. Approval routes tie each system to the person who authorized it.
Built for whoever signs their name to the decision
Executives and boards
Accountability you can name in a board meeting: who held the authority, what they decided, and what happened when the answer was no.
Compliance and governance leads
The registers, cadence, and exports your framework assessor asks for — without running the program out of a shared spreadsheet.
MSPs and consultancies
The same governance operating model across every client tenant, with client-specific authority models kept isolated from each other.
- Approval threads buried in email
- A decision log somebody updates after the meeting, sometimes
- An exceptions tracker in a spreadsheet with no expiry dates
- A RACI chart in a slide deck that no workflow enforces
- Emergency approvals granted verbally and never reviewed
- An audit scramble to reconstruct who approved what, and when
Governance operations, answered
What is AI governance operations?
AI governance operations are the recurring processes used to run an AI governance program: councils, decisions, actions, exceptions, escalation, reviews and evidence. They turn a written policy into a program that meets, decides, records what it decided, and can show that record on request.
What are AI decision rights?
AI decision rights define who has authority to approve, reject, escalate, delegate or accept risk for an AI system or use case, and under what conditions. They are configured in an authority matrix, so each approval routes to the person who actually holds the authority for that record and risk level.
Who is allowed to accept AI risk?
Whoever your authority matrix says — and nobody else. RAIC separates risk-acceptance authority by residual risk level, so a team lead can accept a low residual risk while a high residual risk routes to the executive or council named for it. The approval route is generated from the matrix, so the right approver is chosen for you rather than remembered by someone.
What happens when a decision has to be made outside normal hours?
Emergency break-glass authority grants a named person temporary powers on a countdown. The grant is time-bounded, visible while it runs, expires on its own, and triggers a retrospective review afterwards — so an urgent call stays defensible instead of becoming an unexplained approval.
What is the difference between an exception and a waiver?
An exception is a time-bounded departure from a control with an owner, a reason, and an expiry date. A waiver accepts the gap for a defined period under named authority. Both are registered, both expire, and both show up in your evidence export instead of living in someone's inbox.
Can we prove that a request was refused?
Yes. Refusals are recorded with the same weight as approvals — who decided, under what authority, on what date, and why. Most tools only keep the yes. Examiners increasingly ask about the no.
What if our authority model changes?
An impact preview shows what a proposed authority change would do to in-flight approvals and future routes before you publish it. Every change to the matrix is recorded in your audit trail, so the history of who could decide what is as auditable as the decisions themselves.
How do we hand this to an auditor?
The Governance State & Continuity Pack exports your councils, meetings, decisions, actions, exceptions, escalations, and authority model as one evidence bundle covering the period under review. Generate it on demand or on a monthly or quarterly schedule, delivered as both PDF and Word to the recipients you name.
Can we show one decision to an auditor without giving them access?
Yes. Share a single governance decision, authority decision, risk acceptance, or a full continuity pack through a link that hides what you redact, expires on the date you choose, and can be revoked the moment the review ends. Your reviewer needs no account, and nothing leaves as an attachment on an email.
What happens to approvals already open when we change who can approve?
You re-route them. Change the authority matrix and RAIC moves the approvals already in flight onto the new rule instead of leaving them on the old one. The run is reportable and safe to repeat, and an impact preview shows what it will do before you publish the change.
From the Resources library
Set your decision rights before your next AI approval.
PUT A NAME ON EVERY DECISION
Spin up RAIC in your tenant and see Shadow AI in your environment within a day.
Self-service online demo — explore RAIC's modules and workflows on your own time, no scheduling required.
MSP, reseller, and audit-partner programs. Email the partner desk.