AI Governance Starts in the Architecture, Not in PowerPoint

Personal content — not employer-related. This article is published in a personal capacity and shares thoughts and experiences based on public industry patterns — not a description of employer or client systems, and not professional instructions. It does not reflect the views, systems, projects, or policies of any current or past employer, client, or financial institution. See the full site disclaimer.

Governance decks showed up after the first incident. By then the architecture had already decided what agents could read, what was logged, and what could not be undone.

Context: Early 2026 AI governance stopped feeling theoretical in organizations I watched. Audit pressure and production agents pushed the same conclusion: controls have to live in systems, not only in policy PDFs.

The gap I kept seeing

Governance embedded in architecture layers

Most orgs had a policy committee, a principles page, a review for “high-risk” use cases. Fewer had enforced access on retrieval indexes, immutable audit for automated decisions, model and data version pins, or controls that actually block a deploy when violated.

Governance you cannot verify in code and logs is theatre.

Controls that worked when they were in the architecture

Classification drives behavior. Tag datasets and documents (public_internal, confidential, regulated, pii). Pipelines and agents read those tags for indexes, models, human review, retention. A spreadsheet does not count.

Lineage for every production output. Model id + version, prompt/template version, source ids + versions, as_of, user or service identity. Store in queryable tables so audit can reconstruct in minutes - not only scattered logs.

-- illustrative lineage / inference log (personal lab style)
CREATE TABLE IF NOT EXISTS ai.inference_events (
  event_id STRING,
  ts TIMESTAMP,
  workflow STRING,
  model_id STRING,
  model_version STRING,
  prompt_template_version STRING,
  source_dataset_ids ARRAY<STRING>,
  as_of TIMESTAMP,
  user_or_sa STRING,
  outcome STRING,
  cost_eur NUMERIC
)
PARTITION BY DATE(ts)
CLUSTER BY workflow, outcome;

Access as code. IAM, row filters, masks, retrieval scopes in version-controlled config. Avoid: “the agent uses a service account that can read most of the warehouse.”

Human-in-the-loop by risk tier. Read-only with logging. Draft/suggest with sampling review. Acts on systems of record need an approval gate. Forbidden actions blocked at the tool layer. Risk tier is a property of the workflow, not a meeting outcome.

Eval and drift after launch. Golden-set regression on model/prompt changes. Sampled production quality. Alert when override rate or policy blocks spike. Kill switch drill on a schedule.

Questions auditors ask - answers architecture should already have

Question	Artifact
What data was used?	Lineage + retrieval log
Where is a user’s data retained, and how is each copy deleted?	Deletion map covering sources, indexes, logs, caches, outputs, and backups
Who approved this automation?	Workflow config + approval audit
Cross-border processing?	Region-pinned infra + residency tags
Model behavior change?	Version pins + regression gates

Engineers do not replace legal. They make compliance operable.

Anti-patterns

Governance review after production launch. One global “AI platform admin”. Logging prompts but not retrieved content hashes. Trusting a vendor “enterprise AI” badge without your own controls. Separate AI team with no data platform accountability.

A 30-day sequence I saw work

Week 1: classify datasets used by live or planned AI workflows.
Week 2: lineage fields on inference and retrieval logs.
Week 3: risk tiers + approval gate for one high-risk workflow.
Week 4: kill-switch drill + audit reconstruction exercise.

Small verifiable steps beat a twelve-month policy program.

Closing

AI governance belongs in architecture: classification, lineage, access, approval tiers, monitoring, kill switches. Principles on slides are necessary. Enforced system behavior is what keeps you out of the incident report.