Read and report
The use case will read data and report what it sees. It will change nothing.
Coming soon
Give every AI use case
clear ownership and oversight.
Connect AI use cases to owners, policies and review decisions. Help engineering, security, legal and leadership teams govern adoption with a shared record of accountability.
AI use-case register
Declared purpose
Policy requirements
Review responsibility
Investigation context
01 / Describe use
Start with the purpose and context.
- Use-case purpose
- Business owner
Discuss how AI use cases should be captured for your organisation.
02 / Review policy
Make oversight responsibilities explicit.
- Policy requirement
- Reviewer
Evaluate how policy requirements and review responsibilities should connect.
03 / Retain decisions
Define an accountable decision record.
- Decision rationale
- Evaluation scope
Agree the evidence and approval history your governance workflow needs.
Policy
Model policy as code
To be evaluated against the model catalogue.
Tiers
Autonomy by use case
Risk class, budget, tool allowlist.
Chain
Signed decision log
Hash-chained, tamper-evident.
Export
Regulator bundles
Checksummed and signed.
The category
What is AI governance?
Most organisations now have AI in production before they have a way to say who approved it. Regulation such as the EU AI Act and frameworks such as the NIST AI Risk Management Framework expect more: a known inventory, a risk classification, a policy for each use, human oversight where risk is high, and records that a third party can check. AI governance turns those expectations into operating controls. Good governance is enforced at the point a model is invoked, not reconstructed from memory when an auditor asks.
System inventory
Record the AI system and its intended use.
Risk classification
Define the oversight and policy expectations.
Review record
Preserve the approval rationale and supporting material.
Designed workflow: governance capabilities follow the availability stated on this page.
The design
What will auditors ask for, and how will SecurityVault answer?
Each expectation below maps to one designed capability. The output will be evidence for your own obligations, not a legal opinion.
| Expectation | Designed capability |
|---|---|
| A policy for each AI use | Model deployments evaluated against your governance policies as code, such as blocking an internet-exposed, high-risk model that lacks authentication |
| Proportionate oversight | A registry of AI use cases, each with a risk class, an autonomy tier, a model tier, a token and latency budget and an allowlist of tools it may call |
| Regulatory classification | EU AI Act risk categories and NIST AI RMF function mapping, with gaps and remediation steps for each model |
| A record that cannot be rewritten | Every governed AI decision logged with hashes of its inputs and outputs, chained to the previous entry and signed, so any alteration is detectable |
| Evidence on demand | A signed, checksummed bundle for a chosen framework and period: models, prompts, use cases, exceptions, decisions and chain proof |
Autonomy
How will autonomy tiers limit what AI may do?
Every AI use case will be registered at one of four tiers. The tier decides what it may do alone, which tools it may call, and who must approve it.
Observe
Assist
Recommend to a person
The use case will propose; a person will decide. This is how AI already works in SecurityVault triage today, where disposition stays human-only.
Controlled
Act within limits
The use case will be able to take actions, but only with the tools on its allowlist and within its token and latency budget.
Autonomous
Act on its own
The highest tier, designed to require a named approver before any use case is granted it, with every decision written to the signed log.
Correlation
Why should AI governance draw on the security graph?
A governance decision is only as good as what it knows about the model. SecurityVault is designed to govern AI from the same graph that already connects code, artefacts, cloud and identity.
Code
Knowing which repository calls a model, and which image serves it, will turn a policy on paper into one you can enforce at release through the fail-closed deployment gates you run today.
Cloud
Exposure, deployment environment and data sensitivity will inform technical risk review. Regulatory classification also depends on the system's intended purpose and applicable obligations, assessed by your reviewers.
Identity
Every approval, exception and decision will be tied to a named person or service, so oversight is attributable rather than assumed.
Evidence
Governance records will flow into continuous compliance beside the frameworks you already map.
FAQ
AI governance questions.
- What is the difference between AI governance and AI security?
- AI security asks whether a model can be attacked or misused. AI governance asks whether a use of AI is approved, proportionate to its risk and properly recorded. Both start from one model inventory. See AI security posture management.
- Will AI governance help with the EU AI Act and NIST AI RMF?
- The planned workflow will help teams document AI use cases, review relevant EU AI Act requirements and organise evidence against NIST AI RMF functions. Legal classification depends on the system, intended purpose and your role; it requires qualified review and is not determined by a technical risk score.
- What is an autonomy tier?
- An autonomy tier states how much a given AI use case may do on its own, from observing and assisting up to acting autonomously. Higher tiers are designed to require a named approver, and a use case will never be granted a tool its tier does not allow.
- Can AI decide the outcome of a security finding?
- Not in SecurityVault. Disposition of a finding is a human-only decision with a mandatory reason code, enforced in the platform today. AI governance is designed to extend that same discipline to the AI uses in your own organisation.
- When will AI governance be available?
- AI governance is in development. Share your model oversight and approval requirements so we can discuss the relevant roadmap and evaluation boundaries.
Related offerings: AI security posture management · data security posture management. Further reading: framework cross-walks with one evidence chain. Built for GRC and audit teams and CISOs.
Discuss your requirements
Tell us how your organisation uses AI.
Discuss model accountability, approval boundaries and the governance records your organisation needs to retain.