AI governance

AI governance turns principles into operating rules. It decides which uses of AI are allowed, who owns each system, what data it may touch, what review happens before launch, and how performance and risk are monitored afterward. Frameworks such as the NIST AI Risk Management Framework and laws such as the EU AI Act provide structure; governance is how an organization applies them to its own systems.

For AI agents, governance has to reach past the model to the actions. A policy that says a person approves every payment only matters if the platform actually stops the payment step until someone approves it. The same holds for data access, logging and change control: governance that lives only in a document is not enforced when a model does something unexpected.

A governance committee requires that any agent touching customer accounts screens input for prompt injection, gets approval before changing a record, keeps a replayable record of every run, and is evaluated again whenever its model or prompt changes.

In Dynamiq, those requirements map to platform controls: SSO on Enterprise, organization roles and private projects for access, detectors and validators on input and output, approval gates on consequential steps, versioned deployments with rollback, every run traced and replayable, and real-time evals with an AI agent that surfaces issues from production traces. The platform supports a governance program; it does not certify a customer's compliance.

Sources: NIST, AI Risk Management Framework