Best Practices Guide
AI Decisions Requiring Board Approval
The board should approve decisions that set or change the organization's AI risk boundaries: AI risk appetite, high-impact autonomous use cases, material third-party model or data dependencies, the maximum authority granted to AI agents, and exceptions to approved policy. Management and technical owners should decide everything that operates inside those boundaries. Each reserved decision needs a defined trigger, a named owner, runtime controls that enforce the limit, and audit evidence that can be reported back.
Treat board approval as a decision-rights problem
Board approval works best when it is treated as a question of decision rights: which decisions belong to the board, which are delegated, and who owns each one. Write down the five board-reserved decision types and name an owner for each.
- AI risk appetite
- High-impact autonomous use cases
- Material third-party model or data dependencies
- The maximum authority granted to AI agents
- Exceptions to approved policy
For every reserved decision, define a trigger, a named owner, the runtime controls that enforce the limit, and the audit evidence that can be reported back to the board.
Criteria and thresholds that trigger escalation
Define escalation thresholds so that it is clear when a decision moves from management to the board. Set thresholds for each of the following:
- Risk tier
- Autonomy
- Financial exposure
- Data sensitivity
- Regulatory impact
Who decides what
The board approves the boundaries. Management and technical owners decide everything that operates inside them, and runtime controls and audit evidence connect the two.
| Stage | Role |
|---|---|
| Board approves | Risk appetite, agent authority ceilings, high-impact use cases, and policy exceptions. |
| Executive bodies decide | Use cases and changes that fall inside approved boundaries. |
| Runtime controls enforce | Permissions, tool-call rules, and least-privilege access apply the limits. |
| Evidence returns | Audit logs and a decision register show adherence to the board. |
Agent authority is the decision most often missed
The maximum authority granted to AI agents is a board-reserved decision. Set a board-approved ceiling on agent authority, and delegate per-agent scope to an executive body that decides within that ceiling.
Translate approved limits into runtime controls
An approved limit only matters if it is enforced. Map each approved limit to a specific permission, policy, or approval workflow in production, so that permissions, tool-call rules, and least-privilege access apply the boundary the board set.
Evidence and records for board reporting
Create a decision register that links each approval or exception to its runtime policy. Audit logs and the register together show the board that its limits are being followed.
Agree on a recurring board report built from enforcement logs, including exceptions and blocked actions.
Turn approved AI limits into enforced policy
See how runtime governance applies agent permissions, tool approval workflows, and audit logging to the boundaries your board sets.
Request a Demo