Shelf five · Putting it to work
Guardrails & Responsible AI
Kitchen table
Rules about what the machine may do on its own and when it must come and ask a grown-up. It can draft the letter, but not send it. It can suggest the refund, but a person clicks the button. Like a learner driver: allowed on quiet roads with an instructor who has their own brake pedal, not on the motorway on day one. The point is not distrust. The point is that trust is earned a road at a time.
Whiteboard
Least privilege for something that improvises: scoped credentials, allow-lists over deny-lists, approval gates on irreversible actions, sandboxes for anything exploratory, input and output filters, and a blast radius you have actually calculated rather than gestured at. Layered, because any single check will be argued past eventually – by the model or by a user. The design question that organises everything: if this goes as wrong as it can go, what is the maximum damage? Engineer that number down first, capability second.
Boardroom
This is where regulators, auditors and your own risk committee will look first, and the EU AI Act era has made 'we had controls designed in' versus 'we were going to add them' the difference between a finding and a fine. Retrofitting is far more expensive than designing in – true of security for twenty years, truer here. The reframe worth carrying into strategy: strong guardrails are not the brake on AI adoption, they are what makes bolder adoption defensible. The teams that can prove control get to move faster.
Related concepts