More solutions create more dependencies
One pilot can be managed locally. When more teams build, buy, or connect AI, ownership, access, and shared controls become an organisation-wide concern.
A framework built around six elements
Our AI governance framework consists of six elements. Below, we explain how to keep track of your agents, control access to data and tools, and monitor solutions in production. We also cover the decisions involved in building and running your own agents in the cloud.
Why is AI governance important?
AI can act for the organisation
AI applications and agents can read data, use tools, and affect processes. They need clear boundaries and defined points for human approval.
Controls have to work in production
Policies make no difference on their own. The systems running AI must enforce, trace, and test them.
- 01
Governance & Protection Layer
This layer defines responsibilities and policies for AI use, misuse prevention and token spend. A shared agent registry acts as a catalogue of the organisation's agents and MCP servers, which connect AI to tools and data. Teams can find and reuse approved solutions and see who owns them. Together with the gateway, the catalogue provides a basis for controlling who can use what.
- 02
Users, Copilots & Apps
This is where employees and customers interact with your AI solutions, for example through a copilot or a customer-facing app. In the framework, these solutions connect to the shared Agent Gateway. This gives them one route to the agents and tools each user is allowed to access.
- 03
Agent Gateway
The Agent Gateway is the shared integration layer between your AI solutions and the agents, models and tools they use. When each app connects directly to systems and databases, each team has to build its own connections and access controls. The gateway brings control of this traffic into one place. Here, you can check user and agent access, route requests to the right service and enforce shared usage limits. Connected systems continue to enforce their own permissions.
- 04
Agent Runtime
Agent Runtime covers how you run the agents you build and operate in the cloud. Here, you decide where to store conversations and sessions, whether the agent should remember information across conversations, and how long to retain it. You also choose how the agent uses and switches between models, and which actions require human approval.
- 05
Tools & Integrations
Tools and integrations let agents retrieve data and perform tasks in your systems, such as looking up a customer or creating a support case. Connections can use MCP servers or other approved integrations. They are listed in the shared catalogue and accessed through the gateway, giving you an overview of the tools each agent and user may use. For each connection, you need to define which data it may read and which actions it may perform.
- 06
Observability & Monitoring
The bottom layer makes solutions visible in production. Logs, metrics, and evaluations show what solutions return, which actions they take, what they cost, and where quality or security changes.
Questions about the framework
Does the framework work across cloud platforms?
Yes. The framework describes responsibilities and controls without requiring specific cloud products. The implementation can use your current platforms and tools.
Make the framework concrete in your organisation
We can help turn governance into clear decisions, technical controls, and a plan that matches your current AI adoption.