Introduction

Four people open AI Governance for four different reasons, and reading it front to back serves none of them. Pick the path that matches why you are here.

Everyone should read Core Concepts & Data Model first. It is fifteen minutes and every other page assumes it.

Security lead — "what are we exposed to?"

Your question is coverage: what exists, what is governed, and what we can actually stop.

1. Discovery overview — how shadow AI gets found.

2. Connection Types — read this before promising anyone enforcement.

3. Agent Registry — and specifically the POLICIES column.

4. Incidents — including who should be able to read them.

The number to report: not how many agents you have, but what share of them carry at least one policy. The first is an inventory; the second is a programme.

Compliance lead — "can we evidence this?"

Your question is defensibility: mapping obligations to controls, and producing a trail an assessor accepts.

1. System vs Custom Policies — framework packs are your starting point.

2. Policy Data Model — what an incident can prove.

3. Severity — why the column is often blank, and how to fix it.

4. Investigate an Incident — what a triage record looks like.

The thing to settle early: a framework pack is instrumentation, not certification. Applying one gives you the ability to demonstrate compliance; it does not assert it.

Platform engineer — "how do I wire this up?"

Your question is mechanics: connections, instrumentation, and what happens when something is missing.

1. Govern Your First Agent — the whole chain in fifteen minutes.

2. Add an Application — including sync cadence and auto-register.

3. Register an Agent Manually — for anything Discovery cannot sweep.

4. Sessions, Traces & Spans — everything downstream derives from these.

The trap: registering an agent is not instrumenting it. A registered, uninstrumented agent reports nothing and looks governed.

FinOps or product owner — "is it worth it?"

Your question is economics: what this costs, and what it returns.

1. Where Spend Comes From — the five cost types, and why two of them are yours.

2. Outcomes & ROI — turning agent activity into money.

3. Evaluation — quality, and what measuring it costs.

The number that will be challenged: return on spend divides by tracked spend. Report the untracked remainder alongside it, or somebody else will find it.

Whatever your role

Three things cause more confusion than anything else in this module. Reading them once saves everyone a meeting.

1. Discovered is not registered — A sweep finds assets. Registering them is a separate act.

2. Governed is not enforced — Whether a control acts or only records depends on the connection tier.

3. Evaluation is not a control — A bad quality score raises no incident and stops nothing.