Introduction
AI Governance runs in four stages: discover, register, govern, measure. They happen in that order, each one depends on the one before it, and skipping a step is the most common reason a programme stalls.
The four stages
Stage | You do | You get | Where |
1 · Discover | Connect a platform | An inventory of what it hosts |
|
2 · Register | Choose what to govern | Assets with owners, in a registry | The connection's |
3 · Govern | Apply policies | Controls evaluating traffic, and incidents |
|
4 · Measure | Score, cost and value it | Quality, spend and return |
|
1 · Discover
You point UnifyApps at a platform you already use, through a connection your tenant already holds. It calls that platform's own list-agents API and returns what it finds.
Nothing is inferred and nothing is guessed, which is what makes the inventory reconcilable against the source system — the property an audit needs.
What you learn here is usually the point. Most organisations discover more agents than they expected, and the gap between the count and what the platform team believed is the finding.
2 · Register
A sweep does not govern anything. It produces discovered assets on the connection, and registering is a separate, deliberate act.
That separation is a feature. You get to see everything that exists before deciding what you are accountable for, and choosing to leave something unregistered is a defensible decision rather than an oversight.
Register by toggling individual assets, using Register All, or by turning on Auto-register agents once you know what a platform holds.
3 · Govern
Governing means applying policies to registered assets.
A control is one rule: what to detect, where to look, what to do about it.
A policy bundles controls and covers assets — hand-picked, or matched by rule.
An incident is what a control produces when it matches.
Start with a shipped framework pack on a handful of agents rather than writing controls from scratch across the estate. The first week's job is learning what governance produces on your real traffic.
Refer: Whether a control can act or only record depends on the asset's connection tier, not the control. Settle that before promising anyone enforcement — see Connection Types.
4 · Measure
Everything quantitative derives from the traces your agents produce.
Quality — Evaluators score live traffic; experiments test changes against fixed datasets.
Cost — Spend, split by type — including what your own evaluators and checks cost to run.
Value — Outcomes turn agent activity into money, so spend can be weighed against return.
An agent that is registered but not instrumented reaches this stage and reports nothing. If the numbers are empty, check LAST TRACE before assuming a fault.
Why the order matters
Each stage is bounded by the one before it, and the failures are predictable.
Skip | And you get |
Discover | A registry of what someone remembered, which is never the whole estate. |
Register | An inventory nobody owns. Incidents route nowhere. |
Govern | A list of agents with no rules attached — visibility mistaken for control. |
Measure | No answer to "is this worth running", which is the question you will be asked. |
A realistic first month
Week 1 — Connect your two busiest platforms. Read the inventory. Reconcile it against what people believed.
Week 2 — Register what matters, with owners. Apply one framework pack to a handful of agents.
Week 3 — Read the incidents. Tune the noisiest controls. Grade their severities.
Week 4 — Widen coverage by rule. Add one evaluator. Define one outcome.
The temptation is to cover everything in week one. It produces an incident queue nobody works, which is indistinguishable from no governance at all.