AI Governance
The Machine Can Look. It Should Not Touch. Not Yet.
My thinking on the future of AI in solving enterprise problems. Part 1.
Why AI should find your marketing data problems and people should approve the fixes.
Written for business leaders, not engineers. No jargon. I promise.
What problem are we talking about?
Every large company runs its marketing on plumbing most executives never see. Tags on web pages. Consent banners. The quiet connections that tell Google or Meta what a customer bought. When this plumbing breaks, and it breaks all the time, nobody hears a crash. Revenue gets counted twice. A consent setting stops working. Your bidding algorithms keep spending real money on bad information. Today, people find these problems one ticket at a time, often weeks late. Nobody can keep up anymore. It is too complicated and it moves too fast.
The hidden plumbing
When marketing data breaks, nobody hears a crash.
Revenue gets counted twice.
A consent setting stops working.
Bidding keeps spending real money on bad information.
Today, people find these problems one ticket at a time, often weeks late.
So why not let AI fix it?
It’s tempting. The models get smarter every month. A vendor walks in and says: our AI finds it and fixes it, no humans needed. Sounds wonderful.
Here is the one question I would ask. Who approved that change?
If the answer is “the AI did,” you don’t have a technology problem. You have a governance problem. Your auditors, your privacy lawyers, and your security team already have rules for anyone who changes your systems. Those rules don’t care whether the changer is an employee, a contractor or software.
"If the answer is 'the AI did,' you don't have a technology problem. You have a governance problem."
Share on LinkedInSOC 2, the security standard most enterprise buyers ask for, has no chapter on AI. It does have a rule for anyone who makes changes: ask first, get approval, keep a record, and be able to undo it.
Consent is the sharpest example. If a machine “fixes” your consent banner and gets it wrong, that is not a bug. That is a privacy violation you caused. Regulators have already penalized companies for banners that malfunctioned, even temporarily.
What I learned from a defense company
Recently, at an event in LA, I heard Palmer Luckey, the founder of Anduril, speak. I went home and spent hours reading everything I could about how they think. If anyone deals with actions that can’t be undone, it’s the military.
Here is the pattern as I read it from public material:
- The smart systems watch and recommend.
- A fixed, tested process carries out the action.
- A human authorizes anything that can’t be taken back.
Finding and fixing are two different jobs, and they must play by two different rules.
Finding: let the machine be curious. Let it watch every page, every tag, every setting, every day. Let it guess, compare, explain what’s at risk and suggest a fix. If it’s wrong, the cost is a false alarm.
Fixing: make the fix boring. Boring is a compliment here. Use a playbook that has worked before. A named person on your team says yes. Every step is written down. Then check that it worked, and if it didn’t, go back to how it was. No creativity at this step. None.
Finding vs. Fixing
Two jobs. Two different rules.
AI is excellent at finding problems. Fixing them inside a live business needs a process you can prove.
Finding · The machineLet the machine be curious
- Watch everythingEvery page, tag, consent setting, every day
- Spot what looks wrongCompare against what normal looks like
- Explain why it mattersMoney at risk, customers affected
- Suggest a fixA recommendation, not an action
If it's wrongThe cost is a false alarm.
Handoff: Nothing changes yet
Fixing · People + processMake the fix boring
- Pick a proven playbookOnly fixes that have been tested before
- A named person approvesYour person, with their name on it
- Make the change, write it all downWho asked, who approved, what changed
- Check it worked, undo if notOne button back to how it was
If it's wrongGo back to how it was.
AI finds. People decide. Proven playbooks fix. Everything is written down.
See what's broken in your marketing data today.
Tag Inspector scans your tags, cookies and consent settings and shows what's at risk. It finds. You decide.
Isn't a human in the loop just slower?
Fair question. Yes, at first. Erik Brynjolfsson at Stanford warns about what he calls the Turing Trap: chasing automation that replaces people instead of making them more capable. His research also shows the payoff from big technology shifts arrives after companies rebuild how the work gets done, not the day the software ships.
My read: the approval step is not a tax. It is how you earn the right to do more. A fix that has run cleanly twenty times, with a record to prove it, is a fix you can let run faster. Autonomy is earned, not granted.
How a governed fix moves
Six steps. One named approval.
AINamed personProven process
- 01DetectAI spots the break
- 02RecommendExplains the risk and suggests a fix
- 03ApproveA named person on your team says yes
- 04ApplyRuns a playbook that has worked before
- 05LogEvery step on record, ready for your auditor
- 06VerifyChecks the fix worked
Didn't work?Undo it and go back to how it was. No creativity at this step.
Autonomy is earned, not granted
What this means for you
When an AI vendor offers to fix your stack, ask three things:
- Who approves each change, by name?
- Can I see a record of every change, good enough to hand to my auditor?
- If it goes wrong, how fast can I undo it?
If the answers are vague, you are buying alerts with a nicer demo.
Before you buy
Three questions for any AI vendor that offers to fix your stack.
01Who approves each change, by name?
02Can I see a record of every change, good enough to hand to my auditor?
03If it goes wrong, how fast can I undo it?
Vague answers?You are buying alerts with a nicer demo.
Where we stand, honestly
This is what we are building at InfoTrust. Today our software finds problems, and our people fix them with customer approval, with every change logged. We are turning those fixes into proven playbooks the product can run. We are not all the way there, and I won’t pretend otherwise. But I’m convinced the lasting advantage in this market is not a smarter model. Everybody will have a smarter model. It is fixing things in a way you can prove.
Part 1 of a series
To read more, subscribe here.
Stay in the loop with our latest updates!
Hear first when Part 2 of Alex’s series publishes.
You're subscribed.
Watch your inbox for our next update.
The Machine Can Look. It Should Not Touch. Not Yet.
