AI governance gates that don't slow delivery: the five gates

In this lesson you'll learn:

• the five gates, who owns each, and the evidence each one needs;
• what a gate decision record contains, so a gate is a decision rather than a formality;
• how to keep governance fast: owners who can evaluate, and approvals struck that cannot.

Sound familiar?#

• A product manager is approving pull requests they cannot evaluate, and nobody signs the shadow results.
• "Governance" is a steering committee that meets monthly and asks for numbers nobody has.
• The agent launched, and nothing was set up to notice when it stopped being good enough.

Governance done this way is slow and weak at once. Done right, it is five decisions with evidence, and each takes less time than the meeting it replaces.

What are the five gates?#

Run the gates, step by step#

Step 1 · Give each gate one owner who can evaluate it#

The most common governance failure is a product manager approving a pull request. Strike every approval that its owner cannot evaluate, and insist on being asked the ones they can. Behaviour and expansion belong to QA, because they are questions about measured evidence.

Step 2 · Write the gate decision record#

Each gate decision fits on a page: the question the gate asks; the evidence that was actually in front of the owner, with denominators; what would have made the answer no; any conditions; what the owner could not evaluate and who should have; and a signature. A record like this takes minutes, and it is what makes a gate defensible to an auditor six months later.

Step 3 · Hold only what must halt#

Most decisions in an agentic build do not need to stop anything. Only the hard gate between design and build halts, along with the decisions that fail any of its four questions; the rest run behind placeholders with an owner and a date. Treating everything as a hard gate is how governance becomes the bottleneck.

Step 4 · Wire the drift alert to the release gate#

A released agent can stop being good enough with no deploy at all. When the output mix breaches its drift threshold, the release gate re-opens automatically: nobody has to decide to reconsider. Drift monitoring

Step 5 · Report two numbers, paired, every cycle#

The sponsor's governance is one line: what the feature saved and what it cost, with the review hours and re-runs beside them so neither number can be gamed. Every measure is reported next to its side effect, because a number reported alone gets pushed.

Who signs what#

Where you'll use it#

• In a governance forum: replace status reporting with five gate records.
• In a regulated industry: the gate records and the evidence pack are what an auditor reads.
• With a risk framework: NIST's AI Risk Management Framework organises the same concerns into govern, map, measure and manage; the five gates are where they become named decisions.

Why it matters#

Gartner lists inadequate risk controls among the three reasons it expects over 40% of agentic AI projects to be cancelled by 2027. Controls fail less often from a lack of rules than from a lack of owners and evidence. Five gates, each with a named owner deciding on written evidence, supply both, without adding a single meeting.

Key takeaways#

1. Five gates, each with one owner who can evaluate it: intent, plan, behaviour, release, expansion.
2. A gate is a decision record with evidence and denominators, signed, not a click or a vote.
3. Drift re-opens the release gate automatically, and governance reports two numbers, paired.

FAQ#

What is AI governance in practice?#

Named people making specific decisions on written evidence at defined points: whether an AI feature is worth doing, whether its plan and controls are right, whether it meets its bar, whether it is safe to release, and whether it has earned wider use, plus a standing rule for what re-opens those decisions.

Who should approve an AI agent for production?#

Different people for different questions. In this manual the product manager owns release (is it safe to show a few real users?) on the evidence of a shadow run and a rehearsed rollback, while the QA lead owns behaviour and expansion, which are questions of measured evidence.

How do you govern AI without slowing delivery?#

Give each decision one owner who can evaluate it, halt only on the decisions that are expensive to reverse, run the rest behind placeholders, and replace status meetings with short decision records. That is usually faster than the process it replaces.

How does this relate to NIST's AI Risk Management Framework?#

The NIST AI RMF describes four functions (govern, map, measure and manage) for managing AI risk across an organisation. The five gates are one concrete way to run those functions for a single product: named decisions, specific evidence and a standing trigger for re-evaluation.

Apply it in your role#

Across the enterprise. Gates scale when they are per product and evidence-based. A central board then reviews exceptions and drift alerts, not every release.

The ten-minute workflow. A gate review prepared in advance:

Here is our evidence pack: <paste the index>. For each gate (intent, plan, behaviour, release,
expansion) list the evidence it needs, whether we have it (quote the file), who signs, and what would
re-open it. Flag any gate whose evidence is a meeting rather than a document.

Sources and credits#