Governance Controls
The individual, assessable requirements that make up a policy.
What are controls?
A control is a single, measurable requirement that is automatically assessed against the real state of a project. Controls are grouped into governance policies and determine whether each policy is passing or failing.
A policy passes when all controls above Low importance resolve to PASS. A Low-importance control can resolve to FAIL, ERROR, or NO_DATA without causing the policy to fail.
Every assessment resolves to one of four statuses:
| Status | Meaning |
|---|---|
PASS | The requirement is satisfied. |
FAIL | The requirement is not satisfied. |
ERROR | The assessment couldn't run, usually due to a misconfigured control. |
NO_DATA | There was no data to assess in the evaluated window. |
Importance
Use a control's Importance setting to communicate how seriously a failure should be treated and whether it should block a deployment gate. Through the public API, this setting is the control's severity field.
| Importance | Use it for… |
|---|---|
| Critical | Requirements whose failure represents the highest-priority risk |
| High | Important requirements that need prompt attention |
| Medium | Standard governance requirements with moderate impact |
| Low | Advisory requirements that should be tracked without blocking deployment |
| Not set | Controls that don't need an importance classification |
Control types
There are four control types, each assessing a different part of your AI lifecycle.
Operational controls
Verify that each project has the required data, integrations, monitoring, and security configuration.
Runtime controls
Continuously check production observability metrics against defined thresholds.
Pre-deployment eval controls
Require a qualifying evaluation test run before deployment.
Pre-deployment red teaming controls
Require a qualifying red teaming risk assessment before deployment.
Versioning
Controls are versioned. Each time you change a control's configuration, a new version is appended to its history. Assessments always run against the latest version, while older versions remain available for audit purposes.
Next steps
- Policies — group controls and assign projects
- Introduction to AI Governance — learn how policies, controls, and assessments fit together
Last updated on