Why AI governance matters
Without a control structure, an AI can send company data to arbitrary models or providers without oversight and perform unclear actions. KAI separates this structurally into three questions: Who may access what? Where may which data flow at all? And which actions may run without approval, and which only with it?
Data and access control
Knowledge can be assigned to departments, every tenant is strictly separated, and role and department permissions determine which documents and answers a person gets to see at all.
Model and provider governance
For each tenant you can define which AI models may actively be used at all and which external or cloud-based provider processes requests – instead of being locked into a single provider.
Data classification and target systems
Rules link a data classification to a target system – such as a specific provider, model, department or execution source – and define what happens in that case. These rules are evaluated by priority before a request reaches its target.
The request may reach the target as intended.
The request is blocked for this target instead of being silently processed further.
The request may only be processed locally or within your own infrastructure.
Capabilities and action permissions
Independently of general knowledge access, a separate rule set defines which concrete actions an AI agent may propose at all. These action permissions can be configured per tenant and agent and can only ever be narrowed, never extended beyond an agent's base permissions.
Human approval
Actions classified as risky are never executed directly by an AI. They must be reviewed and approved by another, separately authorised person – self-approval by the same person is not possible.
Audit and traceability
A governance overview with time-range filters and activity logging for agent executions make decisions and actions traceable – including the reason for each decision – instead of a black box.
Governance for AI agents
The same structure – access rights, action permissions, approvals and logging – applies to every AI agent. Details on roles, tools and the approval process can be found on the AI agents page.
Private AI and governance
The "process locally only" decision from data classification is the concrete link between governance and Private AI at KAI: governance rules can enforce that certain data never goes to an external provider.
AI governance at KAI in detail.
What does KAI mean by AI governance?
Three separately controlled questions: who may access which knowledge, to which models/providers which data may go, and which actions may run without approval or only with it – with traceable logging.
Can specific models or providers be restricted?
Yes. For each tenant you can define which providers and models are actively usable, and rules can require that certain data is only processed by specific models, providers or exclusively locally.
Can sensitive data be blocked for certain targets?
Yes. Rules link a data classification to a target system and a decision – allow, deny or process locally only – evaluated by priority before a request reaches its target.
Can AI actions require approval?
Yes. Risky actions can require approval by another, separately authorised person before anything is executed. Self-approval is not possible.
Are AI actions logged?
Yes. A governance overview and activity logging for agent executions make decisions and actions traceable.
Talk to us about your governance requirements.
We will show you which access, model and approval rules fit your organisation.