# Focus & Stack

Governance, Compliance, Risk Management, Audit, Safety, Access Control, Policy

Policies, permissions, review processes, and technical guardrails that let organisations use AI confidently. Not governance that blocks adoption. Governance that enables it by ensuring quality, safety, and accountability.

## What we implement

### AI Use Policy

Approved use cases by risk level, data handling rules, output review requirements, acceptable use guidelines. Practical, not theoretical. Designed for your context.

### Model & Tool Inventory

Every AI system registered: what it does, what data it accesses, who owns it, risk classification, last review date. You can’t govern what you can’t see.

### Risk Classification

Low risk (basic guidelines, spot checks), medium risk (human review, quality evaluation, audit logging), high risk (mandatory review, comprehensive audit, incident response).

### Access Controls

Role-based access to AI tools. Data-level permissions. API key management. Approval workflows for new deployments.

### Output Guardrails

Technical measures in the AI pipeline: input filtering, output validation, brand/tone checking, PII detection, compliance rule checking. Automated, not relying on people remembering to check.

### Audit Trails

Every AI interaction logged: input, output, model, timestamp, initiator. For reviewed outputs: who, when, what changed, final result.

## How we implement

### Assess—Step 1

Classify existing AI use cases by risk level.

### Design—Step 2

Proportionate controls for each risk tier.

### Implement—Step 3

Technical guardrails, access controls, monitoring, audit infrastructure.

### Train—Step 4

Staff on governance requirements and processes.

### Maintain—Step 5

Ongoing inventory updates, periodic reviews, quality assessments.

## Deliverables

### What you get

- AI use policy tailored to the organisation
- Risk classification framework
- Model and tool inventory with maintenance process
- Access control implementation
- Guardrail configuration
- Audit trail infrastructure
- Incident response procedure
- Training materials

## Case Study

**Hashlock AI Auditor**  
An AI audit platform operating in a high-trust domain — with review gates, traceable reasoning and the controls needed for AI output to be accountable, not guessed.

## Scaling AI adoption and need proper controls?

Governance that’s too heavy kills adoption. Too light creates risk. We help organisations find the right level and implement it technically, not just on paper.