Workshop: Governance charter
Produce artifact #4: the one-page charter — appetite statement, policy skeleton, intake and board design, inventory plan, incident path — plus the first-90-days checklist.
Workshop four compresses the module into the governance charter: one page that makes your program governable and your governance credible, plus the 90-day checklist that makes it real. This is the artifact your board's risk-minded member will read first — write it for them.
- 1Write the risk-appetite statement (4–6 sentences, Alder's as the template): what's open, what's gated, what's forbidden, what dependency you accept. Read it against your funded portfolio — every initiative should be classifiable in one sentence using only the statement. If one isn't, fix the statement or flag the initiative; that friction is the workshop working.
- 2Draft the one-page acceptable-use policy skeleton: the three verb-first sections (may / needs review / never), your approved-tools list as of today, and the data-class line (align it to whatever classification your company already uses — invent nothing new). Run it past one skeptical non-executive reader for the three-minute test.
- 3Design intake + board: the five intake questions, the routine-vs-review bar (derived from the appetite statement), board composition with names, meeting cadence, and the two calibration gauges (intake latency target: ≤5 business days routine; exception-rate review: quarterly). One paragraph each.
- 4Plan the inventory: the register's columns (system, task, data touched, owner, tier, last review), the amnesty sweep announcement (draft its two sentences now — tone decides everything), and the tiering pass with counsel from the regulation radar. Date each.
- 5Define the incident path: the named contact, the no-blame sentence for the policy, the three-way triage (wrong-answer / leakage / compliance), and where learnings land (board agenda, standing item). Then assemble all five pieces onto the one page, and append the first-90-days checklist, in order: policy shipped (wk 2), board seated and first intake decided (wk 4), amnesty sweep done (wk 6), inventory tiered (wk 10), first calibration review (wk 12). Board seating precedes the amnesty sweep it will adjudicate.
ALDER LOGISTICS - AI GOVERNANCE CHARTER v1 owner: J. Okafor
APPETITE drafted+reviewed AI: all internal work. triaged AI:
customer routing. human-approved always: external sends,
money, employment. never: safety-relevant decisions.
vendor dependency accepted w/ exit plans on file.
POLICY 1 page, may/review/never - approved tools listed - data
classes per existing infosec tiers. ships wk 2.
INTAKE 5 questions - routine bar per appetite - <=5 day SLA.
BOARD ops (chair), legal, IT-sec, data lead, rotating biz lead.
biweekly. decides, not advises.
INVENTORY register + amnesty sweep (wk 6) + counsel tiering (wk 10).
INCIDENTS named contact - no-blame - triage 3 ways - board standing item.
CALIBRATION intake latency + exception rate, reviewed quarterly.You are a skeptical, time-pressed board member reading my one-page AI policy for exactly three minutes before the meeting: [paste the one-page acceptable-use policy and appetite statement]. Attack it. (1) What's vague enough that you'd exploit or ignore it? (2) Which line sounds like ceremony rather than a real control? (3) What's missing that would make you distrust the whole program? (4) What one question would you ask in the room that I can't answer well? Be blunt; you have no time for hedging.
If the policy can't survive a hostile three-minute read, it won't survive the boardroom. Tighten every line the simulated skeptic circled before you present.
~16 minutes to read; the charter drafts in a focused half-day, but the elapsed timeline is the 90 days the checklist lays out (board seated wk 4, amnesty sweep wk 6, tiering wk 10). DELEGABLE: drafting the policy skeleton, standing up the intake form, running the amnesty sweep and building the register, scheduling the tiering session with counsel. YOU, PERSONALLY: the risk-appetite statement (this is the one paragraph no one can write for you), chairing the board for the first 90 days, and the final owner/tier calls.
Three governance failures to diagnose from artifacts alone: a 19-page policy nobody read (find the five sentences worth keeping), a review board that meets monthly and has approved nothing in two quarters (which gauge is screaming?), and an intake log showing routine requests averaging 22 days (trace the bottleneck; it's a person, and the fix is a bar, not a beating). Governance debugging is pattern recognition — these are the three patterns.