AI guardrails checklist

Step 2 of 6

Pick environment

Choose where AI is used: an IDE assistant, autonomous agents with tools, a customer-facing feature or an internal knowledge assistant. A control about tool scopes does not apply to a plain chat assistant.

Step 3 of 6

Pick risk tier

Choose low, medium or high. Each tier shows its own controls and every control from the tiers below it, so higher risk means a longer list rather than a different one.

Step 4 of 6

Get controls

The list is filtered to what applies. Each control says why it matters, how to put it in place and what evidence shows it works.

Step 5 of 6

Assign owners

Give each control a named person, not a team, and a date. A control without an owner is a hope.

Step 6 of 6

Keep evidence

Save the evidence for each control, such as a test result, a log query or a review record, and revisit it when the system or its tier changes.