A policy stack for advanced AI governance.

Policies should define decision rules, not merely aspirations. Each policy should map to controls, owners, evidence and exceptions.

Mandate, scope, governing bodies, risk ownership and minimum control expectations.

Mandatory evaluations, approval thresholds, restrictions and release authority.

Permissions, credential handling, external actions, autonomy and human review.

Telemetry, alerts, retention, review cadence and intervention triggers.

Severity, containment powers, escalation, evidence preservation and recovery.

Who can approve exceptions, duration, compensating controls and expiry.

Minimum policy schema

Section	Question
Purpose	What governance outcome does this policy establish?
Scope	Which systems, teams, deployments and capabilities are covered?
Requirements	What actions are mandatory, prohibited or conditional?
Decision rights	Who may approve, block, override or stop?
Evidence	What must be recorded to demonstrate compliance?
Exceptions	How are deviations approved, time-bounded and reviewed?
Review trigger	What changes force policy reassessment?