Chapter 1.

The Nature of Governance

Every large company has a shelf of documents that describe how it’s supposed to behave. Privacy policies, security standards, data handling rules, the contracts it signed, the commitments it made to regulators and customers. Ask anyone where the company's governance lives and they will point at that shelf.

But the shelf is not governance, it’s a record of governance intention. The governance is the sum or all the things the company actually does when someone reaches to use a piece of data and has to decide, right then, whether that use is one the company allows. The documents describe that decision in advance, but they’re not the decisions.

This is easy to miss, because for a long time the two looked like the same thing. A company would decide how it wanted to handle something, write it down, and the writing-down felt like the governing. If the rule was on the page and the page was in the binder, the company had governed. That worked as long as a person stood between the rule and the data, someone who had read the page, understood the business, and was there to apply it when the moment came. The document contained the rule; the person carried it to where the data was actually used. Governance was the two of them together, and because a person was always in the middle, nobody had to notice that the document alone did nothing.

Whatever the company knows about how it should behave, it has always been the people who carried that knowledge to the point where it mattered. Someone remembered the policy, or knew who to ask, and happened to be in the room when the decision came up. That is how an organization's judgment actually reached its behavior: through people, one decision at a time. The documents were how the judgment was stored and passed along. The application of it was always human.

That arrangement had a limit built into it, and the limit was the person. A company could only govern as many uses of data as it had people to stand in front of them. For most of business history that was enough, because data was used at the speed people worked. A request was made, a person considered it, an answer came back. Slow, but the volume was slow too, so the people in the middle could keep up.

Then data stopped being used at the speed of people. First there was simply too much of it. The number of times data got used in a day outran the number of people who could possibly review those uses, and the documents on the shelf kept describing decisions that no one was there to make. The response was to build better documents, richer catalogs, more detailed policies, more thorough assessments, but that only described the growing gap in finer detail. It did not close it. The thing that applied the judgment was still a person, and there were never going to be enough of them.

Now machines use data on their own. An agent, a model, an automated pipeline reaches for data and acts, and there is no person in the path and no pause in which to put one. The decision about whether that use is allowed has to happen at the same moment the use happens, or it does not happen at all. For most companies today it does not happen at all. Their systems use data all day long against rules that are written down somewhere and applied by no one, because the person who used to carry the rule to the moment of use cannot be in a million places at machine speed. Faced with that, a company has only two crude options, and most take one or the other. Some let the machines run and hope, governing nothing for now. Others lock the data down, restricting broadly because they can't decide precisely, and pay for it in agility and in the value they never get from data they were too blunt in governing to use safely. Both are the same failure in differing guises; without a decision that can be made at the moment of use, the only choices left are too under, or overgoverned.

This is what broke as enterprises scaled, and it is worth being specific about what broke. It was never the company's judgment – companies know what they want. They have spent decades working out how they should handle information, and that knowledge is real and hard-won and sitting right there on the shelf. What broke is the way that judgment failed to translate to behavior. The method was always a person carrying a rule to the place it was needed, and that method cannot scale to the speed and volume at which data is now used. The judgment survived, but delivery failed to scale.

Say that plainly and you’re looking at a different problem. The task was never to write down what a company intends; companies did that long ago. The task is to make sure what a company already believes actually reaches every use of its data, at the moment of use, without a person needing to carry it there. Governance has always meant working out what is happening and then deciding what is allowed. Until now, a person did both. We will come back to what it means to separate them. For now the point is simpler: the decision was always the organization's, and the carrying of that decision to where it needs to be applied has always been the bottleneck.

An organization's judgment can be applied on its own, to every use of data at the moment it happens, in all the places a person could never be. Not only documented, but also applied. The rules a company spent years building stop living on the shelf and start running, continuously, on the actual use of data by its systems and its people. That is Runtime Governance, the organization's own judgment, applied at the speed its data now moves.

Runtime governance does not replace the judgment – it applies it. People still decide what the company allows, still weigh the risks, still resolve the hard cases, still change the rules as the business changes. What is new is that those decisions no longer sit on a shelf, waiting on a person to be present to apply them. These decisions reach the data on their own, everywhere, every time.

From here I want to answer three questions. What is that decision, exactly, and where does it happen? How can a machine apply the company's judgment without taking it over from the people who are responsible for it? And what does a company become when it can grow, automate, and hand its work to machines, and still do what it decided?

Chapter 2.

The Governance Decision

Every governance function, whatever the department calls itself, is answering the same question: under what conditions may this organization use this information? Privacy answers in the language of law, contracts in the language of obligation, security in the language of access, risk in the language of harm. But it is one question, and there is only one place it actually gets answered: the moment an agent, a system or a person tries to use a piece of data, when that use is either permitted or refused.

Everything else is preparation for the moment of use, where that decision actually gets made. The data inventory grounds the decision in what data is being used, a policy records what is permitted in advance, an assessment gathers evidence, sometimes before the use and sometimes long after it, and a committee argues the hardest use cases. None of that happens at the moment the data is used, and that moment is the only one that counts, because that is where permission is either honored or not. For most of enterprise history a person attempted to be present at that moment, someone who had read the policy, knew the business, and could hold the answer in their head long enough to say yes or no to the request in front of them.

That worked while one person could see the whole picture, but it broke for a reason most people mislabel as speed. Speed is part of it, but the deeper problem is breadth. Making this decision correctly today means weighing dozens of overlapping regulations, contracts, consent states, jurisdictions and internal commitments against one specific use of one specific piece of data, in the moment, across thousands of uses happening at once. No person can hold that much and watch that many things at the same time, reliably, every time. Big data meant the job had already outgrown the human doing it before machines ever started using data on their own.

Then machines began using data on their own, at tremendous speed. When an agent, a model or an automated pipeline uses data, no person is in the path and there is no pause in which to place one. The decision gets made in the same instant the use happens, or it is not made at all. Not at all is where most enterprises are today, their systems using data all day long against rules no one is applying in the moment.

To cope, enterprises have assembled a patchwork of tools held together by people. A catalog describes what data the company holds, while a policy engine resolves a rule. Separately a review board convenes, and assesses document intent. None of them can make the whole decision. Each one hands more information to a person so the person can make it, and that person is no longer fast enough or broad enough, and increasingly is not even present when the data is used, which is the whole promise of AI.

The decision itself is what we build at Ethyca.

When an agent, a system or a person attempts to use data, we decide in that instant whether that specific use is permitted, by checking it against the rules the organization has already set. One decision, made where the use happens, out of judgment the company has already defined. Everything else exists to make that decision correct, fast and explainable, everywhere data is used.

Every decision is made against what the organization already knows, and a large enterprise already knows a lot of it, just never in one place. We know what the data is, because it has been classified and inventoried. We know what it may be used for, because consent, contracts, regulation and jurisdiction define it. We know what the organization has decided for itself, because its policies record it. We know what the risk is, because the business has already weighed it. And we know who, or what, is asking, from the request itself. None of this is new. It is the organization's own judgment, sitting in separate systems owned by separate teams, and the decision is what happens when that judgment is brought into one place at the moment of use.

For decades the industry governed the wrong thing. It governed data, and who could reach it, classified, tagged, mapped, permissioned, and called that governance. But none of that was ever the same as governing how the data gets used. A person with access to a dataset can use it for a purpose that is allowed or one that is forbidden, in a country where it is lawful or one where it is not, for a customer who consented or one who withdrew consent an hour ago. The data is identical in every case. What changes is the use, and a use cannot be labeled in advance, because it does not exist until it happens.

That is why the old machinery could never do the job, and it has nothing to do with the machinery being crude. Catalogs, maps and registers were built to describe data as it sits, what it is and where it lives. Governing a use means acting on data as it moves, and that is a different task these tools were never built for. The gap was always there; human review hid it, one request at a time, because at human speed there was usually a person to supply the judgement the tools could not.

Take that person out of an enterprise running at machine speed, and nothing is watching what the machines do. The decision has to be made at the moment of use, because the use exists nowhere else. A decision made a day early is governing a hypothetical; a decision made a day late is governing a breach. Only the decision made in the moment governs what is actually happening.

Which is the whole point, in one sentence:

We make the decision that determines whether a particular use of data is permitted, by applying judgment the organization has already formed, at the moment the data is used.

The other input to that decision is the use itself. A written rule cannot be applied until you know what is actually happening: what data is being used, for what purpose, by whom, and under what conditions. Working that out, continuously, without handing the organization's authority to a machine, is the hard part, and it is the subject of the next chapter.

The people who feel this most acutely are the ones accountable for governing data and still equipped to do it the old way. The privacy leader is asked to approve a use they cannot fully see, against rules scattered across the business, and will be held responsible for the answer either way. The governance lead watches the business quietly route around a policy they wrote with care. The data leader is told to move faster and be safer in the same breath. These experts are not short of judgment or short of care. They are working with tools built for a slower, smaller world, tools that were real diligence when data moved at the speed of meetings and cannot keep pace with the way data moves now. They can feel the old model of assessment and review buckling, and nothing better has been put in front of them.

The rules an organization has spent years building stop living in documents and start running on their own, on every use of data, at the moment it happens, in all the places a person could never be. The company stops choosing between moving fast and staying safe, because that was never a real choice, only a sign that its judgment couldn't keep up with its business. A company that runs this way can let its machines use data as fast as they can ask, and still know, every time, that the use is one it is allowed to make. That is what Runtime Governance is: judgment the organization already holds, applied at the speed its machines now move.

A decision is only as good as the judgment in it. Making an organization's judgment run on its own, at machine speed, without making it reckless, is the hard problem, and it is what the rest of this book is about.

Chapter 3.

Executable Judgment

If governance is one decision made at the moment data is used, the hard question is who makes it. Handing a decision like this to a machine that is right most of the time sounds reckless, and it should, these decisions carry real weight. Whether a person's medical history can train a model. Whether a customer who withdrew consent can still be marketed to. Whether data that isn't allowed to leave the country is about to. Most of the time is not good enough when being wrong means a regulator, a lawsuit, or someone harmed.

But there is a mistake buried in that worry, and it is worth pulling out, because everything depends on it. We treat "decide what is allowed" and "work out what is happening" as the same act. They are not. They are two separate jobs, and for as long as governance has existed one person did both, so it looked like one.

Watch a privacy reviewer and you can see the two jobs come apart. A request comes in to use data in some new way. The reviewer doesn't start by knowing whether it's allowed. They start by figuring out what's actually going on, what this data is, whose it is, what the business wants to do with it, where it will end up, whether the customer ever agreed to this. Only once they have that picture do they reach for the appropriate rule and apply it. First they work out what's happening, only then they decide what's allowed. It looks like a single judgment because one person does both and hands you one answer.

The first job was never certain, and never could be. The reviewer didn't see the purpose of the use; they worked it out from a form, a conversation, and what they knew of the business. What they ended up with was their best read of the situation, and a read is not a certainty. This isn't a knock on reviewers. Working out what's happening when you can't see everything is the hardest part of the job, and it takes real expertise. But it is a read, and reads can be wrong.

So where did the weight of the decision come from, if not from being certain? From the other part of the job. The organization had already decided what it would allow once the situation was understood, and that decision was theirs, made in advance, backed by their policies and their view of what's right. The reviewer worked out what was happening. The organization had already settled what was allowed. The certainty people remember was never certainty about what was going on. It was the authority of a rule the organization set, applied to a situation that was always a judgment call underneath.

Working out what's happening is a question about the world, and you can never be fully sure, because you can't see everything. What's allowed is not a question about the world at all – the organization decided it. One you have to figure out, the other is set. The reviewer was doing both at once, and only the first was ever a guess. This is why governance has always needed inference in the first place. You can't govern a rule in the abstract. You govern a real situation, and someone has to work out what the situation is before any rule can be applied to it.

The uncertainty everyone is nervous about with AI was already there. Governance has always run on someone's best read of what's happening, often a careful one, built from research, precedent, and experience. But however much work goes into it, it ends in a judgment call, and that judgment lived in an expert's head, formed once, for one case, and rarely visible to anyone else. The confidence of the rule it was applied against made the judgment underneath easy to overlook. AI doesn't add uncertainty to governance. It takes over that read the reviewer was already making, with far more context to inform it, and does it on every use of data, continuously, at a speed and scale no person could reach, and in a form that can actually be examined.

That is all inference does here – it works out what's happening, what the data is, whose it is, what it's being used for, where it's going. It does that with more or less confidence, same as the reviewer, because reading a situation is never certain. Then it stops and does not decide what's allowed. What it works out becomes the facts the decision runs on, and the decision itself stays with the organization, exactly where it always was, decided in advance and applied to whatever the facts turn out to be. The machine works out what's happening, the organization decides what's allowed – Runtime Governance puts the two together. That line is the one thing that can never blur, because it's the line between reading a situation and ruling on it.

Here's what makes it safer rather than reckless; the system runs one of two ways, and the organization chooses which. In observation mode it doesn't enforce anything. It watches how data is being used and tells you when a use breaks one of your rules. A wrong read can't block or permit anything here, because it isn't enforcing anything. It's giving you eyes on something you have never been able to see, every use of data across the business, which no human process could ever cover. In enforcement mode it actually applies the rule and can stop a use. And a company only turns that on where it already trusts the decision enough to let it act. If the read isn't confident enough by the organization's own standard, the use doesn't get a quiet yes. It stops, or it goes to a person. The organization decides how sure is sure enough, and a hospital, a bank, and a government will each decide that differently. Where confidence falls below the organization's own standard, uncertainty lands on caution rather than permission, because that's how the organization set it up.

None of this takes the human out, instead it puts them where only a human will do. Someone has to write the rules, to decide what the company actually allows and under what conditions, and that has never been something a machine could do. And someone has to handle the genuine judgment calls, the cases the organization has deliberately kept for a person because they're too uncertain or too important to settle automatically.

So a machine does not now make these decisions and we're not trying to build one that does. Everything that makes governance governance, the authority to decide what's allowed, stays exactly where it always was, with the organization and its people. What the machine takes over is the part that was never really judgment at all, the endless, uncertain work of keeping up with what's happening, which people were doing all along and can never do at the speed and scale their own systems now demand. Judgment didn't become executable by turning into a machine. It stayed with the people who always held it, and now reaches every use of data, everywhere, at machine speed.

That is what lets an organization finally govern its own machines. What it becomes once it can is the subject of the last chapter.

Chapter 4.

The Organization That Does What It Decided

Five years ago a company decided that customer support transcripts would never be used for marketing. It was a real decision, made for good reasons, written down, agreed to by the people who cared about it.

Today those transcripts are training a marketing assistant. Not because anyone reversed the decision. There were two acquisitions in between, and a data platform migration, and a new team that inherited a database table with a name that gave nothing away. Somewhere in there the transcripts became just another source, and a model used them, and no one was in the room who remembered the promise. Nobody chose to break it. Nobody noticed it was being broken.

This is the thing that happens to every organization as it grows, and it is worth being clear about what is actually happening here, because it is almost always misdiagnosed. It looks like a discipline, culture, or people problem, and companies spend enormous effort treating it as one, with more processes, more training, more sign-offs, and more committees. But the decision was never the problem – the company knew exactly what it wanted. What it lacked was any way to make that decision reach every place the data actually got used. Organizations do not drift because they stop having principles. They drift because the decision made in the room never reaches the place the work actually happens.

We treat deciding something and doing it as if they were the same act, but they're two completely different things. A decision is made once, in a room, by a few people. The data use it’s supposed to govern happens millions of times, across systems and teams and machines, most of them far from that room and long after everyone in it has moved on. For all of history the bridge between a decision and the use of data it was supposed to govern was a person who remembered the decision, or knew where it was written down, and happened to be there when it mattered. No company ever had enough of those people, in enough places, fast enough, to make its behavior follow its decisions everywhere. The gap wasn't a failure of will, it was a mechanical failure of reach.

That is the gap that closes with runtime governance. Not because organizations suddenly have better judgment, they always had the judgment, but because the judgment can now reach every use of data at the moment it happens, without a person needing to be there when it happens. The decision about the transcripts stops being a promise someone has to remember and starts being a decision every system applies on its own, on every use of data, including the ones acquired last week and the models spun up this morning.

A company decides health data never leaves the country. Before, that was true most of the time, and the exceptions were the ones nobody saw. Now it is true every time, including at 2am when a new pipeline in a business unit that didn't exist last year goes to use it. A company decides this data is for serving customers and not for marketing to them. Before, that held as long as someone was there to enforce it. Now marketing simply cannot use it. No meeting, no reviewer, no hoping someone remembered the rule existed.

None of these are new powers. They are old decisions the company can finally uphold.

For as long as organizations have existed, they have faced a trade nobody could get out of. You could grow fast, and lose your grip on what you were becoming. Or you could keep your grip, and move slowly enough that a person could stay in the loop. Every company that scaled paid this price. The bigger and faster it got, the less it resembled the thing it had set out to be, and everyone treated this as a law of nature, the cost of success, the reason big companies lose themselves. It was only what happened when behavior couldn't keep pace with judgment, and once it can, the trade is gone. A company can grow, automate, and hand more and more of its work to machines, and still act like the company it decided to be, because the deciding and the doing no longer come apart under speed.

And this gets stronger as the company grows, which is the opposite of how governance has always worked. Every new part of the organization arrives already behaving the way the company decided, instead of becoming one more place the drift can start. The system bought last quarter, the model spun up this morning, the use nobody has thought of yet. Growth used to fragment a company, every new team and system another place the company could drift from what it decided. Now every new part runs on the same judgment as the rest, and the bigger the company gets, the more consistent it becomes. The very things that used to make governance harder are the things it was built for.

An organization can decide what it will and won't do, and then actually do it, at any size, at any speed, no matter how much of its work runs on machines that never sat in the room where the decision was made.

The company decides, and the company acts on it, everywhere, even when or where no person could ever be.