Governance needs a work surface.

A policy document cannot carry the workflow

A team can write a thoughtful AI policy and still leave its most important decisions to improvisation. A product manager defines an intended use. A domain expert notices a condition the model cannot see. An operator needs to finish the work. A reviewer has to decide whether an exception is justified. If those responsibilities meet only in email, meetings or memory, the policy is present but the operating system for governance is missing.

The practical design question is not only what the rule says. It is where each person encounters the rule, what evidence is visible at that moment, which decisions they can make, and what record moves forward with the work. Governance needs a work surface: a place where authority, evidence, action and review become part of the same workflow.

Three jobs deserve three views

I would begin with three views. The creator view defines the task, intended users, data boundaries, success measures and conditions that require review. The steward view monitors evidence, handles exceptions, tests controls and decides when work should pause, change or escalate. The worker view presents the authorized task, relevant context, current limits and a clear route to ask for help.

These are responsibilities, not necessarily three full-time job titles. In a small team, one person may hold more than one role. The separation still matters because it makes decision rights visible. The person doing the work should not have to reverse-engineer the creator's assumptions. The creator should not silently approve every operational exception. The steward should be able to inspect the handoff without becoming the author of every task.

The handoff is part of the product

The NIST AI Risk Management Framework treats governance as a cross-cutting function and calls for documented roles, responsibilities and lines of communication. Its actor-task appendix also distinguishes design, development, deployment, operation and monitoring, evaluation, domain expertise, and governance and oversight. That is not a prescription for this three-view interface. It is the source-grounded reason to resist collapsing every responsibility into a generic user dashboard.

A governed handoff should carry the task's purpose, the policy version applied, the evidence considered, unresolved questions, the decision made, and the person or role responsible for the next step. NIST's human-AI interaction appendix similarly emphasizes that human roles in decision-making and oversight should be clearly defined and differentiated. The current NIST page notes that AI RMF 1.0 is being updated; this product pattern is therefore my design synthesis, not a claim that NIST has certified it.

Test whether the surface changes the work

I would evaluate the pattern with synthetic or consented workflows. One group would use a shared policy document and a general-purpose AI interface. A second would use the same policy and model through separate creator, steward and worker views. A third would add explicit handoff receipts and an independent review queue for ambiguous cases.

Measure legitimate task completion, unresolved assumptions at handoff, unauthorized actions, appropriate escalation, exception latency, correction acceptance, reviewer agreement and time spent reconstructing context. Hold the model, tools, evidence and task set constant. Include role changes, stale policies, conflicting instructions and urgent but legitimate exceptions.

This is a proposed evaluation, not a report of measured results. The founder lesson is narrower: governance becomes usable when it appears where work is created, supervised and performed. A policy can define responsibility. A work surface can make that responsibility observable.