What is AI governance as code?

AI governance as code means embedding compliance policies directly into CI/CD pipelines as executable, testable code rather than leaving them in PDF documents. According to Bob Rapp, Principal AI Architect at General Motors, every gate in the pipeline has a yes-or-no answer, a contract, and a test. If the code does not pass the gate, it does not ship. Ken Johnston, founder of the AI GovOps Foundation, adds that governance checks must also run at runtime through observability layers, especially for agentic AI systems where agents interact with other agents.

Why does AI governance accelerate deployment instead of slowing it down?

Ken Johnston explains that automated governance eliminates what he calls 'the maybe gate,' the point where a decision-maker hesitates to sign off because they cannot verify that all compliance requirements have been met. When governance standards are embodied in code and checked automatically at every pipeline stage, teams know the work is done and can ship with confidence. Bob Rapp cites companies like Merck, John Deere, and General Motors as examples where governance done right enables faster AI deployment because teams are 'safe enough to ship.'

What is the AI GovOps Foundation's Beacon project?

Beacon is an open source tool built by the AI GovOps Foundation that listens to all AI models running on a network, maps their activity against regulatory framework files, determines the organization's compliance posture, and creates immutable audit logs for sampling by auditors. Bob Rapp describes it as a baseline set of standards that allows policy teams and engineering teams to share a common understanding of governance gates and rules. The foundation also offers Lantern, a companion project designed to help auditors and non-technical stakeholders navigate the AI governance audit process.

How does General Motors treat AI governance differently from most enterprises?

Bob Rapp, Principal AI Architect at the GM AI Center, explains that General Motors treats governance as a safety system on the same level as LiDAR, radar, and brakes, not as a slide deck or policy document. With increasingly autonomous vehicles generating up to a million transactions in a few seconds, each potentially involving AI, GM requires controls that execute in real time. Rapp contrasts this with enterprises that 'fill out forms' and 'plan their next retreat' but lack governance that compiles and runs in production.

What is the shift left approach to AI governance?

Ken Johnston advocates borrowing the 'shift left' concept from the security practice of moving checks earlier in the development cycle. Applied to AI governance, this means bringing governance checks closer to development rather than waiting for post-deployment review. Johnston draws on his experience at Microsoft, where he helped automate privacy and data governance for GDPR compliance, and at Ford Motor Company, where the lack of automation meant governance was 'locked up in documents and spreadsheets.' He argues that the speed and risk of AI deployment make shift-left governance even more urgent than it was for security.

Why do traditional testing approaches fail for generative AI governance?

Bob Rapp explains that traditional testing starts with shipping code and then looking for anomalies, but generative AI breaks that model because each of a billion transactions is by design slightly different. Without context, there is no baseline to measure against. Rapp's solution through the Beacon project is to listen to all models on the network, map activity against regulation files, determine compliance posture, and then sample a subset (whether 19 or 1,000 transactions) for immutable logging so auditors can evaluate the system's behavior over time.

EPISODE #44

Yogita Parulekar

Yogita Parulekar is the Founder and CEO of InviGrid, where she is helping enterprises secure AI, cloud infrastructure, and autonomous systems through governance-first architecture. A recognized cybersecurity executive with nearly three decades of experience, she has held leadership roles at Oracle, EY, and Suki, building expertise across cloud security, governance, risk management, compliance, and enterprise technology transformation. Today, Yogita is a leading voice on AI governance, secure-by-design engineering, and responsible adoption of agentic AI, helping organizations innovate faster while strengthening resilience, trust, and operational security.

Your AI Agent Is Not the Risk. Its Authority Is.

Episode Summary

Autonomous agents are transforming enterprise operations, but who governs their decisions? Yogita Parulekar explains why AI governance must move beyond models and focus on delegated authority, identity, permissions, and secure-by-design architectures. Learn how leading enterprises are preparing for agentic AI before today's governance practices become tomorrow's weakest link.

Listen to other episodes

Join AI Realized Community

Resources

Linkedin

Full Transcript

Governing AI Agents at Scale: Delegated Authority, Identity, and Blast Radius Host Christina Elwood interviews Yogita Paryulakar, founder and CEO of Invagrid, about shifting enterprise AI governance from models to agents’ delegated authority—the space between model output and real-world action. They discuss how agents inherit the probabilistic nature of LLMs, can interact with other agents and tools, and can create cascading effects, making context and risk tolerance central to governance. Examples include an agent recommending fluids for a dialysis patient and an autonomous agent deleting production and backup databases, underscoring the need for guardrails, blast-radius containment, kill switches, and effective human-in-the-loop oversight with real authority, time, and expertise. The conversation covers identity governance for agents as non-human identities with potentially excessive permissions, secure-by-design architecture across model/agent/data/tools in multi-cloud, a board-focused goals-strategy-risks-oversight framework, and operational needs for hyperautomation and embedded controls to govern agents at machine speed.

00:00 Welcome and Guest Intro

01:47 Why Govern Agents

02:19 What Makes Agents Different

06:03 Context and Risk Tolerance

08:51 Guardrails and Policy Controls

09:56 Human in the Loop Reality

10:56 Accountability and Risk Layers

23:09 Agent Identity Governance

25:53 Designing Blast Radius

29:57 Board Level Governance Model

35:27 Starter Checklist for Production

39:03 Resources and Leadership Takeaways

42:58 Final Message and Wrap Up

Yogita Parulekar

Your AI Agent Is Not the Risk. Its Authority Is.

Episode Summary

Resources

Linkedin

Yogita Parulekar

Invi Grid

Join AI Realized