At Nrth (formerly Elevate) in Toronto, Shahir Daya of Zafin spoke about AI governance: governing the agent versus governing the work. One idea has stayed with me since: control is what makes speed possible.
Most small firms assume AI governance is for banks and hospitals. It isn't. It comes down to three questions every firm eventually faces: "Was this authorized? Who authorized it? Can I show my work?"
One useful frame from his session borrows from air traffic control:
- Clearance. What is this tool or agent allowed to do? What access does it need to finish its task, and which tools, skills and knowledge can it use?
- Flight path. From request to result, where are the human gates? Where does a person need to approve before it moves on?
- The record. You can't go to a client or a regulator and blame the agent. You need a record of what it accessed and what it did, ready before anyone asks.
The surprise is that it isn't speed versus control. When you have control, you have speed. Guardrails, policies and clear rules are what let you give a tool more autonomy, because you trust the controls around it. Without them, someone has to watch every task, which is the slowest option of all. A good question as you build: how much autonomy am I comfortable giving this tool, and what would make me comfortable giving it more?
Two more ideas worth borrowing:
- Govern the work, not just the agent. Tools change every few months. The process, the approvals and the outcome are what your client cares about.
- Don't apply the same rules to everything. A tool that summarizes internal notes needs light oversight. An agent that emails clients or touches sensitive records needs much more. One regime for everything slows you down without reducing real risk.
Here's how I'd apply it in a five-person firm that uses AI to draft client updates. Clearance: read access to the matter summary, no access to billing. Flight path: a named person approves before anything sends. Record: a simple log with the date, what the tool produced, what it drew from, and who approved. That log can be a shared document. It doesn't need special software.
That is an operations idea as much as a technology idea. You can't authorize, gate or audit a workflow that lives in people's heads. Foundations first, then autonomy.
Try it with one AI use in your firm:
- Name it. For example, "drafting client updates."
- Write its clearance, flight path and record in three short lines.
- Run it for two weeks, then ask what you'd need to see before giving it more autonomy.
If you can't yet answer "who approved that, and what did it do?", that's the first gap to close. Take the GRIC checkup and send me a message with what you find.
Idea and air traffic control frame shared from Shahir Daya's session at Nrth (formerly Elevate) 2026. The five-person example and exercise are my own. Follow Shahir Daya and Zafin on LinkedIn.
Related: "Culture You Can Score."