In short: At around a thousand people, auditors, regulators, security teams and large customers start asking how decisions were made, and "we discussed it" stops being an answer. The enterprise brain's job becomes governance, and the risk becomes a platform that nobody in the business owns.
Key points
- Supervisors treat AI systems that act differently from ones that only generate content, and expect agent actions logged.
- Write a trace specification with compliance for every AI-assisted decision class before the next production deployment.
- Register every agent with an owner, a scope and permissions that follow the user it acts for.
- A platform team that owns the judgment record makes it technically sound and commercially empty.
- Buy the context layer, but own the record of how you decide in an exportable format.
Somewhere in this range, often earlier for regulated firms, the organisation acquires functions whose job is to ask questions about other functions' decisions. Risk. Compliance. Internal audit. Information security. Procurement teams at large customers who send hundred-question security reviews. Each wants to know who decided, on what basis, and who checked.
At the same time, AI use has spread. Agents act on behalf of employees: drafting, routing, approving small things, triggering workflows. Supervisors now treat a system that acts differently from one that only generates content, and expect agent actions and decisions to be tracked and logged.
What has to exist now
A trace specification. For every AI-assisted decision class: inputs, evidence with its standing, model and prompt versions, output, every human action with timing, final action, and outcome. Written with compliance, before the next production deployment.
An evidenced review gate. Review that leaves proof: sources opened, time on item, class of edit, blind second looks on a sample.
Agent identity and permissions. Every agent registered, with an owner, a scope, and permissions that follow the user it acts for. This is the area where the large software vendors are competing hardest, and for most organisations it is a buy, not a build.
Retention and deletion, agreed with counsel. What is kept, for how long, who can see it, and how deletion leaves a tombstone rather than a hole.
Who owns the record
This is the stage where a platform team typically forms around AI. That is useful and also dangerous. A platform team that owns the judgment record will manage it as infrastructure: uptime, schemas, cost. The record will be technically sound and commercially empty.
The better arrangement: each decision record is owned by the function whose decisions it records. Credit owns credit decisions. Sales owns deal decisions. The platform team owns the standards, the trace, the tooling and the export, and serves the functions. Risk and compliance oversee.
Buy the context layer, own the judgment record
At this size, connectors, enterprise search, assistants and agent registries are mature products. Build them only for real differentiation. What you should not rent is the record of how you decide: the decision classes, the falsifiers, the outcomes, the precedents. Own that, in a format you can export, whatever tools sit on top.
In practice
- Write the trace specification with compliance for each AI-assisted decision class.
- Register every agent with an owner, scope and inherited permissions.
- Assign each decision record to its business function; give the platform team standards and tooling.
- Run a reconstruction drill: rebuild a three-month-old decision end to end, and time it.
What would prove this wrong. Thousand-person organisations passing audits, examinations and customer security reviews of AI-assisted decisions without traces or evidenced review.
Common questions
What AI governance does a company need at 1,000 employees?
A trace specification for each AI-assisted decision class, an evidenced review gate, registered agents with owners, scopes and inherited permissions, and retention and deletion rules agreed with counsel.
Who should own AI decision records in a large company?
Each decision record should be owned by the function whose decisions it records, such as credit owning credit decisions. The platform team owns standards, trace, tooling and export, and risk and compliance oversee.
Should enterprises build or buy AI agent identity and permissions?
For most organisations agent identity and permissions are a buy, not a build. Connectors, enterprise search, assistants and agent registries are mature products at this size.
How can a company test whether its AI decisions are auditable?
Run a reconstruction drill: rebuild a three-month-old decision end to end, and time it.