How wide is your AI governance gap?
5 questions on how your AI decisions are approved, recorded and checked. You get a result out of 100, what it means, and 3 checks to run this week.
- About 1 minute
- No sign-up
- Answers stay in your browser
Question 1 of 5. Roughly how many decisions a day do your AI systems make or act on?
Count approvals, refunds, access changes, record updates and replies sent, whether an agent acts alone or a person accepts its suggestion.
Question 2 of 5. What share of those decisions leave a record of who or what approved them?
A record the AI did not write itself: a ticket, a sign-off, a system log of the approval.
Question 3 of 5. How do you hold each AI system to the level of human oversight it was approved for?
For example: it acts alone, it asks a person first, or it only recommends.
Question 4 of 5. If an auditor asked for the evidence behind 1 specific AI decision, how fast could you produce it?
The record itself, not a summary written afterwards.
Question 5 of 5. How often does anyone check that your AI systems still act within what was approved?
Approvals age: models, prompts, tools and permissions change after sign-off.
Pick 1 answer
Your result
Critical gap
A result in this band usually means most AI decisions leave no record of who approved them, and nothing checks what the AI does once it runs. If someone asks who let an agent act, the only account may be the agent's own.
Significant gap
A result in this band usually means some AI systems are covered and many are not. Some decisions trace back to an approval. For the rest, a question about 1 specific decision would take days of reconstruction, and the answer would rest partly on what the AI reported about itself.
Moderate gap
A result in this band usually means most AI systems have a set oversight level and a record behind most decisions. The gap sits in the rest: the systems and decisions nobody has looked at lately. Test those first.
Minimal gap
A result in this band usually means set oversight levels, records behind most decisions, fast retrieval and regular checks. The question now is whether those records would hold up if someone doubted them: who wrote each record, and could the AI have changed it?
This is a self-check. It is not an audit, a rating or a certification. It adds up your own answers, and nothing was checked against your systems. The 3 checks turn your weakest answers into evidence.
3 checks to run this week
Count the decisions, do not estimate them
Ask the owner of your busiest AI workflow for last week's number of actions the AI took, counted by the system it acted on, not by the AI's own log. If getting the number takes more than a day, write that down. It is a finding.
Tests your answer to question 1
Trace 5 decisions back to an approval
Pick 5 AI decisions from last week at random. For each, find who or what approved it, in a record the AI did not write. Count how many you can show. That number out of 5 replaces your estimate.
Tests your answer to question 2
Write down each system's oversight level
List the AI systems that can move money, change access or change records. Next to each, write the oversight it was approved for (acts alone, asks a person first, or only recommends) and who signed off. Each blank cell is a gap with an owner to find.
Tests your answer to question 3
Time a real evidence request
Pick 1 decision an AI system made last month that mattered. Ask your team for the record of who approved it, and start a timer. Stop it when you hold the record itself, not a summary of it. That time is your real answer to question 4.
Tests your answer to question 4
Compare what was approved with what it did
Pick 1 AI system. Put what it was approved to do next to what it did last week. Then ask: if it had stepped outside that, who would have noticed, and how? If the answer is the AI's own report, you are relying on its word.
Tests your answer to question 5
| Area | Your answer | Points |
|---|---|---|
| Q1 Volume | ||
| Q2 Approval record | ||
| Q3 Oversight level | ||
| Q4 Retrieval | ||
| Q5 Drift checks |
Where TrustGate fits
Most of the checks above ask the same thing: is there a record of what was cleared, written by something other than the AI? TrustGate returns a signed allow, deny or escalate decision before the action runs, for actions that go through it. The receipt binds the agent, action, target and exact arguments that were evaluated. An outcome we cannot confirm is reported as unknown, never as success. TrustGate reports 'could not check' separately from 'checked and found nothing'.
It does not certify compliance or give a legal or audit opinion.
How the result works
Each answer is worth 0, 5, 10, 15 or 20 points, and the 5 answers add up to a result out of 100. On questions 2 to 5, the first answer listed is worth 0 and the last is worth 20.
Question 1 runs the other way. Fewer decisions a day earn more points, because fewer decisions ride on each gap.
- 0 to 20Critical gap
- 21 to 50Significant gap
- 51 to 75Moderate gap
- 76 to 100Minimal gap
What it is not
It is not an audit, a rating or a certification. It adds up your own answers. Nothing is checked against your systems, and nothing you answer is sent to us.
For a closer look at 1 workflow, the free review kit gives you 10 questions and 2 prompts, with no sign-up. Other questions this site answers are on All answers.