---
name: scale-governance
description: Writes an AI governance policy for the revenue org covering roles, operating model, risk and compliance, rules of use, security, model choice, bias, tooling, monitoring, transparency, and accountability, sized to the company's stage. Use when the user says "AI policy", "governance", "what are the rules", "security for AI", "compliance", "risk register", or after scale-coe-charter.
---

# scale-governance

Produce `artifacts/scale-governance.md` and set `context/governance.md` to verified. Clear boundaries beat both micromanagement and "go have fun."

## Preflight (every run)
1. Confirm `GTM-AI-OS/` is accessible. If not: "I need access to your GTM-AI-OS folder. Select it in Cowork's folder picker, or run `os-install` from the core plugin." Stop until it is.
2. Read `CLAUDE.md`, `INDEX.md`, and the last 20 lines of `signals/log.md`.
3. Check the prerequisites below. For anything missing, ask the cold-start questions and offer: (a) run the earlier skill now, or (b) fast path: answer the questions and this skill writes a minimal version of the missing artifact marked `status: draft (fast path)`.
4. On finish, update the artifact row in `INDEX.md` and append one line to `signals/log.md`: `<date> | <skill> | <produced> | <human changed> | <open question>`.

## Prerequisites
- `context/governance.md` at draft (from scale-guardrails) and `artifacts/scale-coe.md`.
Cold-start: "Which of these apply: regulated industry, customer PII in your systems, existing security certifications (SOC 2, ISO), a legal team?" Continue.

## Step 1: Inherit
If `~~docs` has an existing IT or security policy, read it and extend rather than duplicate.

## Step 2: The thirteen areas, sized
Write a section for each, one paragraph for small orgs and a full policy for regulated ones: roles and responsibilities; operating model; risk and compliance; rules of use (what's allowed, what's not, what needs approval); security (data boundaries, tooling between users and models if needed); model management (which models, why, how updated); bias (demographic and informational); tools and monitoring; transparency (how an answer was produced must be inspectable); accountability; trustworthiness; responsibility; incident response.

## Step 3: Risk register
Start it with the reversal triggers from `context/reversal-triggers.md` and the guardrails from Module 3. Add a row per deployed tool: risk, likelihood, impact, control, owner, review date.

## Step 4: Quality gates
Define what gets reviewed before any AI output reaches a customer, a forecast, or a system of record.

## Step 5: Write
Write the policy and the register. Update `context/governance.md` and `INDEX.md`.

## Hand off
Say: "The OS is installed and governed. Now make it learn. Run `os-weekly-review` every week."