The usual failure in AI governance isn’t too little control. It’s one-size-fits-all control. When a request to summarize internal meeting notes goes through the same review as an agent that emails customers, automatically, without any one reviewing those emails, there is an issue.
The small request waits for months, or the big one gets waved through because everyone is tired of reviewing. Either way, people learn that the official route is slow, and they stop using it. That is how shadow AI gets made.
The fix is to match scrutiny to risk. we use three lanes.
The three lanes
| Lane | What the tool does | What it takes to approve | Target turnaround |
|---|---|---|---|
| Green | Reads internal, non-sensitive data, and a person reviews anything before it leaves | A named owner and a short checklist run by an admin | 2 business days |
| Amber | Touches customer data or writes to records, with a person approving the action or a tightly limited scope | Named owner, least-privilege permission design, sandbox test, rollback plan, unit-cost estimate | 1 to 2 weeks |
| Red | Acts on its own toward people outside the company, or touches regulated data or decisions about people | Full review: privacy, security, legal, an accountable sponsor, staged rollout, monitoring and a kill switch | Scheduled with the right people, and sometimes “not yet” |
A few examples of where things land:
- Green: drafting internal call summaries from non-sensitive fields.
- Amber: an assistant that proposes a case category and updates the record once the rep confirms it.
- Red: an agent that sends messages to customers unattended, or anything that influences eligibility, pricing or care.
How a request finds its lane
Five questions, answered by the requester rather than negotiated:
- Can it only read, or can it also write or send?
- Whose data does it touch, and how sensitive is that data?
- Does a person see the output before it takes effect?
- Does it act on people outside the company?
- If it’s wrong, how much damage does it do, and how fast can we undo it?
Publish the questions and how they are scored. When the requester can see how a lane is decided, they stop trying to argue their way into a faster one.
Put a price on every amber and red request
Each one carries a unit-cost estimate: what a run costs at pilot volume, and what it costs at production volume. A pilot’s economics can look nothing like production’s, and the time to find that out is before the decision to scale, not after. Tie the spend to a named use case, so that when finance asks what it returned, somebody can answer.
Watch the turnaround time
Measure how long each lane actually takes and publish the number. It’s the one metric that tells you whether your governance is working. If green requests take longer than a week, people will quit asking.
Re-triage when things change
Lanes aren’t permanent. A green tool that gets write access is now amber. Whenever the scope changes, the request goes back through the five questions.
The point
The goal isn’t to slow AI down. It’s to make the yes cheap, the no rare, and the wait short and explained.
Float into the Clouds helps Salesforce teams design approval paths for AI that move at the speed of the business. Get in touch if yours is a queue where good ideas wait.