Ed Randall

Interactive CV
Posts
Lab Notes
About
Recommendations
Speaking
Contact
Search

Would Your Governance Framework Tell You?

AI coding assistants produce working code fast. The harder question is whether your governance framework would tell you if something had gone wrong. This short self-assessment covers the eight dimensions where I most often see gaps in conversations with engineering leaders.

Eight questions for engineering and technology leaders using AI-assisted development. Answer honestly: this runs entirely in your browser and nothing you select is recorded or sent anywhere.

1 · Layer awarenessFor the systems AI is helping to build, do you know which layers your team can independently verify? Yes. We have mapped where we have genuine review depth and where we are taking output on trust. Informally. Individual engineers know their own limits, but it is not written down anywhere. Not really. If the code looks professional and works, it goes in.

2 · Compensating controlsWhere you cannot fully verify AI output, what bounds the risk? Deliberate controls: network boundaries, access restrictions, monitoring, and graceful failure modes chosen with the unverified layers in mind. Our standard platform controls, though we have not revisited them for AI-assisted work. Nothing specific. The code passed testing, so it shipped.

3 · SpecificationIs there a stable specification to build and review against? Yes, developed before the code, and it is what reviews are anchored to. Partially. There are tickets and design notes, but the prompts carry most of the intent. No. We describe what we want, refine what comes back, and the application grows from there.

4 · Living documentationDoes that reference stay current as the work evolves? Yes. Keeping it updated is part of the workflow, and a new team member could pick it up and know what is built and what is outstanding. It exists but drifts. Nobody owns keeping it accurate. The chat history is the documentation.

5 · Model self-assessmentWhen the model says the code is well-structured and secure, how is that treated? As noise. Assurance comes from independent review or automated verification against a specification. As a useful signal that we sometimes double-check. As assurance. If the model is happy and the tests pass, we are happy.

6 · Review gatesWho reviews AI-generated code that is public-facing, customer-facing, or handles sensitive data? An experienced engineer with relevant expertise, against a defined standard, every time. It gets a normal pull request review, though reviewers cannot always keep pace with the volume. Often the person who prompted it, sometimes assisted by the model itself.

7 · AccountabilitySomething AI-built breaks in production. Does the question "who approved this?" have a real answer? Yes. There is a clear accountability chain and a review record, not just a prompt history. Sort of. We would piece it together from commits and chat logs. Genuinely unclear. The AI produced it, someone accepted it, nobody exactly approved it.

8 · DetectionIf something had already gone wrong, would your governance framework tell you? Yes. Monitoring, testing against the specification, and review gates would surface it. Probably eventually, through an incident rather than a control. Honestly, no. We would find out from users.

0 of 8 answered

The questions come from Beyond Vibe Coding: Building AI-Assisted Development You Can Trust. If these gaps look familiar and you are working through what to do about them, get in touch.

© 2026 Ed Randall · Login