The method
AI On It.
Governance first.
Most AI problems are not technology problems. They are permission problems: nobody decided what the AI may do. This is how we decide.
Overview
Sort every task by consequence
Read, draft, change, send or delete. The higher the consequence, the tighter the control. Reading and drafting can run freely. Anything that changes something or leaves the building needs a person's approval.
Write the rules in plain language
The rules are written so an owner can read them, and built into the software so the AI cannot step outside them by mistake. If it is not allowed, it cannot be done.
Start with one small job
One role, a few skills, a clear boundary. Sensitive work stays on your own computer. Every action is logged so you can read what happened.
Show the work before it goes out
Drafts, summaries and plans are shown first. You say yes, and only then does anything move. A bare “yes” approves exactly what you were just shown.
Promote trust, never assume it
When one action has proven safe, you can choose to let it run without asking. It is your decision, one action at a time, and you can take it back.
The permission model
Four levels. Always the same.
Read
Looks things up and gathers information.
Runs on its ownDraft
Writes emails, reports and plans for you to review.
Runs on its ownChange
Updates files, calendars, tasks and records.
Needs approvalSend or delete
Anything outside the building, or anything that cannot be undone.
Always approvalStraight answers
Questions owners ask me.
What is AI governance for a small business?
It is deciding, in writing, what AI may read, draft, change and send in your business, who approves it, and what it must never touch. It is a short policy plus rules built into the tools, not a bureaucracy.
Do I need an IT department to use AI safely?
No. The AI On It method is built for owners and small teams. We start with one small job, keep sensitive work on your own computer, and you approve anything that leaves.
What can an AI digital worker actually do?
Read and research on its own, draft emails and reports for your review, and keep track of tasks. It asks before it changes anything and never sends without your approval.
Is my business data safe with AI?
It depends on the rules. We decide what data each tool may see, keep sensitive work local where it counts, and keep a record of every action so you can check it.
How is this different from just using ChatGPT?
A chat window has no rules about what it may touch and no record of what it did. A governed digital worker has written limits, an approval step and an audit trail.
What is the NSBA doing on AI legislation?
I work with the NSBA on AI and SI legislation and governance on Capitol Hill, so rules are proportionate and workable for small firms.
Start here
One short call.
You leave knowing what to govern first.
Twenty minutes. Tell me what you want AI to do and we decide what it is allowed to do. No pitch theater, and you can stop at any point.
Book a 20-minute call → Or send an email →