AI Governance

The AI Governance suite is how Novantra lets your organization use AI deliberately rather than accidentally. It is the layer where AI capabilities are registered, authorized, constrained, and audited. Every AI use is bounded by an authorization and produces evidence.

This section is separate from the rest of the governance modules because AI governance is its own concern with its own primitives. Where Controls and Risks govern operational and security posture, AI Governance governs the use of AI itself: what AI systems your organization runs, who can invoke them, what they’re allowed to do, and what trail they leave.

The shape of AI governance in Novantra

Module	What it owns
AI Systems	The registry of AI capabilities your organization has registered: the in-product Copilot, Document Intelligence, any third-party AI assistants.
Control Plane	AI BOMs, evals, incidents, literacy, tool inventory, data-flow ledger entries, portfolio metrics, standards evidence, and trust posture signals.
Knowledge Bases	Named, reusable collections of approved sources, retrieval policy, readiness checks, and Copilot publishing posture.
AI Context	Advanced runtime evidence for context sources, chunks, index runs, embeddings, retrieval policies, vector posture, and OCR posture.
Decision Dossiers	Governed decision briefs, coverage matrices, recommendations, review posture, and policy-to-action candidates before owning workflows publish final truth.
AI Watchers	Watcher definitions, sanitized monitoring signals, and governed conversion posture before owning modules create final findings, risks, incidents, violations, or lifecycle records.
AI Agents	Controlled agent sessions, plans, steps, tool-call refs, human gates, and stop conditions before owning modules apply final state.
AI Assurance Handoff	Sanitized AI projections over approved assurance refs for explanations, draft narratives, and handoff readiness without publishing assurance truth.
OCR Engine Status	Deployment-selected OCR readiness, supported file types, extractor registration, and sanitized OCR provenance for scanned documents.
Target Appliers	Runtime inventory of command-safe application paths that let approved AI suggestions call owning-module commands beyond metadata.
Use Authorizations	Who is authorized to use which AI system for what purpose. Without an authorization, the system cannot be invoked.
AI Providers	The upstream AI providers, internal gateways, local endpoints, and approved models the workspace is allowed to use. Connection lifecycle, model allowlists, credentials, rotation.
Governance Copilot	The in-product Copilot for governance work: drafting, summarizing, analyzing. With profiles that scope what it does.
Document Intelligence	Document understanding (OCR, classification, extraction) for documents in the workspace. With profiles per document type.
Action Policies	What AI is allowed to do: which actions it can suggest, which it can perform autonomously, which require human approval.
Runs & Evidence	The audit trail. Every AI run, every suggestion, every applied change, every reviewer decision is recorded as evidence.

Product areas

Novantra separates the AI workspace into practical areas:

Providers answers which AI engines are allowed.
Governance answers what AI use is allowed.
Document Intelligence extracts fields from documents.
AI Copilot drafts, summarizes, and reasons with approved knowledge.
Knowledge Bases controls which approved source collections Copilot can use.
AI Context shows the advanced retrieval/runtime evidence behind those collections.
Usage & Spend shows how much AI is being used and by whom.

Readiness checks follow the same separation. Governance readiness checks whether the capability is governed. Document Intelligence readiness checks extraction setup. AI Copilot readiness checks drafting setup. Knowledge Base readiness checks whether a named collection can be used by Copilot. AI Context readiness checks whether source indexing, embeddings, vector posture, and retrieval policies are available for knowledge-assisted work.

The customer’s mental model

Three things matter most:

Authorization gates use. An AI system that’s registered but not authorized for a specific person and purpose cannot be invoked by that person for that purpose. Authorizations are explicit and audited.
Actions are governed. Every action the AI is allowed to take is described by an action descriptor and gated by an action policy. The set of actions is finite, known, and reviewable.
Every AI activity leaves evidence. The run, sanitized input/output evidence, suggestions, human decisions, and eventual applied changes are captured as audit-grade records that feed back into the rest of the governance program.

Together, these three properties make AI use demonstrable. Not just “we use AI”; “here is what we use it for, here is who’s authorized, here is what it produced, here is who reviewed it.”

Where AI fits in the rest of governance

AI activity touches the rest of the governance program:

Findings raised by AI surface in Findings.
Risks identified through AI analysis can land in Risks.
Evidence claims generated or supported by AI live in Evidence.
Document Intelligence outputs feed Document Governance.
AI provider connections that go down are surfaced through Monitoring and may create Incidents.
The Control Plane records AI-specific posture, candidates, mappings, and signals without becoming the final source of truth for risks, controls, findings, incidents, violations, exceptions, obligations, evidence, or lifecycle state.

AI Governance doesn’t sit in a corner. It’s the discipline around an interface layer between machines that do work and humans that govern that work.

Cloud and Sovereign

Both deployments support the AI Governance suite. The difference:

Cloud customers can choose Novantra-managed AI provider connections or bring their own.
Sovereign installs run AI provider connections entirely on the customer side. The AI activity itself happens on the provider; what stays in the workspace is the governance evidence.

Either way, the workspace never holds raw provider credentials in plaintext; they live in the install’s key management layer.

Where to start

If your organization is rolling out AI Governance for the first time:

Register your providers and approved models through AI Providers so the workspace can talk to only the endpoints and models your organization allows.
Register the AI systems you intend to run through AI Systems.
Create control-plane evidence through Control Plane for BOMs, evals, data flows, literacy, standards posture, and trust signals.
Create Knowledge Bases through Knowledge Bases before using organization knowledge in Copilot workflows.
Use decision dossiers through Decision Dossiers when AI-supported briefs, coverage matrices, or policy-to-action candidates need review before publication.
Create watcher definitions and review signals through AI Watchers when monitoring signals should become reviewable candidates before owning-module handoff.
Record agent sessions and plans through AI Agents when AI-supported workflows need controlled plan, step, tool-call, stop-condition, and human-gate evidence.
Review assurance handoff projections through AI Assurance Handoff when AI explanations or narratives need approved assurance context.
Review OCR readiness through OCR Engine Status if scanned PDFs or images are part of your AI workflow.
Review target appliers through Target Appliers before allowing AI suggestions to apply beyond metadata.
Define authorizations through Use Authorizations so members can actually invoke them.
Pick your action policies through Action Policies - start restrictive; widen as trust grows.
Configure the Copilot and Document Intelligence profiles through Governance Copilot and Document Intelligence.
Review the audit trail through Runs & Evidence as activity flows.

The defaults are deliberately conservative. New AI systems can’t be used until they’re authorized. New actions can’t fire until they’re policied. New providers can’t serve until they’re validated and activated.