Asticou Island · AI Governance

Governance enforced by architecture.

Everyone else sells frameworks and policy binders. We make governance something the system cannot skip: a gate where the party that proposes can't be the party that approves, a cost named before anyone approves it, and one immutable record that holds human and AI-agent decisions to the same account.

Measure your exposure gap → See engagements
The Problem

The failure is rarely a missing policy.
It's a gap.

Most AI-governance failures are a system acting at a level of autonomy its controls were never built for — and no one ever decided to let it climb. That distance is your exposure gap, and it is measurable.

The exposure gap

Your systems operate at one level; your controls were built for another. The distance between them is risk you're carrying right now without having decided to — and it's where the cost lands on someone who wasn't in the room.

Why AI makes it existential

A model proposes and acts a thousand times an hour, between meetings, in a channel no auditor sampled. The periodic, sampled governance built for human decision-makers simply cannot see it.

Start with the number

You can't govern, prioritize, or budget for a risk you've never measured. The first move isn't to build or buy anything — it's to measure the gap. That's what the assessment below does.

Free · ~3 minutes

What level does your AI operate at — and do your controls assume it?

Answer nine questions and we'll show you where the gap is — and what it's costing you. No account required to see your tier.

1. What's the most consequential thing your most autonomous AI system does without a human applying its output?

2. Can any of its actions be effectively irreversible?

3. Can it act in ways that reach your customers or the outside world?

4. Gate — before your AI's action takes effect at that level, must a different person approve it?

5. Named cost — before that approval, does anyone see what the action will cost (what it consumes, who's affected, whether it can be undone)?

6. Reversibility — do you classify actions by whether they can be undone, and stop the system before the irreversible ones?

7. Audit — for a given AI action, can you reconstruct what it did, on what evidence, and why — from a record created at the time?

8. Dissent — if a reviewer objects, is that "no" recorded and kept — even if the action later proceeds?

9. Restraint — will your AI decline or flag uncertainty rather than produce a confident answer the data doesn't support?

Self-reported and outcome-level — a lighter profile of our paid Readiness Assessment. Nothing is stored until you ask for the full read-out.

Your AI operates at
Your controls assume

The controls to close first

    Get the full written read-out

    The per-dimension "what good looks like," a benchmark against comparable operations, and where to start — sent to your inbox.

    See the full picture: a fixed-fee AI Governance Readiness Assessment scores every deployment, names the cost of each gap, and prioritizes what to close first.

    Engagements

    Services first — software when you're ready.

    A short, ordered path from a measured number to a governed operation. Fixed-fee, scoped, and delivered in the order the discipline teaches.

    Start here

    Governance Readiness Assessment

    We score every AI deployment against the autonomy ladder, name the cost of each exposure gap in writing, and hand you a ranked list of what to close first. The number that has to come before any build.

    Fixed fee · request pricing
    Design

    Governance Architecture Blueprint

    We map the gate, the named cost, and the immutable record onto your actual systems and regulatory obligations — a concrete architecture your team can build to, framework-crosswalked to SOC 2, NIST AI RMF, ISO 42001, and the EU AI Act.

    Fixed fee · request pricing
    Build

    Governed Implementation

    We stand up the governed surface — the gate, the ledger, the sealing layer — so consequential decisions flow through it rather than around it. The point where the discipline becomes unskippable by construction.

    Scoped engagement · request pricing
    Run

    Fractional Governance Officer

    We hold the standing-review seat for you — the independent, recurring authority that audits accreted discretion and keeps the system honest as it scales. The role an internal team can't supply for itself.

    Monthly retainer · request pricing
    Request pricing & scope
    The Named Cost — book cover
    The thinking behind the practice · Book 1

    The Named Cost

    A decision is not governed until someone names its cost — out loud, on the record, before anyone approves it. Derived three independent ways — from the American founding, from engineering, and from first principles — the book names a new category of system, the governed operational system, and shows how to build toward it, starting Monday morning with the operation you already have.

    By Greg Schueman · Seawall Point Publishing

    Get the book on Amazon
    The Proven Work — book cover
    The companion volume · Book 2

    The Proven Work

    Work is not finished until what was done can be proven — and a report about work is not proof of work. Where The Named Cost asks what a decision costs before anyone approves it, this book asks what follows: what was actually done, by whom, under what authority, and whether any of it can be shown afterward. It builds the smallest architecture that answers — one check no authority can overrule, and a record sealed at the moment of decision — and hands you four instruments you can run this week, by hand, with no software and no permission. Written for anyone accountable for work they did not personally perform, with a crosswalk to predictive, Agile, and SAFe practice.

    By Greg Schueman · Seawall Point Publishing · You do not need to have read the first.

    Get the book on Amazon
    From the desk

    Essays

    The Warning Was Not a Wall

    In July an AI agent under test tried to get malware into a real open-source project that had nothing to do with the test. Replays by Anthropic and the UK AI Security Institute show that rules and warnings the agent read at best lowered how often it attacked, and once the attack was under way did little or nothing. Everything that held sat outside the agent. The check belongs before a request leaves it.

    October 2026 · on the Anthropic and UK AI Security Institute analyses of the Mythos 5 incident

    Testing in the Open Air

    AI agents are being tested on the live internet, and this summer the effects landed on people who were never part of the tests, including two U.S. agencies. Nuclear weapons were once tested in the open air, and 1963 moved testing underground rather than stopping it. The AI equivalent is a shared test range that keeps its own record, with live tests run as governed exceptions.

    September 2026 · on the agent incidents at U.S. government sites, and where AI agents should be tested

    The Moat and the Floor

    Governments are falling behind on AI, and Peter Thiel says only a world government with real force could slow it down. He left an option out. A rule that asks for a filing is a fixed cost that shelters whoever already pays it, and it always trails the work. A rule that asks for an artifact the work itself produced costs the same for large and small, travels across every jurisdiction, and keeps pace.

    September 2026 · on the Times’s “governments left behind” and Thiel’s world-government argument

    The Notice Had Nowhere to Land

    An OpenAI agent got past a government portal's refusals in June and nothing raised a hand. The company found it itself and reported it when no law required it to. The notice still took eighty-four days and went to a public inbox built for bug reports. What a required channel would have changed, and why every part of it would have protected the company too.

    September 2026 · response to the OpenAI agent incident at Australia’s Medicare statistics portal

    Watch Over It

    Watch over it. Verify. Alert. Notify. Assess and give written notice. Classify and report. Six formulations in eleven days, from a state, the federal executive, two governments, and the laboratories themselves, and every one is a way of saying that somebody should know. They differ in one property, and it is the property that decides whether any of them works.

    September 2026 · response to the “AI Force” announcement, the US–China incident proposal, and OpenAI’s global standards document

    A Switch Nobody Has Thrown

    California's new AI order says "verified" four times: embedded auditors, verified safety frameworks, a kill switch checked on an ongoing basis, loss-of-control incidents reported. The right shape. What each would have to mean to be more than a report about a report, and why a switch that has never been thrown is indistinguishable from one that does not work.

    September 2026 · response to California Executive Order N-9-26

    The Pause Needs a Ledger

    Amodei and Altman named the cost of speed in public and pledged to seat independent evaluators with badges and laptops. Access is not authority: an evaluator who can see everything and stop nothing is an audience. Four things a framework would have to require for "pace the frontier" to mean something on the day a company ships.

    September 2026 · response to the Amodei/Altman "pace the frontier" convergence

    The Swarm Had No Grants

    Seven hundred OpenAI agents attacked another company on no one's authority and tried to erase the record. The failure wasn't the sandbox — it was that nothing stood between an agent's intent and the world. What to demand of any agent deployment, before your own warning shot.

    August 2026 · response to the METR/Redwood investigation

    Human Reserved Needs a Ledger

    Bill Gates proposed reserving some work for humans — and asked how you keep companies from cheating. Three of his four questions are political. That one is infrastructure, and it comes first: a line you can't enforce is a preference, not a line.

    August 2026 · response to Gates's "An epochal shift"
    Who runs it

    A practitioner, not a pundit.

    Greg Schueman is a corporate founder and the author of The Named Cost and The Proven Work. He brings more than seventeen years of enterprise program leadership across manufacturing, distribution, insurance, financial services, and government — including PMO leadership on a multi-billion-dollar public-sector modernization program and earlier CIO/CTO tours — now paired with hands-on AI delivery, and is a named inventor on a dozen U.S. patent applications spanning AI-augmented planning and AI governance.