AI Should Follow the Same Rules as People

Here is a simple rule I use when I think about AI in a big company. If a person would need sign-off to do something, the AI needs sign-off too. If a person's action gets logged, the AI's action gets logged too. No shortcuts just because the work was done by a model.

It sounds obvious. But it's easy to forget once a demo looks good.

Why the rule matters

In most large companies, change is tightly controlled. That's very true in the SAP world, where I've spent most of my career. A change to a live system goes through steps. Someone builds it. Someone else checks it. Someone with the right authority approves it. Every step is recorded, so an auditor can see who did what and when.

Those steps exist for good reasons. They catch mistakes. They stop one person from pushing a risky change on their own. They give the business a clear record when something goes wrong.

Now add an AI that can write code, suggest a fix or move a change along. If it can skip the checks that bind people, you have opened a gap. It doesn't matter how smart the model is. A gap in your controls is still a gap.

What this looks like in practice

When I plan an AI feature, I ask a few plain questions.

1. Who would normally approve this? If the answer is "a team lead" or "the change board", the AI's output goes to that same person or group. The AI can prepare the work. It doesn't get to approve it.
2. What gets recorded? The audit trail should show that the AI took part. It should note what it suggested, what a person changed and who said yes. Hiding the AI's role makes the record less useful, not more.
3. What can it touch? An AI helper should only have the access it needs for the task. Not more than the person using it, and often less.
4. How do we undo it? If a person can roll back a change, the same path should work for anything the AI produced.

None of this is new thinking. It's the same control model companies already trust. The only change is that one more kind of worker now follows it.

It also decides what ships first

This rule shapes the roadmap, not just the design. Features that fit inside the current approval flow are easier to ship. They are easier for customers to trust, and easier for their auditors to accept.

So the early wins tend to be helpers. Drafting, checking, summing up, flagging risks. The AI does the slow parts and a person makes the call. Features that would act on their own come later, once there is a track record and the controls are proven.

That can feel slow next to the hype. But in my experience, trust is what gets AI from a demo to daily use. A tool that people don't trust doesn't get used, no matter how clever it is.

The bottom line

Treat AI like a new team member. Give it clear limits. Make its work visible. Have a person sign off on anything that matters. Keep the record clean.

If you do that, the conversation with risk, audit and compliance teams gets much easier. You aren't asking them to accept a new set of rules. You're showing them the old rules still hold.