An AI governance framework for the tools teams use every day.

An AI governance framework is the set of roles, rules and controls an organisation uses to make sure its AI is used safely, legally and to good effect. It says who decides, what is allowed, how risks are assessed and how you prove it. Most AI governance frameworks share the same ten parts, set out below. The widely used reference frameworks, such as the NIST AI Risk Management Framework and ISO/IEC 42001, work at the level of AI systems and management processes. They tell you what good governance should achieve. They stop short of the tools people open every morning.

Your AI governance model sets out who does what. An executive sponsor usually owns the outcome. A group drawn from legal, security, data and the business writes the AI governance policy and rules on high-risk uses. Named owners run each tool or system day to day. In a smaller organisation, one person may hold several of these roles. Every AI tool still needs someone who answers for it.

The NIST AI RMF organises AI risk work into four functions: Govern, Map, Measure and Manage. The five controls above sit mostly under Govern (roles, owners and policies), Map (knowing what AI you use and where) and Manage (controlling changes and access). They do not cover Measure, which is about testing and evaluating AI systems. ISO/IEC 42001 is a management system standard for AI. It expects defined roles, documented processes and records. An inventory with owners, a publishing process and an audit trail are useful inputs to that work. This is orientation, not certification. Joyst is not a compliance suite and does not make an organisation compliant with NIST, ISO/IEC 42001 or the EU AI Act. Use your chosen framework for the full picture, and these controls for the everyday tools inside it.

Copy this list and work through it with your team. Inventory [ ] We keep one list of the skills, prompts, MCP servers, secrets and agents our teams use. [ ] Each MCP server on the list has its tools documented in plain language. Owners [ ] Every item has named owners who can change it and answer for it. [ ] Everyone else has view or use rights, not manage rights. Publishing [ ] Changes to shared skills and prompts start as drafts. [ ] Someone with the right to publish reviews changes before the team gets them. [ ] We can roll back a skill or prompt to its last good version. Secrets [ ] No API keys are pasted into chats, prompts or committed config files. [ ] Keys for AI tools live in a vault and are referred to by name. [ ] Keys that were exposed have been rotated. Records [ ] We can see who connected, published or changed each item. [ ] We review access and ownership on a regular schedule. Policy and people [ ] We have a short AI usage policy that people have read. [ ] New starters are shown the approved tools in their first week.