ai-governance-architect

What it does

Audits a product, existing or in the PRD stage, for missing human oversight, and always surfaces two different kinds of control, not just one: human-in-the-loop (reactive: approval gates, confidence thresholds, audit logs, kill switches) and human-in-the-lead (upstream: the boundaries and decision rights a human sets before the AI acts at all).

How it works

First figures out the mode: auditing something that already exists (Audit Mode) vs. designing governance into something not yet built (Pipeline Mode, run after the agentic design pass and before the PRD).

Either way, it starts by finding every point where AI currently acts without a human touching it: an API call that sends, deletes, publishes, or charges something; an automated recommendation; anything that fires on a schedule or webhook. For every one of those action points, it proposes at least one pattern from both tracks, never dropping one because the other looks more obviously needed, which is the single most common failure mode this skill guards against. You pick from the menu; nothing gets added automatically. Existing products hand the picks to code-build-copilot as a feature list; new builds fold them into the PRD as concrete requirement language sitting next to the feature they constrain.

Try it

Here's what my app/feature does: [describe it]. Find every point where the AI acts without
a human touching it first, anything that sends, deletes, publishes, charges, or decides
something automatically. For each one, give me at least one human-in-the-loop option
(catching it after it happens) and one human-in-the-lead option (setting the boundary
before it can happen at all). Let me pick which ones I want.

When to reach for it

Before anything that acts autonomously goes live, even a "simple" personal project, if it sends messages, writes to a database, or makes decisions without asking first.