Keeping The Board Focused On The AI-Human Relationship

By Craig Davies, Chief Information Security Officer, Gathid.

​Most board conversations about AI still start in the wrong place, usually too high up in the stack. The questions are typically about productivity, regulatory exposure, ethics, budget, workforce impact or competitive advantage. But CISOs don’t get close enough to the operating issue that decides whether AI becomes a controlled business capability or the next unmanaged risk surface.

The question I want boards to ask, then, is more specific: When a human and an AI system share the work, who holds the authority to act, who owns the decision, and how do we prove what happened?

This is how AI has become an identity management problem. For years, identity governance was built around the fairly stable assumption that a user was a person. That person had an account, a role, a manager, a lifecycle and an access review. Even when governance was imperfect, the model was understandable.

AI has changed the shape of the user. A single employee may now operate with a copilot, a coding assistant, a workflow bot, a service account, a data pipeline and several automated agents acting around them. Increasingly, these systems make decisions that affect production systems, customers, financial workflows or regulated data.

The Board Needs A More Practical AI Conversation

The Board does not need a technical briefing on every AI tool in use. What directors need is a simple way to understand how human judgment, machine action and business accountability fit together.

I would frame it this way: Every AI-enabled workflow creates an authority chain.

A human sets an objective. A system interprets it. An agent or automation acts. Another system records or responds to that action. Somewhere in that chain, data is accessed, changed, moved, summarized or exposed. If the Board can’t see this chain, it can’t govern the risk.

The Example I Keep Coming Back To

Move The Conversation From Access To Authority

• Who owns each non-human identity?