Discuss these controls with us at OC Tech Week on October 21.
Self-Assessment Resource · T. Stanford Law & Yology.AI
Executive AI Control Scorecard
A practical two-sided worksheet covering the six areas where AI deployments most commonly lose control. Use it to assess a specific workflow, prepare for a board conversation, or identify where your organization needs more structure.
The six control areas
The scorecard is organized around six areas that together cover the most common points of AI control failure. Each area includes a set of questions an executive or governance team can work through independently — or with a facilitated review.
01
Agent permissions
What can your AI agents do, and who authorized each capability? This area covers how permissions are scoped, granted, reviewed, and revoked — and what happens when an agent acts beyond its intended boundary.
02
Sensitive-data handling
Which data does your AI workflow touch, and what governs how it moves? This area examines information boundaries, retention, and the controls that prevent sensitive data from reaching unintended destinations.
03
Spending controls
AI agents can incur costs — API calls, compute, third-party services — without direct human approval. This area covers budget limits, approval thresholds, and monitoring for unexpected expenditure.
04
Human approvals
Which decisions require a human in the loop before action is taken? This area maps the approval gates in your AI workflow and evaluates whether they are positioned correctly and actually enforced.
05
Vendor questions
What do your AI vendors' contracts say about liability, data use, model changes, and incident notification? This area surfaces the questions organizations should be asking — and the answers they should have on file.
06
Output checks and response planning
How are AI outputs reviewed before they carry organizational weight? And when something goes wrong, what is the response plan? This area covers output validation, incident detection, and the steps that follow an AI failure.
Private review
Request a private AI scorecard for your company, team, or individual workflow
The printable scorecard is a starting point. Companies, teams, and individuals can request a private, facilitated review of a defined AI use case. We can discuss information boundaries, agent permissions, spending controls, human approvals, vendor questions, output checks, and response planning, then propose an appropriate scope and next steps. The format, deliverables, timing, and fee are agreed separately before any work begins.
An inquiry does not begin an audit, legal engagement, or paid project. A private review begins only after its scope and terms are agreed. Legal advice, if requested, follows T. Stanford Law's separate conflicts and engagement process.
A private scorecard discussion can address technical and operational architecture through Yology.AI. Individualized legal advice requires a separate T. Stanford Law engagement. This worksheet and an inquiry are not a completed security audit, certification, compliance assessment, or legal opinion.
Request a legal consultation →Related resources
This scorecard is a general educational resource. It does not constitute legal advice, a security audit, a compliance assessment, or a legal opinion. Use of this resource does not create an attorney-client relationship with T. Stanford Law. Professional Disclosures