AI_GOVERNANCE.md: One File That Says What Your AI May Do

0:00What is AI_GOVERNANCE.md?

Welcome! README is for humans. AGENTS.md is for agents. What about governance? AI Governance Chain proposes AI_GOVERNANCE.md: one small file at the root of your repo that says what your AI system may do, who owns it, and who can stop it.

Quick note: this is my AI avatar. I write and approve everything it says, and every source is in the description. I am Mathieu K. Gouanou, a consultant based in Geneva, Switzerland, with 20+ years in organizational transformation. I write the AI Governance Chain newsletter on LinkedIn, and I am the founder of aigovernancechain.com. this is Season 1, Episode 2.

0:38The problem: governance far from code

Ask a company where its AI governance lives. You'll often hear: a slide deck, a spreadsheet, a policy PDF on the intranet. Now ask the developer who is about to merge a change to the support agent. Have they seen any of it? Usually not. The rules live far from the code. So the code drifts away from the rules, one commit at a time.

Meanwhile, coding agents already read files in your repo. AGENTS.md, a simple file of instructions for coding agents, has been adopted by more than 60,000 open-source projects. It now sits at the Agentic AI Foundation, under the Linux Foundation. Agents read what's in the repo. So put governance in the repo.

1:16The definition and what's inside

Here's the definition. AI_GOVERNANCE.md is an open file format that tells people, coding agents and continuous integration (CI) what an AI system is allowed to do, which rules apply, and who can stop it. It's a draft standard, version 0.1 as of 4 November 2026, with a JSON schema, published under CC BY 4.0.

The top of the file is structured data. System name, owner, countries, roles and uses. Then controls, each with a status and a pointer to evidence. If your system is an agent, it lists the tools, their limits, the spend limit and the kill switch. Below that, plain English for people. One file, three readers. On the chain, it touches every link, from LAW to OVERSIGHT.

2:02Generate and check it in 3 steps

Step 1: generate it. Run aigovchain init. It asks where you operate, your role and what the AI does. Then it writes the file with the obligations in scope. One command, link below.

Step 2: check it. aigovchain check runs 16 checks across the chain. Does every obligation that applies today have a control? Do risky agent tools, like payments or deletes, have limits or human approval? Is there a kill switch? Is a deadline coming in the next 180 days with nothing prepared? Did a human review the file in the last 12 months?

Step 3: keep it honest. Check 16 warns when a file claims things like fully compliant, and it asks for a governance contact. Put the checks in continuous integration (CI), and every pull request shows where you stand.

2:47A real check result: 14/16

Here's a real run, on the example file in the repo. A support agent, deployed in the EU and California, that can issue small refunds. Refunds are capped at 100 euros and need a human. The spend limit is 50 US dollars a day. There's a kill switch, and email is treated as data, not instructions.

Result: 14/16 checks passed. One warning, one failure. The failure: controls are missing for obligations that already apply, like AI disclosure and AI literacy. The warning: California's SB 1119 child-safety rules start on 1 January 2027, less than 180 days away, and nothing is prepared. That's the point. The file doesn't flatter you. It tells you what to fix next.

3:30Who AI_GOVERNANCE.md is for

Developers get rules they can read in the editor. Compliance teams get one place to look, with links to evidence instead of email threads. Maintainers of open-source AI projects get a clear way to tell users how the system is governed.

And buyers, including public bodies, can ask a supplier one simple question: can I see your AI_GOVERNANCE.md?

3:51Limits: what the file is not

Let me be precise about what this file is not. A self-declared file is not an audit, a certification or a conformity assessment. It's governance guidance, not legal advice in any jurisdiction. The checks read what you declared. They don't test the model. And the spec is a draft, so it will change. Your comments can change it.

4:10Your next step

Your one action today: run aigovchain init in one repo and read what comes out. The link is in the description.

Next episode: your file passes 16 out of 16 checks. How do you show that to the world without claiming something you can't prove?

Thank you for watching!