Most AI governance is theater. The board exists, the policy is written, the meeting happens — and none of it changes what ships. The work that matters is the small set of structural choices that decide whether oversight is real or ceremonial.
Effective governance works like a clearance system: a port authority with zero ambiguity about criteria or authority. Nothing crosses without meeting a known standard, and what meets the standard crosses without friction. The point isn’t to slow things down. It’s to make the line between authorized and unauthorized action legible, enforceable, and fast.
The two failure defaults
Boards collapse into one of two modes. The Rubber Stamp approves everything, so it governs nothing — it exists to produce a signature, not a decision. The Indefinite Hold approves nothing on a defensible-sounding timeline, so the business quietly routes around it and governance becomes the thing teams hide work from. Both end in the same place: the board is no longer where authority actually lives.
What the operating model requires
A board that holds the line needs testable criteria, scoped authority, and actionable denials — plus a documented appeals path and real C-suite accountability behind it. Criteria you can evaluate against, not principles you can interpret either way. Authority scoped to what the board can actually decide, so a “no” means something. And denials specific enough that the practitioner on the receiving end knows what changed and what to do next.
In execution, the criteria framework matters more than the charter, and the board needs dedicated capacity rather than borrowed attention. A governance function staffed out of people’s spare time defaults to the Rubber Stamp by gravity.
The test of whether any of it works: does a practitioner who gets denied understand exactly what happened, and what to do next? If the answer is no, the board is producing theater, however well-attended.