What is a governance plane?
A governance plane is the part of an AI platform that decides who may do what, applies company policy to every request, and records what was done, independent of which model produces the answer. The term borrows from networking, where a control plane directs traffic and a data plane carries it. In an AI platform the models, retrieval services, and tools form the data plane, and the governance plane wraps around them to handle identity, authorization, policy checks, approvals, and audit logging.
Every prompt, retrieval, and tool call passes through it. A user signs in through single sign-on. The plane looks up the user’s roles, limits which documents and tools the request may touch, applies rules such as PII redaction or a block on certain actions, routes the request to an approved model, and writes the exchange to the AI audit log.
Why a governance plane matters
Models change often. A company may swap one open-weight model for a newer one every few months, or route simple questions to a small model and hard ones to a large one. If permissions and logging live inside each application, every change reopens the security review. When they live in one governance plane, the controls stay constant no matter which model sits behind them, and a compliance officer has one place to look. AI agents gain the same benefit: an agent that can issue a credit or update a customer record inherits the approval step and the action log instead of each team rebuilding them.
Governance plane in practice
A collections agency runs an assistant that summarizes account history for representatives, a second that drafts compliant letters, and an agent that proposes payment plans in the system of record. All three pass through the same governance plane. Representatives see only accounts in their own queue. Letter drafts carry a mandatory review flag. The payment-plan agent can propose but never commit, and a supervisor approves each plan from a queue. Every step is logged with the user, the model version, the retrieved documents, and the action taken, which is what the agency’s auditors ask to see.
In Kirk Tech Solutions engagements this layer is built before any model is tuned. FlatClaw, the open-source private AI platform from Kirk Tech Solutions, implements it as identity, role-based permissions, tool controls, approval steps, and audit logging placed in front of the inference endpoint.
What to watch for
- Confirm that every path to the model passes through the governance plane, including scheduled jobs and developer scripts, since one bypass defeats the design.
- Check that permissions are enforced at retrieval time, so a user cannot read through the assistant a document they could not open directly.
- Ask where the audit log is stored, how long it is kept, and who can alter it.
- Prefer a governance plane that is independent of any one model vendor, so a model swap does not require a new security review.