The situation in the room
A manager tells a team to stop using a public AI tool. An employee points to the company policy, which encourages responsible exploration but never names tools, data, tasks, or consequences.
The policy was written to signal responsibility rather than govern behaviour. Its principles sound sensible and answer nothing. The work looked active from the outside. Inside the organization, the unanswered decision was still controlling what happened next.
What the situation is telling you
A usable policy names approved tools, prohibited data, permitted tasks, disclosure rules, human review, escalation, enforcement, and a review date.
That distinction matters because organizations often respond to the visible symptom. They buy another capability, add another review, or ask employees to try harder. The underlying distribution of authority, knowledge, and responsibility stays unchanged.
The sharp version is this: activity is not alignment. A credible programme connects the business outcome, the rules, and the people expected to carry the change.
Why the usual response fails
If a policy cannot answer a real question, it is a press release.
When leadership leaves that decision implicit, each function fills the gap with its own incentives. Technology sees deployment, finance sees cost, legal sees exposure, communications sees a message, and frontline teams see new accountability without new authority.
If a policy cannot answer a real question, it is a press release.
The decision behind the work
Move aspiration into a values statement. Keep the policy short, concrete, role-aware, and owned by someone with authority to maintain it.
Write the answer so that a person outside the project can use it. Name the owner, the boundary, the evidence, and the moment the decision gets reviewed again. If the answer depends on knowing who was in a particular meeting, it is not yet an operating decision.
This is where strategy earns its name. It reduces the number of choices people have to remake in private and gives the organization a stable reference point when the next tool, vendor, or urgent request arrives.
What good practice looks like
Test every clause against a Tuesday afternoon scenario. If two reasonable employees would interpret it differently, rewrite it.
Good practice is visible in ordinary work. People know what they may do, what they must check, who can decide, and where an exception goes. Leaders hear the same account from different teams because the framework is shared rather than remembered differently.
The aim is not perfect control. The aim is a system that notices when reality changes and knows who has to respond. That creates movement without pretending uncertainty has disappeared.
Make the answer operational
Start with the smallest version of the decision that still changes behaviour. Put it in plain language and test it with the people who will use it under pressure. Ask them what they would do, what they would record, and who they would call when the ordinary case stops being ordinary. Their hesitation will show where the instruction is still abstract.
Then connect the decision to the systems around it. A rule without training becomes a document people forget. Training without authority becomes advice people cannot follow. Authority without review becomes a permanent answer to a changing question. The three have to move together, with one person accountable for keeping them connected.
Review the result through actual work rather than confidence surveys alone. Look at a sample of decisions, outputs, exceptions, and escalations. Ask whether the intended boundary held and whether people found a hidden route around it. When the evidence changes, revise the operating choice openly and record why. That is not inconsistency. It is governance doing its job.
What to do on Monday
1. Circle every sentence in the policy that does not change behaviour. Keep the action small enough to complete, specific enough to observe, and connected to a named decision rather than a general ambition.
2. Publish an approved tools list with an owner. Keep the action small enough to complete, specific enough to observe, and connected to a named decision rather than a general ambition.
3. Set the next policy review date now. Keep the action small enough to complete, specific enough to observe, and connected to a named decision rather than a general ambition.