AI Operating Procedures

The enterprise AI failure rate is staggering. Depending on which study you trust, 70–85% of AI projects never make it to production. Of those that do, a significant percentage degrade silently — producing outputs that look correct but aren't, making decisions nobody audits, and compounding errors over time.

The root cause isn't technology. The models are good enough. The data is usually available. The problem is operating discipline.

Most AI implementations follow a pattern that guarantees failure:

• No proof obligation. The AI agent decides for itself when it's "done." Nobody verifies the output against a ground truth. The agent declares success, and nobody checks.
• No gates on risky actions. The agent can send emails, make payments, update records, or deploy code without human approval. When it's wrong, the damage is already done.
• No operating procedures. There's no documented process for how the AI should behave, what it should check, or how to handle edge cases. Every deployment is a one-off experiment.
• No measurement. Nobody tracks whether the AI is getting better, worse, or drifting. There's no baseline, no KPIs, no feedback loop. The AI runs until it breaks visibly — or worse, invisibly.

AI Operating Procedures solve all four problems. They are the missing layer between "we built an AI agent" and "we have governed AI in production."

AI Operating Procedures (AOPs) are RIG's proprietary framework for deploying, governing, and maintaining AI agents in production. Think of them as the SOP (Standard Operating Procedure) equivalent for AI systems — except they're not a generic template. They're engineered per deployment, tested in production, and refined continuously.

An AOP defines three things for every governed agent:

1. The Proof Obligation

Every governed agent has a proof obligation — a specific, measurable definition of "done" that the agent cannot self-certify. The proof obligation is written in plain language, reviewed by a human, and enforced by an independent verifier.

"The agent has produced a client-ready intake summary with all required fields populated, no fabricated case details, and no privileged information leaked to unauthorized parties."

This is not a vague goal. It's a testable contract. The verifier runs the agent's output against the proof obligation and produces a pass/fail verdict — backed by a readable proof packet showing exactly what was checked.

2. The Verification Gate

The independent verifier is the core of governed AI. It's a separate system — not the agent itself — that holds sole authority to declare the work complete. The verification gate checks:

• Completeness — are all required fields/elements present?
• Accuracy — does the output match the source data? No hallucinated facts, no fabricated details.
• Compliance — does the output meet regulatory requirements (HIPAA, privilege, SOX, Colorado AI Act)?
• Safety — are there any gated actions (external sends, payments, destructive operations) that need human approval?

If any check fails, the verifier rejects the output and the agent must retry — with the failure context fed back into its next attempt. The maker is never the grader.

3. The Operating Discipline

The operating discipline is the documented process that governs how the agent behaves day-to-day. It includes:

• Runbook — step-by-step procedures for normal operation, edge cases, and failure recovery.
• Escalation matrix — when does the agent stop and ask for human input? What triggers a manual review?
• Monitoring cadence — how often is agent performance reviewed? What metrics are tracked? What thresholds trigger intervention?
• Change protocol — how are updates to the agent handled? What testing is required before deploying a change?

The operating discipline is what makes AI gains compound instead of drift. Without it, every deployment is a fresh experiment. With it, each agent builds on the proven patterns of the last.

Every RIG engagement follows the same three-phase sequence. It's repeatable, measurable, and proven across 24 shipped systems and 100+ agents in production.

Every governed agent produces a proof packet with each cycle. The proof packet is a readable record of what ran, what was checked, and what the verdict was. It's not a log file — it's human-readable evidence designed for auditors, compliance teams, and executives.

A proof packet contains:

• Timestamp and context — when the agent ran, what triggered it, what input it received.
• Actions taken — step-by-step record of what the agent did, including any gated actions that required human approval.
• Verification results — the verifier's check against the proof obligation: completeness, accuracy, compliance, safety. Pass/fail for each dimension.
• Verdict — the final determination: approved, rejected, or escalated. With the reasoning behind the verdict.
• Human decisions — any points where a human was required to approve, override, or intervene. With the decision and the decision-maker recorded.

This is the fundamental difference between governed AI and ungoverned AI. If there's no proof packet, it isn't done.

The market is full of AI strategy consultants who deliver beautiful decks and walk away. The deck sits on a shelf. The recommendations are never implemented. Six months later, the company hires another consultant.

AI Operating Procedures are the opposite of a strategy deck. They are:

• Executable — not recommendations, but documented procedures that a system follows in production.
• Measurable — every procedure has a proof obligation and a verification gate. You know whether it's working.
• Composable — proven procedures become building blocks for the next agent. Each deployment makes the next one faster.
• Auditable — proof packets provide a complete record for compliance, board reporting, and regulatory review.

At RIG, we hold 3 patents in preparation covering this framework — including the AOP methodology itself, our Deviation Engines for generating candidate solutions, and our Goal Harnesses for defining and tracking proof obligations.

This isn't a framework we downloaded. It's a framework we invented — and refined across 24 shipped systems and 100+ governed agents in production.

AOPs vs. Generic AI Governance

The market is flooded with "AI governance frameworks" — most of them are repackaged enterprise risk management templates with "AI" pasted on top. They're designed for compliance checkboxes, not production systems. Here's how AOPs are different:

• Executable, not advisory. Generic governance tells you what you should do. AOPs define exactly what the agent does, how it's verified, and what happens when verification fails.
• Per-deployment, not one-size-fits-all. Every governed agent gets its own AOP, tailored to its specific workflow, risk surface, and compliance requirements.
• Continuously refined. AOPs evolve based on production data. When the verifier catches a new failure mode, the AOP is updated to prevent it. The governance gets smarter over time.
• Built for engineers, not lawyers. AOPs are written so that the team maintaining the agent can actually follow them. They include code-level specifications, not just policy statements.

The Colorado AI Act Connection

Colorado's original AI Act (SB 24-205) was repealed and replaced by SB 26-189, which takes effect January 1, 2027. The new law is an ADMT (automated decision-making technology) framework: it requires deployers to provide disclosures, keep records for three years, and maintain transparency documentation — and it drops the earlier bill's mandated impact assessments and risk management frameworks. RIG's AOP framework was designed before either law existed, but it maps directly to SB 26-189's record-keeping and documentation requirements. Every governed agent already produces the audit trail, proof packet, and operating documentation that the law's record-keeping obligations call for.