AI Agent Engineer

AI Agent Engineer
PERSONAL PROGRESS

Mark this course

Course content is public. Sign in to save personal progress.

AI Governance Learning Path

6 min read

AI Governance Learning Path

About this knowledge base

AI governance turns the question “how should we use AI responsibly?” into organizational mechanisms that can be executed, traced, and reviewed. It is neither an ethics slogan nor a pre-release checklist. It is a chain of accountability that runs through demand definition, procurement or development, validation, deployment, operation, change, incidents, and retirement: every system needs an accountable owner, every risk needs a decision-maker, every control needs evidence, and every change needs to trigger review.

This course uses the NIST AI RMF functions—Govern, Map, Measure, and Manage—as a general risk-management skeleton, and uses the OECD AI Principles to calibrate the perspectives of human rights, transparency, safety, and accountability. Laws and standards are only entry points for locating and checking sources; any conclusion about applicability or compliance must consider the role, intended use, region, industry, and current authoritative text.

Where this course fits in the overall route

This course belongs to the Safety and Governance knowledge domain. It is a core course near the production-release gate on the Agent Platform Engineering path; learners on other paths can enter it when they take responsibility for a system or its risks. First build a working understanding of Agent Core and data and model fundamentals, then connect the material to Evaluation Framework, Runtime Monitoring, AI Safety, and Privacy Computing. Governance connects that technical evidence to accountable people, risk tolerance, approvals, and lifecycle decisions; it does not replace technical validation.

Learning objectives

  • Build an AI-system inventory that covers in-house, procured, open-source, embedded, and experimental systems.
  • Distinguish accountable, operating, reviewing, consulted, and informed roles, and identify who may accept residual risk.
  • Tier risk and conduct impact assessments from the use case, affected people, and real-world consequences rather than the model name alone.
  • Govern the full value chain of data, models, tools, vendors, and versions.
  • Retain the minimum sufficient evidence for transparency statements, evaluation, approval, change, monitoring, incidents, and retirement.
  • Produce an offline, reviewable minimum AI-governance package and explain why it is not proof of compliance.

From framework functions to artifacts and responsibilities

The NIST AI RMF functions are not a one-time waterfall. Govern runs through the other functions, while Map, Measure, and Manage recur as use, evidence, operation, and external conditions change. The Playbook explicitly presents voluntary guidance, not a checklist that must be completed item by item.

FunctionCore artifacts in this coursePrimary responsibility interfaces
GovernInventory; roles and decision rights; policies; risk tolerance; supply-chain responsibilityGovernance body, ultimate accountable owner, system and risk owners
MapIntended use, affected people, scenarios, regions, impact paths, and non-AI baselineProduct and domain teams, data, privacy, security, and affected-person participation
MeasureScenario-based evaluation, subgroup analysis, red teaming, control evidence, and uncertaintyIndependent evaluation, security/privacy review, and domain review
ManageRisk prioritization, release and exception decisions, monitoring, incidents, recovery, and retirementAuthorized approvers, operations and incident owners, and business owners

Framework entries indicate the result that should exist. The organization must still assign a versioned artifact, owner, decision right, validation method, and review trigger to every result.

Prerequisites

  • Understand that an AI or Agent system commonly includes a model, prompts, data, retrieval, tools, identity, human steps, and runtime infrastructure.
  • Have basic project-management, risk, testing, and versioning concepts; legal or audit training is not required.
  • Read AI Safety and Privacy Computing first to understand the boundary of technical controls.

01 Foundations and risks

  1. System inventory and accountability — first answer “what is governed, who is responsible, and who can decide?”
  2. Risk tiering and impact assessment — derive review depth from the use case and affected people.

02 Controls and governance

  1. Data, model, and vendor governance — govern the value chain from data to external services.
  2. Documentation, transparency, and traceable evidence — retain verifiable evidence for different audiences.
  3. Release approval and change management — bind evidence to versions, conditions, and decisions.
  4. Runtime monitoring, incidents, and retirement — govern real change and harm after release.
  5. Regulations, standards, and regional review — distinguish voluntary frameworks, standards, organizational policy, and legal obligations.

03 Project and self-assessment

  1. Project: Offline AI Governance Pack — integrate the first seven lessons into a reviewable JSON evidence pack.

Hands-on project

  • The capstone is Offline AI Governance Pack.
  • 03-project-and-self-assessment/examples/governance_pack.py uses a synthetic scenario—assisting the organization of benefit-application materials—to produce an inventory, roles, impacts and risks, components, approvals, monitoring, incident, and retirement plan. It is offline, never touches real personal data, and requires no credentials.
  • After each lesson, update the same governance pack for a “customer-support reply-drafting Agent” and compare how its scope, risks, and approval conditions change.

Mastery checklist

  • Every AI use case has a unique inventory ID, purpose, owner, status, components, regions, and review date.
  • High-impact decisions have named accountable owners and an independent challenge channel; neither the model nor a vendor can accept residual risk on its own.
  • A risk tier can be traced to severity, likelihood, scope of impact, reversibility, autonomy, and affected groups.
  • Records for data, models, vendors, evaluation, approvals, and changes can be joined through version identifiers.
  • Monitoring metrics have thresholds, actions, owners, and escalation paths; both incidents and danger signals enter a closed loop.
  • Retirement revokes access, stops calls, handles data and logs, retains necessary evidence, and notifies dependent parties.
  • You can explain why governance materials do not automatically demonstrate compliance with a particular law or standard.

Relationship to other knowledge bases

  • AI Safety produces threat models, red-team results, access controls, and incident evidence; governance determines responsibility, thresholds, and risk acceptance.
  • Privacy Computing provides data-minimization and privacy-enhancing technologies; governance approves purpose, budget, vendors, and lifecycle.
  • Evaluation Framework and Runtime Monitoring provide quantitative evidence before release and during operation.
  • LLMOps governs versions, releases, and observability; governance specifies which changes require reassessment and approval.

Primary references

Scope boundary

This course is engineering education material, not legal, compliance, certification, or audit advice. A production project must be reviewed by authorized people against its deployment location, users’ location, industry, data, organizational role, and the latest authoritative texts. “Adopting a framework” does not equal “complying with a law.”

Backlinks