AI governance needs brand standards that systems can enforce

More approvals cannot govern AI creation at scale

Requiring approval for every AI-generated customer experience keeps a familiar process but creates a growing production bottleneck. AI can generate content in seconds, adapt experiences dynamically and let people without design or development skills create customer-facing work. As agents also begin making decisions and acting for organizations, governance must reach the systems that produce those experiences.

The traditional publishing process shows why governance needs to change. Organizations set guidelines, asked designers, marketers and developers to work within them, and relied on a relatively small group to control publication. The sequence was straightforward: create, review, fix and publish. Human review connected the organization’s standards to what customers saw, even when creators needed corrections along the way.

Keeping that review process is an understandable response to AI risk. A team might require approval for every generated page, message or experience, gaining immediate control while preserving familiar responsibilities. But faster creation brings longer approval queues and more work correcting completed outputs. Adding governance as another approval stage eventually limits how much the organization can create.

To handle that volume, organizations need authoritative inputs and enforceable standards inside the creation environment, with human attention directed by risk. Output checks remain useful, and some activities should stay under full human control. Routine governance, however, needs to operate earlier through the data, rules, boundaries and validation that determine what can be produced.

Governance must reach beyond flagship experiences

The volume problem grows as creation spreads beyond the teams that traditionally controlled publication. Marketers, sales teams, agencies, regional teams, product teams, customer service organizations and individual employees can all create customer-facing material. In practice, the potential creator population becomes almost unlimited. Agents add another set of actors whose work requires governance.

As that population grows, more creators must interpret standards scattered across documents and systems. They rely on knowledgeable colleagues, manual reviews and handoffs to understand how the brand should appear. People who know where information lives and whom to ask have an advantage. Everyone else must reconstruct the rules before applying them, so centralized review becomes the point through which their work must pass.

Yet governance attention still tends to focus on the corporate website, major campaigns and flagship experiences. These properties are visible, familiar and often controlled by established teams, while smaller experiences span channels, markets and departments. One slightly inconsistent landing page may have little consequence on its own. Thousands of inconsistent micro-experiences can collectively cause more damage than a single off-brand flagship page because their exposure accumulates.

Customer experience (CX) leaders therefore need controls wherever distributed creation happens. Requiring a central team to inspect every regional page, sales asset or service interaction spreads the approval bottleneck across the organization. Shared standards and automated validation can extend governance to those creators, provided the information behind the controls has clear authority.

Connected information still needs explicit authority

Extending those controls starts with deciding which information the organization permits AI to trust. Brand and product knowledge may be spread across Figma, Notion boards, Confluence, content management systems (CMS), digital asset management repositories, PDFs and presentation decks. Brand kits, sales-enablement material and websites add more versions. Long-serving employees also hold context that never entered a maintained system.

Connecting these repositories makes their contents easier to retrieve, but it leaves authority unresolved. Consider a product description for a regional campaign: one document describes the current offer, another reflects an earlier position, and a third uses wording developed for a different purpose. All three may look relevant to a retrieval system. The organization must decide which description governs this use and what the system should do when documents conflict.

Pricing makes the consequences more direct. Sales-enablement material and the website may contain different prices, so availability alone cannot determine which price belongs in a new experience. An old presentation can also remain easy to find after its positioning has been abandoned. Without retirement rules, AI can keep retrieving messaging the organization stopped using two years ago.

Resolving these conflicts requires a deliberate sequence. First, identify the information that governs each subject; second, assign an owner; and third, define how that owner updates it. Fourth, specify how AI may access the information, and fifth, establish rules for resolving conflicts. Sixth, retire obsolete material, and seventh, provide the context needed to apply the remaining information correctly.

These steps turn a collection of documents into a maintained basis for decisions. Ownership establishes accountability, while update procedures keep the maintained version current. Conflict rules determine what happens when relevant materials disagree, and retirement prevents abandoned information from competing with current standards. Context explains where and how an authoritative statement applies.

Access and authority therefore require separate decisions: a repository connection enables retrieval, while an authority model establishes when the organization permits reliance on retrieved information. A connection alone cannot resolve the regional product-description or pricing conflicts. Once teams settle authority, they can structure the approved information so people and agents can apply it consistently.

Make standards enforceable inside the creation workflow

Structure standards so humans and agents can apply them

Applying authoritative information consistently requires standards that creation tools can use. Those tools can then offer approved components, supply current product information and check claims as an experience is assembled. To make that possible, organizations must turn guidance that requires interpretation into structured assets and connect those assets to production.

Most existing brand guidance leaves that translation to a person. A brand kit tells a designer which colors and fonts to use, a slide deck describes tone of voice, and a screenshot shows how a page should appear. These materials communicate intent, but someone must turn it into a working experience before a system can enforce it.

Structured standards make that translation explicit. Color guidance becomes design tokens: named values that creation tools can apply consistently. Screenshots become component libraries containing approved building elements. A builder using those components starts with an accepted implementation of the visual standard, reducing the interpretation needed during assembly.

Content needs an equivalent structure so systems can select and reuse it correctly. Word documents become structured content models that define the fields and organization of information. Loose naming practices become metadata and taxonomy: descriptive labels and agreed categories that help systems identify the right material. Knowledge held informally by experienced employees becomes explicit rules others can follow.

The same treatment must extend to product information, claims, positioning and messaging. A claim needs to be identifiable as approved, with its relevant context available whenever it is reused. The practical test is whether a person and an agent can apply the standard consistently without an undocumented explanation. Because a structured record can still contain obsolete positioning, the earlier authority decisions must govern these assets too.

Carry standards through production

Once standards are structured, production must carry them into the environments where work happens. The familiar approach moves from design to documentation to build: a Figma Design System informs manual documentation, which developers use in code or a CMS before delivering a digital experience. Each handoff requires someone to translate a documented rule into an implementation decision.

Repeated translation makes consistency harder to maintain as more teams and agents create experiences. Changes must follow the same handoffs as the original guidance, so a revised standard creates another round of interpretation. The emerging process gives standards an operational role throughout production. Its broad sequence is design, conversion into structured data, distribution, build, governance and improvement.

In this process, teams start with the Figma Design System and create a structured layer containing data, context and operating rules. They distribute that layer to destinations such as code, CMS and MCP, the Model Context Protocol, a standard for connecting AI systems to tools and data. They then validate brand compliance and use the results to make adjustments. Standards stay connected to their application after the initial design handoff.

Keeping that connection active lets current rules shape work as it is produced. Teams maintaining those rules can distribute changes and check whether experiences remain compliant. Documentation continues to explain intent, while structured assets and operational controls make that intent usable during production.

Validate while the experience is being created

With standards available during production, publication can follow a different sequence: create inside the governed system, validate automatically, escalate exceptions, then refine or publish. Routine checks run during creation, while a human reviewer receives cases that need a decision. Problems surface earlier, leaving less completed work to correct.

An AI experience builder restricted to approved components shows how an early control works. The builder assembles an experience from elements the organization has already accepted, limiting its choices at the point of creation. A reviewer may still assess the result, but the system has already prevented the use of unapproved components.

Approved components, however, do not establish the truth of the content placed inside them. Product claims need a separate check against authoritative product data during creation. If a claim conflicts with that data, the workflow can require refinement or escalate the exception before publication. The creator can then resolve the discrepancy during production.

Other requirements can be checked at the same stage. Approved brand terminology can be enforced automatically, and accessibility validation can run before release. These checks belong to a wider set of standards covering visual identity, voice, tone and messaging. Experience patterns and design components govern how interactions are assembled, while personalization rules determine how those interactions may vary.

The same environment must govern the business information and actions behind those interactions. Product information, product claims, positioning, pricing and legal language affect what the organization represents to customers. Customer data, approved information sources and permitted agent actions establish what systems may use and do. Together, these requirements define the operating boundaries for generation and validation, with downstream review retained where human judgment adds value.

Keep human oversight proportional to risk and autonomy

Even with those boundaries in place, leaders must decide how much freedom AI should have in each activity. Oversight should follow both risk and the extent of permitted action. A draft awaiting human use presents a different control problem from an agent acting across customer touchpoints, so identical approval requirements would ignore an important difference.

At the assistance level, AI drafts, recommends and suggests while people retain full control. A person decides what to accept, change or use. This remains an appropriate model wherever direct human judgment is required. Organizations can keep it for those activities without treating it as a temporary stage toward greater autonomy.

Where the activity allows more freedom, constrained generation lets AI produce within approved templates, components, content and business rules. The organization has already limited the available materials and choices. Human oversight can account for those constraints when deciding which outputs need review and which checks the system can perform.

Permission can extend further through bounded execution, where AI acts within defined limits. Humans manage exceptions while the system handles routine actions inside those limits. The boundaries must establish both what the system may do and when responsibility must return to a person.

Broader autonomy allows agents to operate across digital touchpoints, with people setting policy, monitoring behavior and deciding when to stop or escalate. Direct approval becomes less frequent, but human responsibility continues. Greater freedom therefore makes clear intervention rights and ongoing oversight more important.

These operating levels preserve human judgment because embedded standards address only part of governance. A system can enforce an approved component or check a claim against a designated record, while people still decide policy, handle exceptions and determine whether an agent should continue operating. Time spent checking whether someone used the wrong shade of blue can instead go toward those decisions. The appropriate autonomy level follows the activity’s needs, with no mandatory progression toward the broadest permission.

Assign owners and measure whether changes reach customers

Putting that division of responsibility into practice requires named teams to own standards, controls and intervention. Marketing, IT or legal cannot establish the whole model alone because its decisions cross organizational boundaries. CX leaders can coordinate responsibilities around the customer experience, while each function remains accountable for its part.

Within that shared model, brand teams own standards and messaging. Design and product teams define the experience, engineering establishes the architecture and implements controls, and data teams own quality and access. Their responsibilities must connect to the people who set policy, monitor behavior, handle exceptions and authorize intervention as autonomy increases.

To make those connections explicit, the operating model must answer seven questions. Who owns the standards, who may change them, and what happens when they change? Which information sources have authority, who monitors AI output, what happens when a rule is violated, and when must a system stop or escalate? A governance document becomes operational when its answers assign owners and establish enforcement.

Organizations can build this model gradually, starting from document-based standards, ad hoc AI use and reactive governance. Shared components, structured content and clearer ownership create a foundation for the next stage: explicit authoritative sources, rules integrated into workflows and wider automated validation. AI-native governance describes the more mature state, in which AI operates with machine-readable standards, trusted context and generation within defined boundaries. Human attention increasingly goes toward judgment.

Progress through these stages should be assessed against the intended outcomes: faster creation, less cleanup, lower friction, reduced brand risk and greater scale. Authoritative information reduces ambiguity, creation-time controls apply routine standards, and risk-based oversight directs human attention to decisions that require it. Teams can test whether these mechanisms work through everyday production measures.

Measurement should begin with whether creators and systems use governed inputs. Grounding rate measures the share of AI-generated content based on authoritative information, while approved-component use shows how widely accepted building elements appear across experiences. Exception frequency or rate reveals how often work needs additional attention. The amount of outdated content indicates whether retirement practices are keeping pace.

Those measures should sit alongside remaining manual approval steps and incident occurrence. Approval steps reveal operational friction, while incidents show where controls have failed in practice. An absence of visible incidents gives an incomplete picture of how difficult the organization is to operate. Evaluation should therefore examine ease of operation, reduced friction and reduced risk together.

Change-propagation speed makes this evaluation concrete: when a brand or product standard changes, leaders should track how quickly it reaches customer experiences. Updating a document completes an administrative task; applying the new standard across the experiences customers use completes the operational change. Measuring that interval gives standards owners, engineering and data teams a shared responsibility for carrying an approved change through to customers.

In conclusion

AI governance becomes a scaling problem when every new experience requires another approval. For business leaders, the decision is where to place control so the organization can create faster without losing accountability. Human review remains necessary, but it cannot carry the full burden as creation spreads across teams, channels and agents.

The priority is to establish which information AI may trust, who owns it and how standards become enforceable within production. Leaders can begin with a defined customer-facing workflow, settle conflicting sources and connect approved content and components to the tools creators use. Human approval should remain where risk requires it, with clear limits and escalation rules wherever AI has permission to act.

Success depends on whether these changes improve daily operations. Leaders should track manual review, exceptions and incidents alongside the speed at which updated standards reach customers. Faster creation has limited value if obsolete claims or inconsistent experiences spread just as quickly.

The goal is to make routine work reliable enough that people can focus on consequential decisions. That requires governance to operate as part of production, with named owners accountable for both the controls and their results.