/ Context
Scaling generative AI past pilots is an operating-model problem as much as an engineering one: who may use which capability, how access is provisioned and approved, how usage and licence cost are controlled, and how technology choices are recorded. This work put that model in place.
/ Role & decision scope
- Designed the AI operating model: identity lifecycle, SCIM provisioning, RBAC, approvals, usage and cost controls.
- Authored the ADRs and platform standards guiding AI technology selection across engineering teams.
- Set how centralised controls and team autonomy are balanced.
/ Constraints
- AI access has to follow the enterprise identity lifecycle rather than a parallel process.
- Approvals belong in ServiceNow, the organisation's existing workflow.
- Licensing and usage cost need governance, not just visibility.
- Standards have to stay applicable as the AI framework landscape moves.
/ Architecture & key decisions
- D01
Identity lifecycle as the basis for access
AI tool access is provisioned through SCIM against the enterprise identity lifecycle, so entitlement follows identity rather than being administered separately.
- D02
RBAC as the access model
Access is granted by role rather than individually, which keeps entitlements reviewable as the number of AI capabilities grows.
- D03
Approvals through ServiceNow
Requests for AI capability access run through a ServiceNow approval workflow, giving an auditable path inside the process the organisation already uses.
- D04
Usage and licensing governed at the platform level
Usage controls and licensing / cost governance sit with the platform, so consumption and licence cost are managed centrally rather than per team.
- D05
ADRs and platform standards as the durable output
Technology selection is guided by written ADRs and platform standards, so decisions carry their reasoning forward instead of being re-argued.
/ Trade-offs
- Centralised guardrails versus team autonomy
- Identity, approval, usage and cost controls are governed centrally; how teams build remains theirs, guided by ADRs and platform standards rather than dictated by them.
- A new governance process versus existing enterprise tooling
- Access and approvals were built into the enterprise identity lifecycle and ServiceNow rather than into a separate AI-specific process.
- Fixed standards versus a moving framework landscape
- Design focus: standards and ADRs record the reasoning behind a choice, so the record stays useful as specific frameworks change.
/ Evidence & outcomes
- Artifact
- SCIM provisioning and RBAC model tying AI access to the enterprise identity lifecycle
- Artifact
- ServiceNow approval workflow for AI capability access
- Artifact
- Usage controls and licensing / cost governance
- Decision
- ADRs and platform standards guiding AI technology selection across engineering teams