AI Risk & Governance for Operators | Operators Guild Focus Session

Which AI risks actually matter, and what should you do about them? I joined Bryan Kaplan (CI&SO, Juvare) for an Operators Guild Focus Session, moderated by Brittany King, for the people usually handed the AI policy after everyone's been told to use AI for everything. We start with finding the AI your company already uses, including what's switched on by default in tools you approved years ago, and why that audit only works if people feel safe telling you what they use. Then prompt injection and blast radius: guardrails define what a model won't do, access controls define what it can't. That's why neither of us gives an AI agent broad access to our email. For a lean team, governance looks like: • A named owner • A team plan instead of personal accounts • An approved-tools list • A careful read of your cyber liability policy We also cover legal exposure (hiring, copyright, and data retention), open-weight models and where your data goes, reporting an AI incident, and member Q&A on vetting open-weight models, custom harnesses, and company context layers. Watch page and full transcript: https://herdingwolves.com/thinking/ai... Five questions that tell you whether a company has AI governance, on one page: https://herdingwolves.com/five-questi... Talk it through with me: https://herdingwolves.com/book/ The full talk on running open-weight models yourself (RMAIIG, 2026):    • Running AI Locally: What It Is, Why It Mat...   Chapters 0:00 Welcome, and the question on the table 1:37 Introductions 3:13 How worried should operators be? 5:39 Three places AI shows up in a company 6:54 AI in tools you already approved 9:36 What prompt injection is 10:54 Blast radius, and what it can't do vs. what it won't 13:34 Where to start: an audit people feel safe answering 16:25 Writing AI policy at a lean Series A company 18:54 Why neither of us lets AI into our email 21:27 Service accounts and dedicated inboxes 23:45 Why "no" backfires, and AI policy as a hiring factor 25:01 Local models and anonymizing data 26:38 What good governance looks like for a small team 29:16 Cyber liability insurance and AI exclusions 30:14 Legal exposure: hiring, copyright, and data retention 35:09 Open-weight models, routers, and where your data goes 38:27 Reporting an AI incident 40:34 Q&A: vetting and hosting open-weight models 47:26 Q&A: emerging models and custom harnesses 50:39 Q&A: company context layers and data hygiene 53:54 Closing Recorded October 6, 2026, as an Operators Guild Focus Session, a virtual session for the Operators Guild community. Korey Mercier is the founder of Herding Wolves – part confidant, part catalyst for leadership teams whose AI adoption is outrunning their agreement on what it's for. #AIGovernance #ShadowAI #Operations