What's the difference between AI governance and AI monitoring?

What Governance is

AI governance is the set of policies, responsibilities, and standards that define how AI should be built, approved, and used. It covers the ethical framework, the risk thresholds, the approval processes, the accountability structures. It asks: what are agents permitted to do? Who is responsible when something goes wrong? What does compliant use look like?

Governance is largely structural and upstream of deployment. It shapes the conditions under which agents operate before any of them have run a single task.

Done well, it answers four questions: what is this agent permitted to know, what is it permitted to do, who owns those decisions, and what happens when something goes wrong?

What Monitoring is

AI monitoring is the operational practice of observing agents in production — tracking outputs, detecting drift, flagging anomalies, measuring performance against the standards governance set.

Monitoring is downstream of deployment. It watches what agents produce and alerts when something looks wrong. Bias in outputs, accuracy degradation, unsafe responses, policy violations — monitoring is how you find out these things are happening.

The relationship between the two is straightforward: governance defines what "wrong" looks like, monitoring tells you when you're seeing it.

Where both of Them Stop

Perplexity put it well: "Without governance, monitoring has nothing clear to measure against." True. But there's a prior problem that neither typically addresses.

Monitoring observes what the agent produced. Governance sets the policies the agent should operate within. Most governance and monitoring systems don't reliably capture what the agent was actually given before it acted — the operating context, the constraints, the goals, the reasoning behind the decisions it was briefed on.

That gap matters in practice. An agent can operate entirely within its governance policies and still produce decisions that are wrong, because the knowledge it was working from was incomplete, outdated, or never formally captured. Monitoring catches the output anomaly after the fact. Governance confirms the policy was technically complied with. Neither surfaces what the agent was working from when it made the decision.

When that decision needs explaining — to a board, a regulator, a client — the question isn't "was the agent within policy?" Logs and monitoring answer that. The question is "what was the agent working from?" That's a different record, and most organisations don't have it.

The Third Layer

Governance and monitoring together form a framework for AI use. What they don't constitute on their own is a record of what each agent was given before it acted.

That's input governance — the authored record of the operating context an agent worked from: the goals it was given, the constraints it was operating under, the decisions it was built from, the knowledge it was permitted to draw on. Established before execution begins, not assembled from telemetry after.

Parts of this exist implicitly in many systems today — prompt logs, configuration histories, orchestration traces. But they are rarely treated as a coherent, queryable record of what an agent was actually briefed with. The log exists; the brief doesn't.

Input governance isn't a replacement for governance or monitoring. It's the layer that makes both functional at the level of a specific decision. Governance sets policy for agents in general. Input governance records what this agent, for this task, was working from. Monitoring observes what it produced. All three are necessary; most organisations currently have two.

The practical consequence of missing the third: when something goes wrong, the organisation can demonstrate it had policies in place and can show what the agent produced. What it can't show is what the agent was working from — and that's the answer that matters when accountability is on the line.