AI Deployments Fail on Governance, Not Models — Build Discovery Into Engineering

The core problem. Deploying AI inside a regulated institution rarely fails because the model isn't good enough. The demo works. The output is usable. The team has invested in a design. Then security asks which environment will host it. Data owners ask who approved using those documents. Risk asks who will review a wrong exception before it hits the next system. Each question is reasonable, and each one can force a redesign.

Discovery as engineering. Gayle's central claim is that discovery — finding the people who own the decisions a deployment depends on — is not a pre-work phase. It is the engineering. At Bloomberg, building LLM infrastructure meant mapping which datasets could be used and who could approve that use. The same discipline applies in any deployment: before designing retrieval, find the person accountable for each data source. Confirm the allowed use and the environment where processing can happen.

The four decision layers. Gayle identifies four layers every AI deployment in a regulated context must resolve. Data: who owns the source, who can grant access, who can approve using it in this workflow. Model risk: which review applies, what a past submission looked like, who will own the system after launch. Third-party risk: the actual dependency chain — model provider, host arrangements, your role in the operating service. Audit: what someone would need to reconstruct a consequential action — input, configuration, reviewer, approver.

Scoping by shadowing and shrinking. When a customer cannot write a spec, Gayle relies on three steps: shadow, draft, and shrink. Shadow an analyst doing the work. Watch which systems they open, where they make a judgment, when they ask for permission. Write down the actual sequence. Then draft a minimal workflow — three lines: review documents, draft exceptions, analyst submits. Make each line specific: which documents, what the model should produce, who checks the draft.

Authority and evidence. Gayle recommends starting with the least authority that solves the problem. A ladder: suggest, draft, acts with approval, acts. Start at the bottom. For a document exception assistant, highlight a likely exception, point to the relevant source, prepare a draft form. The analyst checks evidence and chooses whether to submit. That design can then be tested against the controls owners found in discovery. The evidence pack for risk review should include intended use, data lineage, failure modes, results by segment, and controls.