How do you implement AI TRiSM in an enterprise AI program?

Implement in five sequenced stages: discover every AI system in use, classify each by blast radius, attach controls proportional to that classification, enforce those controls at runtime, and generate evidence continuously. Most programs invert this and start with policy, which produces a document that governs systems nobody has counted.

Discovery comes first because you cannot govern what you have not inventoried. Pull from egress logs, OAuth grants in Google Workspace or Microsoft Entra, browser extension telemetry, cloud API billing, and code repositories. Survey-based inventories miss the majority of usage. Akto Atlas automates this on the employee side by discovering unsanctioned AI tools and the data flowing into them, which is the half of the estate that never appears in a survey response.

Classification should rank by what an incident can reach, not how likely it is. An agent with write access to a CRM outranks a summarization tool handling the same data, because autonomy converts a data risk into an action risk.

Controls attach by tier. Low tier gets acceptable use policy and logging. High tier gets input and output guardrails, tool-call authorization, human approval on consequential actions, and pre-deployment red teaming.

Runtime enforcement is the stage that fails most often. Policy defined in a spreadsheet and enforced nowhere is theater. The enforcement point for agentic systems is the tool-call boundary, not the prompt.

Evidence should fall out of the controls rather than being assembled before an audit. If your team is screenshotting configs in the week before Stage 2, the program is not implemented.

Start with discovery. Every other stage inherits its accuracy from that one.