Guardrails Before Scale

Between 30 October and 1 November 2023 three things happened that a governance function must absorb. A United States executive order was issued, the Group of Seven published voluntary instruments for developers of advanced systems, and 28 countries and the European Union signed a political declaration on frontier risk. None of the three imposes an obligation on an ordinary enterprise deploying an assistant, and all three change the environment in which such an enterprise will be asked to explain itself. This paper converts that environment into an operating blueprint. It covers risk tiering, lifecycle controls, decision rights, supplier assurance and a 90-day launch. The organising claim is that guardrails are a set of decisions with evidence attached, renewed on a cycle, and that a policy document produces none of them on its own. The risks themselves are not conventional software risks. Probabilistic output, prompt injection through untrusted content, leakage of material the user never intended to disclose, a supplier changing a model without notice, and human overreliance on fluent text are the five that most commonly defeat controls designed for deterministic systems.