Access alone is not enough
Many organizations have rolled out GenAI governance in pieces: approved tool lists here, policy documents there, compliance training somewhere else. But governance only works when the components come together — when the person using the tool also understands the rules.
What the data shows
Respondents who have both approved tool access and have completed a policy review show meaningfully better outcomes than those missing one or both.
+9.2 points (p=0.006)
−34% fewer errors
The "both" group scores 9.2 SJT points higher (p=0.006) and makes 34% fewer errors than respondents without both components in place. The gap is not marginal — it is the difference between a capable user and one who is still operating without guardrails.
Why it matters
Tool access without policy awareness creates a false sense of coverage. The organization has "done governance" on paper, but the individual user is still making decisions without understanding what is safe, what requires checking, and what should never enter an AI tool.
Conversely, policy knowledge without approved tools means users may gravitate toward unapproved alternatives — personal ChatGPT accounts, free-tier tools, browser extensions — where organizational guardrails do not apply. Both conditions need to be met for governance to reduce risk. The GenAI Capability Pulse can measure whether your teams have both components in place and where the gaps remain.
What to do about it
- Gate provisioning: Make policy review — or a short governance module — a prerequisite for tool access. Do not grant one without the other.
- Pair access with enablement: Tool access alone still leaves gaps in Verification and Data Handling. Couple provisioning with targeted training on these dimensions.
- Design for workflow: Embed guardrails — safe-input rules, verification checkpoints, escalation triggers — where AI outputs enter decisions, rather than relying on policy documents alone.
Gate provisioning — make policy review a prerequisite for tool access, not an optional checkbox.
These findings are drawn from the GenAI Capability Pulse — a scenario-based assessment that measures what non-technical teams actually do with GenAI, not what they think they can do. If your organization is scaling GenAI adoption, start with a baseline.
Source: AGASI GenAI Capability Pulse. Comparison of respondents with both approved tool access + completed policy review (n=61) vs not both (n=92). Welch's t-test p=0.006 (N=153).