AI 三道防线治理架构：Three Lines Governance / Decision Rights / Assurance Operating Model

Date: 2026-06-30 Status: evergreen Audience: experienced CBAP / financial retail PM / product architect / enterprise architect / AI governance lead / risk-audit partner Output: 一套把 AI use case、lifecycle gate、decision rights、control ownership、evidence forum、issue management、escalation 和 architecture governance 连接起来的 Three Lines operating model。

重要边界:

• 本文不是法律意见、监管解释、审计意见、模型验证结论、内控有效性结论或生产上线批准。
• 本文不重复 product responsibility、stakeholder coalition、model validation、continuous control monitoring、board reporting 和 segregation of duties 的完整框架。
• 本文只解决一个高级问题: 金融零售企业如何把 AI 治理从"委员会审批"升级为按三道防线分工运行的 enterprise operating model。

一句话:

AI Three Lines Governance 是把 AI 产品、业务运营、风险合规、内部审计和架构治理连接成一套可决策、可挑战、可取证、可整改、可追踪的 operating model。

---

1. Why Three-Lines Governance Matters for AI Product / Architecture

AI 产品常见治理失败不是因为没有流程, 而是因为 decision rights 和 evidence ownership 模糊:

产品团队认为风险已签字
风险团队认为只是提出意见
合规团队认为业务仍需自担责任
审计团队发现证据不足
架构团队发现上线时才补控制
运营团队发现人工复核和例外处理不可运行

传统软件上线可以把责任拆成需求、开发、测试、变更、运维。AI 系统更复杂, 因为风险来自多个动态对象:

• prompt、model、retriever、knowledge source、tool permission、agent plan、human workflow、vendor dependency 会持续变化。
• AI output 可能进入客户沟通、案件记录、信用建议、AML narrative、KYC decision support 或员工知识检索。
• 控制不是单点审批, 而是从 intake、design、pilot、release、scale、change、incident、retirement 贯穿生命周期。
• 风险挑战不是阻断创新, 而是让第一线能在可证明的边界内拥有产品和运营责任。

Three Lines model 对 AI PM / BA / Architect 的价值:

核心转变:

from committee-based approval
to lifecycle decision architecture

from ownerless evidence
to control owner + evidence owner + challenge owner

from "risk signed off"
to first-line decision + second-line challenge + third-line assurance

from project governance
to operating model with issue management and action tracking

---

2. Concept Diagram

flowchart LR
  A[AI Use Case Intake] --> B[Risk Tiering and Scope]
  B --> C[Lifecycle Gate Plan]
  C --> D[First Line Product / Ops Ownership]
  C --> E[Second Line Risk / Compliance Challenge]
  C --> F[Third Line Internal Audit Assurance]

  D --> G[Control Ownership]
  E --> H[Challenge Memo / Conditions]
  F --> I[Assurance Plan / Findings]

  G --> J[Evidence Forum]
  H --> J
  I --> J

  J --> K[Gate Decision Record]
  J --> L[Issue Register]
  L --> M[Management Action Tracking]
  M --> N[Escalation / Risk Acceptance / Closure]

  K --> O[ADR and Architecture Governance]
  N --> O
  O --> P[Release / Scale / Change / Retire]

ASCII 版:

AI use case
  -> lifecycle gate
  -> first-line decision owner
  -> second-line challenge owner
  -> third-line assurance view
  -> evidence forum
  -> issue/action tracking
  -> architecture decision record
  -> release, scale, change or stop decision

三道防线不是三层审批, 而是三种不同 accountability:

---

3. Core Operating Model

3.1 Operating Model Objects

AI Three Lines operating model 不是一张 RACI 表, 至少包含十个对象:

3.2 Three Lines Role Model

3.3 Control Ownership Model

Every AI control should have four ownership fields:

Weak control wording:

Compliance signs off the chatbot.

Strong control wording:

The contact center operations owner owns the controlled rollout and answer-review workflow. Compliance challenges whether regulated-content restrictions and escalation routing meet policy. The AI platform owner produces eval and trace evidence. Internal audit may later test whether the workflow operated as represented.

---

4. Decision Rights and Lifecycle Gates

4.1 Lifecycle Decision Matrix

4.2 Decision Rights Rules

Decision rights should be written as rules, not personalities:

4.3 Decision Record Schema

---

5. Assurance Evidence Forum and Issue Management

5.1 Evidence Forum Purpose

Evidence forum 是一个工作机制, 不是审批仪式。它回答:

• Gate decision 需要哪些证据才足够。
• Evidence 是否与 claim、control、risk、architecture 和 operating process 对齐。
• 哪些 second-line challenge 未关闭。
• 哪些 issue 是 release blocker、conditional release、post-release action 或 risk acceptance。
• 哪些 architecture decision 需要进入 ADR / ARB。
• 哪些 management action 已超期、重复发生或需要升级。

Evidence forum 的标准输入:

5.2 Issue Taxonomy

5.3 Management Action Tracking

Management action must be more specific than "fix before launch":

5.4 Escalation Patterns

Escalation should be based on thresholds:

---

6. Financial Retail Scenarios

Advanced scenario notes:

• GenAI contact center: first line owns quality and operational readiness; second line challenges what happens when a response crosses into regulated advice or complaint handling; architecture governance ensures transcript, answer, source, escalation and reviewer evidence are capturable.
• AML copilot: do not define success only by analyst productivity. Gate evidence must show case narrative source support, analyst edit/approval, typology coverage and issue route for unsupported claims.
• Credit decision support: decision rights must distinguish recommendation, explanation, policy lookup, affordability calculation and final decision. The evidence forum should test whether business users understand the boundary.
• KYC onboarding: false reject, false accept and customer friction issues need separate owners and escalation paths. A single "KYC AI approved" label hides materially different control obligations.
• AI vendor model: vendor onboarding is not a one-time procurement event. Model update notice, incident notice, data use terms, fallback and exit evidence are part of lifecycle gates.
• Enterprise knowledge assistant: entitlement-aware retrieval, approved-source lifecycle and issue management matter more than generic answer quality.

---

7. Metrics / Control / Evidence Model

7.1 Metric Families

7.2 Control-to-Evidence Pattern

7.3 Evidence Sufficiency Levels

---

8. Anti-Patterns and Failure Modes

---

9. Architecture Mapping to RAG / Agent / Copilot / Eval / Governance

9.1 Reference Architecture View

Business workflow / Copilot UI
  -> entitlement and role context
  -> RAG retrieval / knowledge source governance
  -> model / prompt / policy orchestration
  -> agent tool gateway / action boundary
  -> eval and test evidence
  -> evidence collector / trace store
  -> control matrix / issue register
  -> lifecycle gate / ADR / architecture review
  -> Three Lines evidence forum

9.2 Mapping Table

9.3 Architecture Governance Integration

Enterprise architecture should make Three Lines artifacts first-class architecture inputs:

---

10. ADR Draft

# ADR-174: Adopt AI Three Lines Governance Decision Rights and Assurance Operating Model

Date: 2026-06-30
Status: Proposed

## Context

AI use cases in financial retail increasingly combine RAG, copilots, agentic tool use, vendor models and business workflow automation. Existing project governance creates evidence, but decision rights, challenge ownership, control ownership, issue escalation and assurance readiness are inconsistent across teams.

## Decision

Adopt a Three Lines AI governance operating model for medium and high-risk AI use cases:

- First line product and operations owners own business outcomes, control operation, evidence production and residual-risk proposal.
- Second line risk, compliance, privacy, security, model risk and third-party risk functions define standards, challenge evidence, set conditions, object or escalate.
- Third line internal audit does not approve releases; it provides independent assurance through audit planning, testing and findings.
- Every lifecycle gate must produce a decision record linked to an evidence packet, challenge memo, issue/action log and architecture decision record.
- Material changes to model, prompt, RAG corpus, tool permission, automation level, vendor dependency or customer-impacting workflow reopen the relevant gate.

## Consequences

Positive:

- Clearer accountability and reduced "risk signed off" ambiguity.
- Better evidence readiness for governance, audit, regulatory inquiry and incident review.
- Architecture decisions include control ownership, evidence collection and issue escalation from the start.
- Repeat issues can become reusable platform controls and reference architecture standards.

Tradeoffs:

- Gate preparation becomes more disciplined and may slow weakly evidenced pilots.
- First line teams need stronger control ownership and evidence management skills.
- Governance office must prevent evidence forums from becoming generic status meetings.
- Second line capacity must be prioritized by risk tier, not invited to every low-risk experiment.

## Review Triggers

- New high-risk AI use case category.
- Material regulatory or policy change.
- Repeat issue across three or more AI use cases.
- Internal audit finding on AI governance or evidence sufficiency.
- Major platform architecture change affecting policy enforcement or evidence capture.

---

11. Interview Answer

30秒版本

AI Three Lines governance 的核心不是多加审批, 而是把 AI 生命周期中的责任分清楚: 第一线产品和运营 owns outcome、controls and residual-risk proposal; 第二线风险合规 provides standards and independent challenge; 第三线内审 provides independent assurance, not release approval. 对 AI 架构师来说, 关键是把 decision rights、evidence packet、issue/action tracking 和 ADR 绑定到 intake、design、pilot、release、scale 和 change gates。

2分钟版本

在金融零售 AI 场景中, GenAI contact center、AML copilot、KYC onboarding、credit decision support 和 enterprise knowledge assistant 都不是单纯模型问题, 而是 operating model 问题。三道防线的价值是防止三个常见失败: 第一, 业务把风险责任外包给风险合规; 第二, 风险合规变成交付团队, 失去 challenge 独立性; 第三, 内审被拉去做 release sign-off, 失去 assurance 角色。

我的设计会从 lifecycle gate 开始: intake 确定 use case、risk tier 和 owner; design 确定 architecture、control owner 和 evidence plan; pilot 验证控制和运营能力; release 形成 first-line decision、second-line challenge memo、issue disposition 和 ADR; scale / change gate 重新验证证据是否仍然适用。每个 gate 都要有 evidence packet, 包括 control matrix、eval summary、architecture decision、open issue log、management action 和 rollback / escalation rule。

这套模式对 PM 和架构师的要求是: 不要只画 RAG、agent 和 copilot 组件, 还要画 policy decision point、evidence collector、issue register、control owner 和 gate decision record。这样 AI 项目才能从"看起来合规"变成"可运营、可挑战、可审计、可持续改进"。

CTO版本

我会把 AI Three Lines governance 作为 enterprise AI control plane 的 operating model, 而不是作为单独委员会。技术上, 每个高影响 AI workflow 必须暴露四类接口: policy decision interface、evidence event interface、issue/action interface 和 architecture decision interface。组织上, 第一线产品/运营 owner 对业务结果、控制运行和残余风险提案负责; 第二线对 policy fit、control adequacy 和 evidence sufficiency 做 challenge; 第三线通过独立 assurance 验证治理和控制是否按声明运行。

CTO 应关注三个架构问题:

1. 证据是否 by design 生成, 而不是靠上线前人工补材料。
2. control ownership 是否映射到平台能力, 比如 RAG source governance、tool gateway、approval binding、trace store 和 change impact analysis。
3. material change 是否能自动触发 gate re-review, 避免 prompt、model、vendor 或 tool permission 漂移使原证据失效。

如果做得好, Three Lines governance 会减少无效审批, 因为低风险场景走轻量 gate, 高风险场景才进入完整 challenge 和 assurance 路径。它的目标是让 AI 平台可规模化治理, 不是让每个团队都重新发明一套风险流程。

---

12. 7-Day Practice Plan

Suggested capstone:

Design the Three Lines governance operating model for an AML copilot that drafts sourced investigation narratives but cannot close alerts or file SARs.

Minimum portfolio artifacts:

• One lifecycle decision-rights matrix.
• One evidence packet index.
• One challenge memo.
• One issue/action log.
• One ADR.
• One architecture diagram showing evidence collector, policy decision point and issue route.

---

13. Source Anchors

These anchors provide governance language and operating-model structure. They do not create automatic compliance, audit reliance or production approval.