Eric Housh
Welcome back to AI in Action, the show for business owners and leaders who are serious about putting AI to work for their companies. I’m Eric Housh. Joining me, as always, is Zack Terry, our director of AI here at Fast Slow Motion. Zack, good to be back.

Zack Terry
It’s good to be here. It feels like just yesterday we were in the studio recording a podcast, and here we are again.

Eric Housh
Yeah. Imagine that. So, what are we talking about today?

Zack Terry
Well, I think it’s something that we’ve mentioned several times, and I think it’s worth its own discussion, and that is governance in the context of AI applications. We’re gonna be talking about Claude specifically today, but these concepts will apply to really kind of any AI tooling, AI platform, AI application, whatever it is that you might be using. These concepts can expand beyond just Claude, but that is what we’re going to be talking about today: governing Claude, the tools that Claude has to offer when it comes to governance and rolling this out to your team, and how to do that effectively and safely, and understand what sort of the levers do when you’re administrating Claude and rolling that out to your team.

Eric Housh
Yeah, and I think governance is one of those words people hear and it just sounds big. It sounds like this is for big businesses; this isn’t, I don’t have to worry about this. But it’s not just for big businesses. It’s any business using Claude, any business using AI — they have some pretty big decisions to make: what data goes in, who has access, what controls are in place, how you evaluate risk. So that’s where we’re going to dig into today: we’re just gonna talk about all those things.

Zack Terry
No.

Eric Housh
In the context of AI and Claude, and hopefully give some folks some food for thought.

Zack Terry
Yeah, when I hear the word governance, I typically think Fortune 500, enterprise, large business, but it’s really just about understanding how things are used and who can use them and how you can audit and report on it. So it doesn’t have to be this big, scary word. It’s really just about having a handle on what’s going on at your organization.

Eric Housh
Yeah, so stay there for a minute — when we talk about governance in the context of Claude, what are we actually talking about there?

Zack Terry
So it’s really a set of decisions and controls that determine how an AI tool like Claude can operate within your business. So that’s going to cover things like who can use the tool, for what purpose can they use the tool — so things like acceptable use policies: what you should put in it, what you should make sure that you’re not putting in there, what data you’re permitted to bring into that conversation. It’s visibility and how it’s being used across the organization. And so an example that we talk about a lot is: do you have a central platform, like a Claude Teams or Enterprise plan? Or do you have a bunch of individuals that have signed up for Claude or ChatGPT or Gemini separately, probably on your corporate email address, and they’re just using it on their own, but there’s no real central platform governing that entire process? So that’s another thing to think about. And then it’s also how do you respond when something goes wrong? So it’s really the same type of thinking that you would apply to any business-critical tool. Obviously, we’ve been in the CRM business for a long time, and so when we think about governance from the CRM, it’s the same type of thing, right? It’s the security posture. It’s how you know who is going into your systems and what data they’re able to access and how you can actually report and audit on what’s going on. The difference here with AI, though, is just how quickly it has proliferated and gotten into the hands of really everybody. Now, so not just employees, but individuals that companies are probably using their own plans for their own things, in addition to whatever they’re using to actually do business and do their work at your organization. So even if you haven’t adopted a central tool, they’re probably already using something, right? And so the idea here is to make sure that you’re understanding how these tools are being used across the business. You have a central platform like Claude Enterprise that is the accepted tool, as opposed to allowing — or it really doesn’t even come down to allowing. It just comes down to: if you don’t have that sort of central tool where you are encouraging and allowing access, people are probably going to use it elsewhere. And that’s what we call kind of shadow IT or shadow AI use. And so that’s really what it comes down to, right? Is that sort of centralized location where you are able to manage the tool and understand how people are using it.

Eric Housh
And the businesses out there that are getting this right — it sounds like that’s a critical thing, right? That central tool, that central understanding. And then just the conversations with their teams, right?

Zack Terry
Definitely. And I think it’s important to mention that we’re really early in this still, and so people are still figuring this out, right? We have a really good idea of what some best practices kind of look like, but none of this is really — this is the rule, right? We’re all kind of figuring this out as we go. So the businesses that we see that are most successful at this today are the ones that are being very thoughtful in how they approach rolling this out to their teams. And so that is spending time with each team, walking through how they’re using AI, what they’re doing to ensure that it’s the most effective, ensuring there’s a shared understanding of ownership around what it produces. And so we kind of have this saying at Fast Slow Motion, where if somebody uses Claude to help produce something, maybe they’ll say, “Hey, Claude built this for me.” It’s like, no — you built that with Claude’s help, right? And so you own it as the individual, as the human that’s involved, in however much you’re in the loop, right? But you’re ultimately still responsible for it. And so having that sort of communication around making sure that the responsibility still aligns with the people producing the work, whether they’re using AI to produce it or not — and it doesn’t even really matter at what level. It could be a very small amount, it could be the entire thing. It doesn’t matter. Ultimately, you’re still the one responsible for that output, right? So that’s another thing that we see is commonly an attribute of companies that are doing this well. And I think it’s just about making deliberate decisions about how these tools can fit into the business operation before it’s at scale, right? So it’s thinking about this before it becomes a problem. It’s being intentional and transparent.

Eric Housh
Yeah, absolutely. Let’s talk for a minute, Zack, about the guardrails, the controls. What’s available in Claude Enterprise from a control standpoint, and what decisions do those controls require of you?

Zack Terry
So the short answer is there are a lot of controls. We’re gonna talk about a lot of them today. I’m not gonna get into the weeds on any of them, but just know that this is also evolving very quickly. And so just a couple of weeks ago, there’s a feature that I think is really important, but Claude didn’t have it — but now it does. And so that’s the ability to essentially manage role-based permissions, right? And this is changing so rapidly that by the time you’re listening to this, there may be a lot of other security controls and features besides what we’re going to mention today. So just keep that in mind — make sure to go and check out the latest updates. But Claude Enterprise specifically is going to give you more control over how your data is treated. So by default, your data is not going to be used to train Anthropic’s models, and that is a contractual obligation with your organization when you get on Claude Enterprise. Now, obviously, all this is subject to change at any time, so always make sure you’re reading the fine print. But that is one of the biggest draws to Claude Teams and Claude Enterprise — that contractual agreement that they’re not going to train their models on your business data. You can also review their data processing documentation. Let’s say you’re in a regulated industry, you may be able to get a data processing agreement — if you’re in healthcare and you need a BAA for HIPAA or for any other reason. Most of their products can offer that at the enterprise level, with the exception of Cowork. So Cowork does not offer a BAA right now. However, if you’re using Claude Chat or you’re using Claude Code, those are offered at the enterprise level. So I think the main thing there is it doesn’t mean that you’re handing off governance to Anthropic. It just means you have a documented baseline to work from. So it’s tools to help you make decisions about what’s appropriate for your business. So beyond the contractual obligations, you’re also going to get a lot of access and usage-based controls. So, as an administrator in Claude, you can take advantage of centralized administration, centralized billing. It allows for really easy onboarding and offboarding. So you can even use single sign-on and SAML or SCIM for automated user provisioning. You can essentially define who in your organization has access to Claude. I mean, it’s very much like a platform, right? It’s adding people to have seats, and then you’re managing their usage, which is also really important because it gives you the ability to monitor that variable cost, that consumption, that usage across the entire team. And you can set spend limits both at the organization level as well as the individual level. So you can say, “Hey, as an organization, we are not going to spend more than this amount per month, and these ten people on this team, they each have this amount per month.” So maybe that’s $100 per month for an individual. And what’s nice is those individuals — maybe they’re getting a lot of use out of it — they can also ask an administrator to increase that limit if they need it in a given month. But the administrator still has control. They can go and say, “Okay, let’s make sure you’re using it effectively and not just token-maxing and using as many tokens as possible,” right? And so that’s another really good control that you have within the system. And you can set usage policies that can govern what kind of tasks and data are in bounds and acceptable for use. And then beyond that, you get the ability to connect to certain services at an organization level, so controlling access to certain connectors. So let’s say that you’re a Google organization and you want to enable your entire team to connect with Google Drive, you can set up that connector at the organization level, and then they can easily sign in using their Google credentials, and then now their Claude has access to that data. And again, very important — at what level should Claude have access? Well, of course, it’s going to be controlled by that user’s ability, but you can also control specific tools within those connectors. So if you just want your organization to be able to read information from Google, or even Salesforce, right — you can connect to Salesforce via a Salesforce-hosted MCP or a custom MCP. You have a lot of fine-grained control over each individual tool and what you want to allow access to. And on Enterprise, that can be both at the organization level and the group level. So you can have certain groups that have the ability to do certain things. But that’s key, because I know for us, we tend to recommend — specifically when you’re working with Salesforce or HubSpot and Claude — not to start with the full suite of capabilities. Start with read-only and get a sense for how it works and the data that it can pull, and how much value you can get out of it without having to write back to the system. And then there are certainly use cases where that is beneficial, but from a risk management perspective, we usually recommend you start with read-only, get a feel for it first, and then you can expand beyond that. So I think that’s a pretty good overview. Obviously a ton of levers that you can pull, a lot of administrative controls, and these capabilities are growing sort of every release that Anthropic puts out. So I would not be surprised to see additional controls and capabilities come out on a regular basis.

Eric Housh
And I think the point is, Zack, there’s a lot to ingest there. I think that’s where businesses need help — not that it’s overly complicated, but you gotta have somebody sit down and talk you through it, right?

Zack Terry
Yes, and it’s exactly what you said. It’s not because the tech is complicated — I mean, the underlying tech is, but using it doesn’t have to be that complicated, right? So it’s ultimately decisions that require someone to sit down and actually make them, right? You’ve gotta take the time to make the decisions. And that, I think, is the harder work — which is understanding your model, understanding your risk, understanding where your data is and who should use it and how it should be used, and really codifying that and then applying that to these tools and how they’re able to access and work with that data.

Eric Housh
You said a word that caught my attention there — risk. Let’s stay on risk just for a second, because I would imagine this is where a lot of business leaders get stuck. They know there’s risk, but they’re not sure what to do with it, how to evaluate it. That uncertainty becomes a reason not to move at all.

Zack Terry
Agreed. And I think there’s a misconception that not moving at all is the safe option. And I’ve mentioned this on this show before — I don’t know if it’s AI in Action or if it was on the Fast Slow Motion podcast — but Sam Donegie, who used to run some of these podcasts, always asked guests, “Hey, what’s one quote that’s always inspired you?” I had a college professor who said this, and it’s, “No decision is a decision, and it’s usually the worst decision.” And so the idea there being, look —

Eric Housh
Yes.

Zack Terry
You can get analysis paralysis and wait around and try to say, “Okay, I’m gonna wait until I have just enough information to make that decision and be certain about it.” But that’s probably never gonna come. You’ll probably never arrive at that point, and in the meantime, you’re gonna lose out, right? And so I say all of that to say, I get it that this is a brand-new technology, it’s a new paradigm, there’s risk involved everywhere — but I think not doing anything is a big risk in and of itself. So the businesses that don’t take the time to develop a governance framework for AI — you’re not really avoiding risk, you’re just leaving that decision unmade, which will create its own problems down the road. So, that said, the way that we think about risk evaluation for most of the businesses that we work with, which typically are going to be in the small-to-medium-sized business, growing-business space — but we do work with some larger organizations, but keep in mind that’s kind of the frame we’re looking at here — it really could start with your data, right? What kinds of information does your business work with day to day? Client names, contact info — that’s different than things like protected health information. It can be different from proprietary financial information. So not all of it carries the same risk profile. There’s descriptive data, but then there’s personal data, there’s identifying information, there’s sensitive financial information, maybe it’s healthcare information. You want to understand that landscape, right? Because you don’t want to make a mistake where that data is getting put into a model and getting trained on, or where you have an agreement with a client, and you put it into a third-party system, but your agreement says that you can’t. You want to make sure you understand that entire landscape when you’re thinking about these policies. Then you want to think about what these AI tools can do. So if we’re talking about Claude, think about what you’re asking Claude to do. There’s a big difference between asking it to draft an internal communication and using it to actually process client records. So the use case really defines the level of risk. We want to start with the lower-sensitivity workflows and build from there. And we just talked to a guest yesterday about how important it is to evaluate the business use case from the perspective of the customer. And so really asking the question when you’re looking at implementing AI at any point in the business: does this better help me serve my customers? Will my customer get a better experience out of this? Because if the answer is no, it’s probably not the best place to apply your resources and your time and your effort and your money toward that type of thing, right? So really be thinking about how this actually helps the business and how it helps you serve customers, because there’s no business without customers, right? And then, finally, you want to understand that industry context. And this kind of goes back to some of the compliance pieces — if you’re in healthcare or financial services, you have regulatory obligations that are going to shape what governance actually means for your business. So if you’re in one of those organizations, it’s going to be a different type of math than if you’re just in professional services or manufacturing, right? Governance is not necessarily a one-size-fits-all approach. It’s going to be different from business to business and different from industry to industry, depending on all of those variables.

Eric Housh
And I think that’s where technology partners like us really can add value, because you unpacked a lot there. A lot of business leaders don’t really want to walk through that analysis alone. They want somebody that’s kind of seen a little bit more than they’ve seen.

Zack Terry
Definitely. The governance framework — I think it doesn’t have to be complicated, but it does require someone who’s done this across different businesses, different contexts, to really help you see what you’re not seeing. It’s one of those things where you don’t know what you don’t know. And I think that’s the value of a company like ours, that have worked with thousands of businesses across dozens of different industries. It can really just come down to knowing what questions to ask.

Eric Housh
Let’s talk for a minute, Zack, about when things go wrong. What does a business with good governance in place actually look like in that moment versus one that doesn’t?

Zack Terry
The big thing to think through there is preparation. I think I said “being proactive” earlier, but it’s all about preparing. So it’s not about if something goes wrong, it’s when something goes wrong. So taking a posture of “we know that we will have to address this in the future” — not this sort of thing you can kick the can on and say, “Well, we’ll address it when it happens.” Make the assumption that something’s going to go wrong so that you can set yourself up for success in the event that that happens. And so that means having a clear picture of what data is being worked with, documenting policies that define what is and is not permitted, having access logs and auditability that can show you what happened and when it happened, a team that’s been trained on the boundaries and understands acceptable use, and, of course, having those compliance guardrails in place as well. So, all that to say, when something goes wrong, that means you can diagnose it quickly, you can respond clearly, and you can make changes that can address the root cause as opposed to the symptoms. But if you haven’t done that work up front, then you’re gonna be under pressure. And rarely are good decisions made under pressure, right? You’re trying to understand your system in the middle of a problem. You don’t even have a blueprint to understand what you’re supposed to do in a crisis situation. I think that’s where things become pretty hard to manage. And so having a lack of a governance foundation in a situation like that makes it extremely difficult to respond in the moment. So what I’m not saying is try to predict every possible scenario — I mean, we cannot do that — but it’s important to think through some of those macro-level risks and what could happen down the road, and just put a plan together. It doesn’t have to be perfect, but it just has to be thought out ahead of time, so that when you run into that problem, it’s not a surprise. You’re not caught off guard, and you’re not trying to make up that blueprint in the moment.

Eric Housh
Yeah. The risk isn’t really in the tool. The risk is in how you put it together, how you implement it.

Zack Terry
True for any system — Salesforce, HubSpot, any platform that touches your business data. The tool operates within the boundaries that you set, right? It’s up to you to set those rules and to make sure that you are using the tool correctly. And a lot of that — you’ll hear Salesforce talk about this as the shared responsibility model, right? Salesforce is responsible for its engineering and its capabilities, but you’re responsible for who has access and how well you actually control that access, right? That’s true for these AI tools, and it’s true in an even different way, because it could hook up to data autonomously in some cases. So you gotta make sure that you’re setting those things up really well and really documenting what your entire landscape looks like, where all these tools are touching data and working with individuals at your company.

Eric Housh
Let’s stay there for a minute, because I want to make this concrete, and I want people to be able to really digest this — for the business leaders that are listening thinking, “Man, we gotta get this right,” what does it look like? Where do they need to start?

Zack Terry
So, four things — and this is not comprehensive, but just a starting place, right? These are some things that I would immediately think through. The first is data classification. Understand the categories of data that you have at your organization. Understand which categories of data are appropriate to bring into an AI workflow and which are not. This doesn’t have to be a massive project, but just a simple sort of tiered framework to give you something to work from in terms of acceptable, not acceptable. You can get a lot more detailed — certain platforms, like Salesforce, even have this built into their data model, where you can classify each individual field and the data in there. And that can help you as a team understand what is acceptable to use and what isn’t. You can get really deep into that, but just to start, start classifying things in a simple way — just understanding what data is okay to use and what isn’t, right? And then there’s a usage policy, and that sounds similar to data classification, but this is more about people. This is a people problem. So this is making sure that your people understand what is and is not acceptable to use. Data classification can help with the usage policy, because if there’s something unclear about whether this piece of data should be used or not, classifying it can certainly help with that decision. But how you use it is ultimately up to the individual that’s working with the tool. So codify and document and write down what should be used and should not be used — for example, just a clear, practical set of guidelines that your team can actually follow. What’s in scope, what’s out of scope, what should they do if they’re not sure. At Fast Slow Motion, this is a really simple framework for us — it’s just kind of like a traffic light model, right? It’s green, it’s yellow, it’s red. If it’s green, it means absolutely — you don’t even have to think about it, this is acceptable, internal documentation, sure. Red is: under no circumstances should you ever put this into the LLM. And yellow is, well, if you’re not sure, ask. Get somebody involved — get somebody in the organization that is creating these policies and understands the risk landscape to come in and weigh in on it. So those are two. The third one is access and admin controls. We talked all about this at the beginning of our conversation, but setting up your tool — if it is Claude, it is Teams or Enterprise — making sure that the right people have access, that you have visibility into how it’s being used. And the important thing is this is not just a one-time setup. This is an ongoing process. It is important to regularly review access and capabilities. This should just become a part of your security rhythm, right? Making sure that everything is up to speed. So this is not a “set it and forget it.” You’re not going to do this tomorrow and then not look at it again for six months. This needs to be something that happens on a regular basis. And then, finally, is team training. So your governance framework is only as good as your team’s understanding of that framework. A simple 30-minute conversation about what good usage looks like can go a very long way. So it doesn’t have to be complicated, but it does have to be intentional. And I think we all understand that it’s easier to do this at the beginning rather than to try to retroactively adjust it after you’ve already scaled usage across the organization. So, to recap: classifying data,

Eric Housh
Mm-hmm.

Zack Terry
having a usage policy — what’s acceptable and what isn’t — making sure that you are making the regular review of your access and admin controls a part of your rhythm, and then training up your team on how to use it well.

Eric Housh
And not to sound like a commercial, but this is our wheelhouse. These are the conversations we’re having with business leaders every day, right?

Zack Terry
Exactly. Yeah, we love having these conversations. We’ve implemented all of this internally for ourselves. We are doing this for clients today. And I think our goal is: if we can help you not run a red light — you know, something that we’ve run in the past that we got a ticket for, right, and we had to go pay that ticket — we would love to help you not get a ticket and run that.

Eric Housh
So what do they need to do this week, Zack?

Zack Terry
Yes — if you’re listening and you’re not sure what governance means or where your governance policy stands, and this could be, maybe you’re evaluating an AI tool, or you’re looking at Claude for the first time, maybe you’ve already rolled it out but you just want to make sure you’ve got the right things in place — that’s where we’d love to have a conversation with you, right? You can go to fastslowmotion.com/AI, and that link will be in the show notes as well, but just reach out to us and drop us a note. We’ll set aside some time, we’ll talk through your specific situation, what you’re working with, what your goals are, and what you’re trying to accomplish, and help inform you on what good governance looks like. And that’s really the starting point, but we’d love to have a conversation if this is something you’re thinking about.

Eric Housh
That’s a perfect, perfect place to end it. The good news is — you said this earlier in the show — it’s not a heavy lift to get it right, you just have to be intentional — one of our favorite words. So again, that link, fastslowmotion.com/AI — you’ll find all of our episodes of AI in Action there, along with some other resources, and of course ways to connect with our team. We’ll see you next time on AI in Action.