Governance & Enablement · Field note 006
The three-tier AI builder model
Organizations spend a lot of energy debating whether business users should build AI solutions at all. It's the wrong question. The better one is what kinds of solutions different builders should be trusted to create.
Three tiers, three sets of expectations
Tier 1 — Personal
Individual productivity and experimentation. Maximum freedom, minimum ceremony, clear boundaries on data and scope.
Tier 2 — Departmental
Team-level workflows. Coaching, structured review, and shared patterns instead of solo invention.
Tier 3 — Enterprise-grade
Business-critical solutions. Full engineering discipline: testing, security review, ownership, and lifecycle management.
Why the tiering matters more than the rule
A single blanket policy — everyone can build anything, or no one can build anything without engineering involved — fails in both directions. Too permissive, and business-critical logic ends up running on someone's personal automation with no owner. Too restrictive, and the organization loses the genuine value of subject-matter experts building their own tools.
The value of a tiered model is that it matches governance to risk instead of applying one setting to every builder. People get the freedom appropriate to what they're actually building, and the organization keeps confidence in the outcomes that matter most.
A path for growth, not just a fence
- AI consumer
- Personal builder (Tier 1)
- Guided department builder (Tier 2)
- Professional AI builder (Tier 3)
The model doubles as a talent pipeline. Employees can move from consumer to practitioner to builder to champion over time, which gives the organization a growth path instead of a hard line between "business users" and "real engineers." Publishing rights — the ability to share a solution beyond its creator — should require stronger controls than experimentation rights at every tier.
Questions worth asking
Where the tiers get tested
Where should responsibility shift as a solution graduates from Tier 1 to Tier 2 to Tier 3 — and who decides it's time? What training belongs at each level, and how much of it should be mandatory before someone is allowed to move up a tier?