Boards do not need to dictate technical solutions. They do need to ask questions that force the important choices into the open.

Deb Henretta has spent decades on that problem—across consumer brands, digital transformation, and boardrooms. What follows begins with her perspective on the questions boards should be asking about autonomous AI.

"An effective board member leads and influences by asking the right questions versus dictating solutions."
— Deb Henretta, Korn Ferry, 2021
Perspectives from Deb

On strategy and value creation

  • How does AI align with our core business model? Ask management whether AI drives real revenue, reduces operational costs, or fundamentally reshapes the product offering—rather than being deployed for the hype.

On risk and human oversight

  • What are the risks for the business associated with AI use? Understand where exposure sits—financial, legal, reputational, operational—and whether the risk profile is explicit and owned.
  • What is the competitive consequence of not moving forward—or not moving fast enough? Inaction carries its own risk; the board should weigh the cost of delay alongside the cost of failure.
  • What consequential decisions, if any, are made by machines? Identify where automation makes high-risk choices—hiring, pricing, credit, contracting—and what specific thresholds mandate human intervention or override.

On outcome delivery

  • How do we measure true impact on the business? Reject vanity metrics like the number of active pilot projects in favor of hard evidence tied to productivity, margins, or customer outcomes.
  • What specific evidence would cause us to kill a program? Clearly define the threshold triggers or failure criteria to abandon underperforming or risky AI initiatives.

On governance and verification

  • Who is individually accountable for AI exposure, spending, and outcomes? Ensure a specific executive owns each major AI initiative, application, or risk category—avoiding vague, shared responsibility.
  • Is the underlying data clean, secure, and legally cleared? Confirm the organization has the explicit ethical and legal rights to use, license, and reuse the data feeding its models.

The framework below is how the Proverify.ai team addresses these concerns—distilling the questions raised by Deb and our client design partners into three board lenses and five operating rules, each specific enough to state in one sentence, enforce in practice, and prove with evidence.

Three board lenses

Money. Authority. Evidence.

The five rules turn strategic value, business risk, human oversight, accountability, and verification into operating tests management can state, enforce, and prove.

Money
01

What value are we buying?

Authority
02

What may AI decide or do?

Evidence
03

Can we prove it?

Board standard: if management cannot state the rule clearly, show how it is enforced, and produce the evidence, the rule is not board-visible.

The 5-Rule Board Check

Name the bet → Set the threshold → Set boundaries → Require human approval → Show the evidence

Rate what the board can verify today. Treat "Unknown" as a gap and ask for evidence, not assurance.

0 of 5 assessed · 0 clear · 0 to discuss
01

Money

What value are we buying?

Board question: Why this AI, why now, who owns the outcome, and what would make us invest more—or stop?

Board lens: AI spending should behave like capital allocation. Every material bet needs a business-model rationale, one accountable executive, and a measurable funding gate. Moving too slowly can be a strategic risk too.
BETName the bet
State the business outcome, why it matters now, and the executive who owns it.
The value case should be explicit: revenue, cost, product advantage, customer outcome, or competitive position—not AI adoption for its own sake.
Ask to see: the one-page value case, including the named executive owner.
GATESet the threshold
Define in advance the evidence that changes the investment decision.
Use hard business outcomes—productivity, margin, revenue, customer results, risk reduction—not pilot counts or activity metrics.
Ask to see: the metric, threshold, review date, and explicit expand / redesign / stop criteria.
See the control card: Money

We are investing $4.2M to automate customer onboarding.

$4.2MAI investment
$85Current cost per completed onboarding
$28Target cost per completed onboarding

Fully loaded cost per completed onboarding falls from $85 to $28, including AI, systems and human review. Expansion occurs only if completion, quality and unit economics hold at scale.

Board artifact to request: investment, baseline, target, accountable owner and the next explicit funding gate.

Proverify control: TokenOps makes the economics visible.

02

Authority

What may AI decide or do?

Board question: Which consequential decisions are delegated to machines, what is prohibited, and when must a person retain or retake control?

Board lens: risk becomes governable when consequential machine decisions, hard prohibitions, and human-intervention thresholds are explicit. Higher autonomy should mean clearer boundaries—not vaguer accountability.
BOUNDSet boundaries
State the decisions and actions AI may take autonomously—and the ones it may not.
Be explicit about consequential choices such as hiring, pricing, credit, contracting, payments, or other actions with material financial, legal, customer, or human impact.
Ask to see: the authority matrix, exposure limits, and technically enforced prohibited-action list.
TAKEOVERRequire human approval
Define exactly when control must pass to a person.
Triggers should be tied to observable conditions such as uncertainty, risk level, dollar exposure, legal sensitivity, customer impact, or irreversible consequence.
Ask to see: the takeover thresholds, named human owner, and evidence from a real handoff or override.
See the control card: Authority

Example: customer support — cancel order?

RunTime checks live order state and cancellation policy before an autonomous action is permitted.

Order placed→ Not shipped→ Within policy→ Cancel order

Outside approved policy — for example, already shipped, missing information or outside the cancellation window:

Escalate to human

Board artifact to request: permitted actions, prohibited actions, preconditions, escalation rules and the accountable owner of those boundaries.

Proverify control: RunTime controls operational authority.

03

Evidence

Can we prove it?

Board question: Can management prove the system was entitled to act, the underlying data was fit for use, and what actually happened?

Board lens: evidence starts before execution. Data should be clean, secure, and legally usable; authority should be approved; consequential actions should remain reconstructable afterward. Sample a real decision, not another policy presentation.
PROVEShow the evidence
Prove the data, authority, action, accountability, and outcome end to end.
That includes data quality, security and usage rights before execution; the approved operating rules; a reconstructable decision trace; and review of exceptions afterward.
Ask to see: one consequential decision from source data and approval through action, owner, outcome, and exception review.
See the control card: Evidence

Example: promotion execution — apply 20% to a $1,200 order?

RunTime validates eligibility, exclusions, stacking rules and dollar-impact limits. VERIFY makes the resulting decision trace reproducible.

  • The customer was eligible.
  • The SKU was approved.
  • The promotion was active.
  • Promotions were not improperly stacked.
  • The financial impact remained within the authorized limit.
  • The resulting transaction and customer outcome were recorded.
1Facts observed
2Policy version
3Rule applied
4Action taken
5Result & outcome

Board artifact to request: a replayable decision record containing the observed state, policy version, applicable rule, authorization, action and resulting outcome.

Proverify control: VERIFY establishes whether the autonomous system is enforceable, reproducible and operationally fit.

Your next board agenda

Mark the five rules. Anything Partial or Unknown becomes a question for management.

No assessment yet
No gaps identified yet.

Name the bet. Set the threshold. Set boundaries. Require human approval. Show the evidence. Money determines why AI deserves investment. Authority determines what it may do and when humans take control. Evidence proves the rules were real.

We have seen this problem before.

Long before autonomous AI, automotive engineers had to answer a deceptively simple question: who is driving?

The NHTSA/SAE Levels of Driving Automation made the answer explicit. At lower levels, software assists while the human remains responsible. At Level 3, the system drives under defined conditions but may return control to the human. At Level 4, the system can operate without human intervention—but only inside a defined operating domain. Level 5 removes even that boundary.

The important idea was never that every vehicle should reach Level 5. It was that greater autonomy requires clearer rules about authority, boundaries, intervention, and evidence.

Enterprise AI now presents boards with the same problem.

An AI system that recommends a customer refund is different from one that issues it. An agent authorized to purchase $500 of supplies is different from one authorized to negotiate and execute a $5 million contract. Increasing capability does not automatically justify increasing authority.

That is what the five-rule check is designed to expose: what value is being bought and who owns it; what evidence expands, redesigns, or kills it; what AI may and may not do; when a human must take control; and whether management can prove the data, authority, action, and outcome.

Sources. Deb Henretta on board leadership and asking the right questions: Korn Ferry, 3 Nov 2021. Deb Henretta on beginning digital transformation with big business questions: LinkedIn, 11 Jul 2018.

Related Proverify thinking

← Back to thought leadership