Role tracks

No organization adopts AI as one crowd, and a large regulated one least of all. A chief information officer (CIO) adopts it through funding and risk appetite. A developer adopts it through a coding agent and then by building AI features into products. A production support engineer adopts it at three in the morning, during an incident. One common ladder cannot describe all of that, so this chapter gives nineteen role tracks, each written to the same template. Every track opens with your first steps and ends that section with the fully adopted workflow: how the work runs at Stage 4 to 5 and what changes for the organization.

Treat each track as a starting shape: rename the roles to match your org chart and tune the steps to your own workflow.

1. Start from what you need to do

2. From requirement to production, every role on one path

AI does not wait for full adoption to reach production. At Stage 1 every change still reaches production through the normal process; AI only helps people draft. What adoption changes is how much of each step agents do, and how much evidence surrounds it. The accountable decision at each step stays with the same role.

3. In any organization

The tracks are written for a large regulated organization because that is the hardest case. A smaller or unregulated organization follows the same order with fewer people and lighter paperwork.

What never scales down: no customer or secret data in unapproved tools; the requester of an agent task never approves it; a kill switch for anything that acts on its own; a human in command of incidents.

4. Two kinds of adoption, on every track

The ladder stage describes the controls, context and evaluation around a use case. It is not seniority, and it is never permission to hand an accountable decision to an agent. Every track names at least one activity that stays human-operated even at Stage 5.

5. Decision relationships

"Who approves" is too coarse once AI is in the work. Every track uses five relationships.

6. Nineteen tracks in eight families

Families follow the lifecycle. The badge on each track shows its line of defense: 1st line delivers and owns the risk, 2nd line sets standards and challenges, and internal audit (the 3rd line) assesses independently.

Lead

Shape

Build

Data & platform

Assure

Release & run

Govern

Adopt

7. The common template

Every track uses the same fifteen sections in the same order, so a reader can compare roles side by side.

8. Separation of duties, in one table

An agent is never an approver. When an agent does the work, the person who delegated it is the requester, and the approval goes to someone else with the existing authority.

9. Internal audit: the third-line interface

Internal audit is not a track and not part of the second line. It receives evidence (the AI inventory, control design, validation reports, change records, monitoring and exceptions) and independently assesses whether governance works. It never approves a first-line release and never designs controls for management. The risk and compliance and executive sponsor tracks show the interface in detail.