The Guidelines
Six judgement calls the framework cannot make for you, each written around the failure it exists to prevent.
A gate definition tells you what evidence is required. It does not tell you whether the evidence is any good, whether the oversight it records is real, or whether the whole apparatus is proportionate to what you are governing. These guidelines cover the judgement between the requirement and the practice.
All six carry the framework's [Practice recommendation] status: advice from this documentation, not requirements of IRGF. They are collected here rather than scattered so that the distinction stays visible, and so that disagreeing with one does not mean disagreeing with the framework.
Scoring risk consistently →
Running a scoring session, anchoring judgement, the countersignature control, and the gaming vectors that survive it.
Evidence that holds up →
What separates evidence from documentation, when attestation is acceptable, and how to write records that survive being read by someone hostile.
Oversight that is real →
Automation bias, override-rate instrumentation, symmetric friction, and designing an intervention point that actually intervenes.
Procured and embedded AI →
Routing intake on AI content, the questions vendors can answer, capping tiers you cannot evidence, and concentration as a portfolio property.
Generative systems and retrieval →
Prompts as configuration, grounding as architecture, evaluation that is not a demo, and the failure modes specific to retrieval.
Keeping governance proportionate →
The friction budget, what to automate, what to delete, and how to tell over-governance from under-governance before the estate routes around you.
Using them
Each guideline is written to be read once by the person setting up a process, and then used as a reference. The structure is the same in each: the failure it prevents, the practice, what to do when the practice is impossible, and how to tell whether it is working.
The last of those matters most. Every guideline names a signal that shows it is failing, because a practice with no failure signal is a belief.