How Do You Put AI to Work Without Losing Control? | Ken Royce of TetherFox

What we talked about.

Sunny Ray sits down with Ken Royce and Matt Humber of TetherFox to explore how organizations can put AI to work without surrendering control. Royce, who came to AI from an ERP background, and Humber, whose experience spans AI governance, risk, and model risk management in regulated sectors, explain why traditional compliance processes built on spreadsheets, manual sign-offs, and after-the-fact audits cannot keep pace with autonomous, goal-seeking systems. They describe TetherFox as a single platform that sees AI activity, governs it at runtime, and extracts more value from it on the back end. The conversation covers policy as code, human approval chains that stay in place where judgment matters, and audit logs that trace agent actions to individuals and devices. They also discuss surfacing unsanctioned AI use as a signal of real demand, how the team tests its own product internally, and how new rules are proposed and reviewed rather than accepted with one click. The episode closes with a look at customer growth and a human-first philosophy.

TetherFox's Ken Royce explains how regulated companies can govern AI at runtime instead of choosing between speed and safety.

The questions, and the answers.

What is TetherFox, and what problem are you solving?

AI is moving incredibly fast, and organizations want to put it to work, but in regulated industries they can't afford to move ahead blindly. TetherFox gives them the visibility and control to use AI safely and confidently. We see it, we govern it, and we get more from it on the back end, including more intelligence and business insights.

What does broken compliance and governance look like from the inside of a real enterprise?

It is very human driven. Dozens of people may need to sign off on individual components across many risk domains, and the process leans on observability after the fact. Today it is largely manual, with spreadsheets and verbal approvals, so even a tiny change can take two or three weeks to ingest. It cannot move at the speed of AI.

Which hurts more, the number of models to govern or the speed of change?

The speed. Traditional governance documents what has happened, but AI requires governing it as it happens. Controls have to be enforced at runtime, and audit has to be available in real time so you can respond to incidents immediately, rather than waiting for a scan or a quarterly review.

What actually gets automated, and where does a human still have to sign?

We automate what should be automated and keep humans involved where judgment matters. Regulated industries already have multiple lines of defense and approval chains, and we baked that into the platform. Capabilities can be approved by first and second lines before production, and escalations can route to human review wherever an organization's policies say humans should step in.

Do you build to the strictest regulation or build for the change itself?

We build to the customer's compliance requirements and policies, then execute them as policy as code at runtime. Industry frameworks are available during onboarding, and we enforce your jurisdiction's requirements as runtime control policies. Regulators are playing catch-up and rules will change, so the platform is flexible and adaptive. We build to the speed of change.

If a regulator asked what a customer's AI agent did last Tuesday, what would TetherFox hand them?

An audit log showing exactly what the agents were doing in production, traced to the individual and the device, whether each tool or call fell within approved policies, and the chain of defense, reviews, and attestations behind it. We also show unsanctioned AI use, which is like the well-worn path across the grass that leaders should account for in policy.

Policy as code sounds great until the policy is wrong. Who catches a bad rule?

Every runtime control is proposed first and never accepted with one click. Whoever submits a rule, whether the system or an individual, needs someone else to review and sign off. We mirror the processes that already exist in regulated industry governance, risk, and compliance.