Governing generative AI in organizations: a design theory and quasi-experimental field study of sociotechnical guardrails

Abstract

Generative AI adoption has outpaced organizational governance capabilities. We conceptualize AI guardrails as sociotechnical governance mechanisms, comprising policy, technical, and workflow components that embed organizational norms in deployed AI systems. Extending norm-based coordination accounts, we specify three mechanisms (norm encoding, output monitoring, and escalation) targeting four properties: predictability, fairness, safety, and auditability. We instantiate the theory in a three-layer artifact at a Fortune 500 firm and evaluate it through a stepped-wedge quasi-experiment covering 20 teams, 28 weeks, and 10,200 interactions. Guardrails reduced interaction entropy by 35%, narrowed the fairness gap from 0.18 to 0.05, halved hallucinations, and raised audit-trail completeness from 53% to 96%, at a 12% task-time cost and a temporary satisfaction decline. At least 35% of teams circumvented guardrails perceived as opaque or disproportionate, identifying perceived legitimacy as a boundary condition. Analysis of nine US executive orders (2019–2025) yields design implications for regulatory resilience.