The AI Driver's License

Let People Earn Tool Access

Let People Earn Tool Access

Most AI acceptable use policies are written like a sign on a door. They list what is forbidden, name a few approved tools, and ask employees to confirm they have read the page. Then everyone goes back to work and does whatever gets the job done. The trouble is that a sign can only say yes or no. A yes-or-no policy tells people the rules. It does not tell you whether anyone can follow them, and it gives the people who can no way to earn more. There is a better model, and every adult in your company has already been through it. We do not ban cars because some people drive badly, and we do not hand the keys to anyone who asks. We license drivers. You prove you can operate the vehicle safely, you get the right to drive, and higher-stakes vehicles require a higher-stakes license. Voltage Control recommends governing individual AI use the same way. Instead of a yes-or-no AI acceptable use policy, issue an AI driver’s license: a short, practical test that unlocks tiers of access, from sanctioned tools on everyday work, to customer data, to building agents that act on their own. Design it well and something counterintuitive happens. Shadow AI comes above ground, because the legitimate path finally becomes faster than the workaround. It is the same logic we laid out in Govern AI Like You Hire: access grows as trust is earned.

A Policy Without a Test Is a Hope

The gap between written rules and real behavior is not a guess. The University of Melbourne and KPMG surveyed more than 48,000 people across 47 countries. Only 40 percent of employees said their workplace had a policy or guidance on generative AI use. Almost half admitted to using AI in ways that contravene company policies, including uploading sensitive company information into free public tools. And 57 percent said they hide their use of AI and present AI-generated work as their own. More than half of employees are using AI out of sight. A sharper paragraph in the handbook will not fix that. It is a trust problem, and the handbook is part of why it exists. The cost of that invisibility is now measurable. IBM’s 2025 Cost of a Data Breach research found that one in five organizations reported a breach due to shadow AI, and that organizations with high levels of shadow AI saw an average of $670,000 in higher breach costs than those with little or none. Only 37 percent had policies to manage AI or detect shadow AI. We have already made the case in this series, in “Governance by Lockdown Is Not Governance,” that blanket restrictions push AI use underground. The question here is different. Once you decide to let people in, how do you decide who gets in, to what, and on what evidence? An acceptable use policy cannot answer that on its own. It describes the road. It says nothing about the driver.

What a License Actually Does

Here’s what makes the driver’s license such a useful frame. It is not a training program, and it is not a ban. It is a small, legible system that does three jobs at once. It checks skill, not attendance. Nobody gets a license for sitting through a lecture on traffic law. You have to show you can drive. It grants privileges in tiers. A learner’s permit, a full license, and a commercial license each unlock a different class of vehicle, and each one asks more of you. It creates a record. The state knows who is licensed for what. That visibility is the quiet reason the whole system works. Most organizations have a policy, which is the rulebook, and some have training, which is the classroom. Almost none have the test, the tiers, or the record. The license is the missing piece that connects the rulebook to real access.

The Test: Three Questions That Actually Reduce Risk

A good AI license test is practical, short, and done on the person’s own work. It should feel like a road test, not a written exam. Three questions sit at the heart of it:

1) Can you get a useful result? The candidate takes a real task from their own role and uses a sanctioned tool to produce something they would actually ship. This checks the skill that makes AI worth using at all: framing the request, giving context, and knowing when the output is good enough. 2) Can you catch a fabricated one? The candidate gets an AI output with planted problems, such as a citation that does not exist, a number that does not add up, or a confident claim that contradicts the source document. Their job is to find them. This is the skill most training skips, and the evidence says it matters most. In the same University of Melbourne and KPMG study, 66 percent of employees said they rely on AI output without evaluating its accuracy, and 56 percent said they have made mistakes in their work due to AI. We heard the same thing from the other side of the table at an executive dinner this summer. A leader from a global professional services firm described an internal AI enablement session that drew the largest training turnout anyone there could remember. What followed was a wave of polished output that nobody had properly checked. The room named the missing capability in one word: evaluation. Training raised enthusiasm. It did not raise judgment. 3) Do you know what never goes into a prompt? The candidate sorts a set of realistic examples, such as a customer email with account details, a draft board memo, a public press release, or a spreadsheet of salaries, into what is safe for which tool. This is where your acceptable use policy finally earns its keep. The test turns abstract data classifications into decisions people make with their hands.

Notice what is not on the list: model architecture, vocabulary, an essay on ethics. None of it predicts whether someone will leak data or ship a hallucination on Tuesday.

The Tiers: What Each License Unlocks

The test unlocks access in levels, and each level adds one new check matched to the new risk. Here is the shape we recommend.

The learner’s permit should be easy to earn, within a week, using the work already on someone’s desk. Its purpose is not to filter people out. It is to get everyone onto the sanctioned pth quickly, with a baseline of judgment. The full license is where the stakes rise. Once AI touches customer records or anything a customer will see, a mistake stops being private. Can this person show you how their AI-assisted work gets a second look before it leaves the building? The commercial license is for builders. An agent that reads a ticket queue, drafts replies, and closes tickets is a different vehicle from a chat window. The person who builds it needs to think like a hiring manager, which is the frame this series opened with in “Govern AI Like You Hire”: least-privilege access, a defined role, and a named human accountable for the work. The commercial test checks exactly that. Can you write the agent’s job description, scope its permissions to that job, and say where it must hand off? Licenses should also get a renewal check. Models change underneath your people without asking, and a short annual refresh keeps the license honest without turning it into bureaucracy.

Make the Legitimate Path the Fast Path

Here is the design principle that decides whether any of this works. The license must be faster to get than the workaround is to use. People do not route around rules because they enjoy breaking them. They route around rules because the sanctioned path is slower than their deadline. If earning a learner’s permit means a six-week course and an approval queue, your people will keep using personal accounts, and you will have built an elegant system that nobody enters. So make the test short and available on demand. Let managers proctor it on real work. Grant access the same day someone passes, and give anyone who fails a specific reason and a second attempt within the week. When the license is fast, it changes the conversation about shadow AI. You are no longer asking people to stop using tools that help them. You are offering them a quicker, safer, supported way to keep doing it, with better tools and access to better data as the reward for showing judgment. That is an offer most people take. It also gives you something a lockdown destroys: visibility. You know who is licensed, at what tier, and for which tools, and when a new model arrives, you know exactly who needs a refresher.

AI Literacy Is Already a Legal Duty in Europe

If your organization has staff or operations in the EU, this is not only good practice. Article 4 of the EU AI Act, which has applied since February 2, 2025, requires providers and deployers of AI systems to take measures to support AI literacy among their staff and others using AI on their behalf, calibrated to their role and the context of use. The European Commission’s own guidance is useful here, because it shows what the law does and does not ask. It says there is no need for a certificate and no obligation to measure employees’ AI knowledge, but it recommends keeping an internal record of training and other literacy initiatives. It also confirms the duty covers ordinary use, including staff using a general chatbot for writing or translation, who should understand risks like hallucination. Supervision and enforcement by national authorities began in August 2026. The 2026 amendments to the Act softened the wording of Article 4, from ensuring a sufficient level of literacy to supporting its development, but kept the obligation in place for providers and deployers. A license goes beyond what the law requires. A training log shows people attended something. A license record shows they demonstrated the judgment the training was meant to build, at a level matched to the systems they use. If a regulator or a customer ever asks how you know your people can use AI responsibly, that is a far better answer to have on file.

What a License Is Not

A license is not a gate designed to keep people out. If your pass rate on the learner’s permit is low, the problem is your enablement, not your people. Fix the teaching, not the test. It is not a generic literacy course. Broad, organization-wide AI training often generates high attendance and little behavior change. One change leader at a very large enterprise described exactly that to us: a well-attended, company-wide AI learning program that did not move the needle, and no baseline to tell them where people started. A license gives you that baseline by design, because every pass and every failure is data about where your people actually are. And it is not a substitute for governing the systems themselves. The license governs the driver. The rest of your governance governs the vehicle and the road.

How to Start This Month

You do not need a platform to pilot this. You need one team and an afternoon of design. Pick a team that is already using AI, sanctioned or not. Sit down with them and write the three questions of the learner’s permit test using their real work: a task they would genuinely use AI for, an output with two or three planted errors, and a short stack of data examples to sort. Write it with them, not for them. Governance people help shape is governance people follow. Run the test with that team within a week. Grant access to sanctioned tools the same day people pass. Ask everyone, with curiosity rather than suspicion, which tools they were using before. Their answers tell you what your sanctioned stack is missing. Then draft full license criteria for the roles that touch customer data most, and design the commercial test with your security team in the room. The organizations that license AI use will see more of it, not less, and they will see it clearly. The ones that rely on a policy alone will keep publishing rules that more than half their people quietly work around. The difference is not how strict you are. It is whether your people have a fast, fair way to prove they are ready. If you want help designing an AI driver’s license with the people who will carry it, talk with us. Building governance together, so it gets followed instead of routed around, is the work we do.