How to govern AI skills across a company: owners, approvals and review cycles

Start with an inventory: every skill in use, where it lives, which AI tools use it and who relies on it. A central inventory is one of Gartner's six steps for managing AI agents. You cannot govern what you cannot see.

The quickest way to build it is to ask teams to bring the skills they rely on into one company library. Skills that stay outside it are, by definition, ungoverned.

Every shared skill needs one named person who answers for it: someone who keeps it current, reads the feedback, approves changes and decides when it should be retired. Usually that is the expert who knows the process best, or the team lead responsible for it. A skill without an owner is a skill nobody will fix.

Decide, for the whole company, a team or a single skill: who may create or import skills, how widely each person may share them (with themselves, their team, or the whole company), which sources skills may come from (your own repositories, never public sources, for example), and which AI tools may receive them (Claude and Copilot, but not personal accounts, for example).

Write the rules down, and enforce them in the tool that holds the skills rather than in a policy document. A rule people have to remember is a rule that will be broken.

Skills from public directories can be useful, and some are malicious. Treat them like any other software a company brings in: scan each one for risky behaviour before import, look at what it actually does, and then decide whether to import it, ask for changes or block it. We explain the risk in Your company is sharing AI skills nobody has tested.

Not every skill needs the same scrutiny. Give each skill a risk level, and let that level decide who must approve a version before anyone can use it: the owner alone for a low-risk skill, an admin or the security team for a skill that touches client data, two approvers for a critical one. Advisers on agent governance make the same point: for any AI rollout you need clarity on who approved it.

Approval should apply to a specific version, with the test results next to it, so the approver sees what changed and whether it still works.

An approved skill only helps if people actually use that version. Deliver it to every AI tool your team uses, not only the one the owner prefers. Decide how strongly updates are pushed (optional, recommended or required), pin a version where stability matters more than improvements, and roll out risky changes to one team before the rest.

Skills go stale even when nobody edits them, because the AI models underneath change. Anthropic warns that a skill's behaviour can shift from one month to the next. So review every skill on a schedule that matches its risk: critical skills every 30 days, high-risk every 90 days, medium every six months and low once a year. Run the skill's tests again whenever the AI model changes.

Installed does not mean used. In Vercel's tests, the AI never used an installed skill in 56% of cases. Track which skills are actually used, by whom and in which tools. An unused skill usually has a vague description or the wrong job, and a heavily used one deserves the most careful review.

Finally, keep a record of everything: imports, changes, approvals, rollouts and reviews. When something goes wrong, you should be able to answer who changed what, when, and who signed it off, without detective work.

Eight parts, and the question each one answers.

Each AI vendor offers some controls for its own tool. A company that uses Claude, ChatGPT and Copilot side by side needs one model that covers all of them, or it ends up with three inventories, three approval processes and three versions of the same skill.

That is what Fygment provides. One company library holds every skill with its owner, risk level, versions and approval history. Rules for creating, sharing, sources and tools apply to the whole company, a team or a single skill. Outside skills are scanned before import, approvals follow the risk level, updates roll out the way you choose, review dates come round automatically, usage shows what is actually used, and every change is recorded.

If you want to put this model to work, Fygment is free to start.