Why a 20-year CX leader built an AI-governance company

Governance software is the most user-hostile category there is. I set out to change that, by making the person who is actually trying to get something done the hero.

A customer experience person building governance software sounds like a category error. It isn't, and the reason is the whole point of GatedFlow.

I started my career as a software engineer, building systems that real people had to use. Then I spent 20 years on the other side of those systems, at the customer coalface of regulated businesses: Telstra, Optus, Allianz, EML, icare. Along the way I stood up Lean Six Sigma programs and ran transformation portfolios at Optus, and worked across the whole of customer experience: UX, Voice of Customer, service design and customer strategy. Different titles, one constant question: what does the person who actually has to use this thing need?

The gap between the slide and the Tuesday

Here is what two decades in regulated organisations taught me. Good intentions rarely fail for lack of a framework. They fail in the gap between a framework on a slide and what actually happens on a Tuesday. The policy is usually fine. The problem is that nobody can use it.

I watched this play out in my own field, again and again. Customer experience would get called in after a system was already built, to bless it before launch. By then it was far too late to change anything that mattered. The decisions that shaped the customer's experience had been made months earlier, by people who never had the customer in the room.

Governance has exactly the same disease. It gets brought in at the last forum, when all it can do is say no. And a function that only ever says no, late, gets routed around. The work does not stop. It goes underground. The governance that was supposed to protect the organisation quietly stops happening.

Why governance software makes it worse

Most governance software is built for the auditor, not for the person doing the work. It asks the Business Owner, the one actually trying to ship an AI use case, to navigate a maze designed for someone else. They fill in forms whose purpose they cannot see, wait on committees whose criteria they were never told, and discover at the final gate that they were missing three things they could have prepared at the very start.

So they do the rational thing. They route around it. They use the tool that is not on the approved list, stand up the model without telling anyone, or quietly ship and ask forgiveness later. Every workaround is a small vote of no confidence in the system, and every one of them is a governance failure waiting to surface in an audit, a complaint, or a regulator's question.

AI is about to turn that gap into a chasm. It is scaling faster than the governance around it, and the old reflex, more committees, more forms, more "no", will not hold.

The one design choice that changes everything

So I built GatedFlow, an AI portfolio operating system for regulated organisations. And I made one deliberate choice that runs against the grain of the whole category: the most important person, the one trying to get something done, is the hero. Not the auditor. Not the committee. The Business Owner.

For a simple reason: without adoption, governance fails. A control that people work around protects no one. The only governance that actually works is the governance people are willing to use.

That is a customer-experience problem before it is a compliance problem, which is why I designed it the way I have always designed, with the people who make it happen front and centre. How does a Program Manager want to see their portfolio? What lens does the Chief Risk Officer need on that same portfolio? How does a Business Owner know, at a glance, who the next action sits with? Same underlying record, the view each person actually needs. It is why the first thing I built into GatedFlow was not a gate or a form. It was the feedback loop. In a governance tool, where you start tells you everything about whose problem you are really solving.

In practice that means GatedFlow tells the Business Owner exactly what each gate needs at the start, not at the last forum. It scales the governance to the risk, so a low-risk internal tool is not dragged through the same process as a model that decides someone's insurance claim. And the risk and governance people still get everything they need: a regulator-ready, tamper-evident record that nothing shipped without the right approvals. The Business Owner gets to move. The organisation gets control it can prove. Everyone wins.

Built by someone who has lived both sides

I know the regulated-industry problem from the inside, I have lived the customer-experience discipline, and I can ship the software that solves it, with AI as my co-pilot. GatedFlow is self-hostable and Australian-sovereign: you run it in your own environment and own your instance and your data, so your control of your AI never depends on any one vendor being around. We are working with a small number of design partners now, and being honest about that stage, because in a regulated buy candour earns more trust than claims.

A career that started in code and then spent 20 years asking "what does this person actually need?" turned out to be the right training for governance after all. You just have to remember who the customer is.

If you are a Chief Risk Officer, Chief AI Officer or Head of Risk wrestling with how to scale AI responsibly, I would genuinely like to talk.

Krish Mootoosamy is the founder of GatedFlow, the AI portfolio operating system for regulated organisations.