# Operational coverage for enterprise AI

> Use evidence to assess the operating coverage behind enterprise AI, identify the capability limiting production scale, and assign an improvement.

Source: https://brocs.fyi/resources/operational-maturity/
Framework: BROCS (Build, Run, Observe, Control, Secure), brocs.fyi. CC BY 4.0, attribute to brocs.fyi.

---


Broad AI use can coexist with uneven operational support. Adoption work can set ambition,
choose use cases, develop skills, and expand use. The BROCS diagnostic records whether
the organization can support, change, and account for the systems people depend on.

BROCS measures current capability coverage. The scoreline records which operating
statements can be supported by evidence today. Each organization interprets the result
against its own systems and requirements.

## Evidence by scope

| Scope | Evidence of operating coverage | A common constraint |
|---|---|---|
| Build | Approved tools, documented access, governed data connections, repeatable delivery, and evals tied to releases | Teams wait for setup or work outside the sanctioned path |
| Run | Owned runtimes, explicit state, managed secrets, repeatable provisioning, and tested portability | A pilot depends on one person's environment or an undocumented supplier default |
| Observe | Service metrics, model-quality measures, traces, alerts, cost attribution, and agent action records | The service appears healthy while quality, cost, or behavior changes unnoticed |
| Control | Versioned configuration, named identities, controlled ingress, routing, rollback, and recovery mechanisms | Every operating change requires code, a supplier ticket, or a full shutdown |
| Secure | Enforced permissions, agent limits, inventory, spending boundaries, incident evidence, and compliance records | Policy exists without a system that can enforce it or prove it held |

Microsoft's current AI management guidance calls for structured operating processes,
deployment governance, and monitoring throughout the AI lifecycle.[^microsoft-manage]
BROCS organizes evidence for those capabilities under the five operating scopes.

## Production readiness for planned and active systems

Production readiness applies to purchased and homegrown systems. Before an AI workload
becomes a dependency, the responsible teams should be able to identify:

- the supported path used to configure and release it;
- the runtime, state, secrets, data, and supplier responsibilities;
- the telemetry and evals that show whether it remains useful;
- the people and mechanisms authorized to change or stop it;
- the limits and records required by security, finance, and compliance.

The review remains useful when those answers are incomplete. Missing evidence is part of
the result.

## Use the scoreline as a constraint map

Complete [the BROCS assessment](/resources/assessment/) using organization-wide evidence.
A result such as `B3 R2 O1 C2 S0` identifies where support is weakest.

Select an active system or delivery path, locate the scope creating delay or weak control,
and assign one improvement with an owner. Define the evidence that will show the
improvement works, then score the same scope again after it is operating.

The next improvement may be a shared service, a change mechanism, a missing trace, an
access boundary, or a documented responsibility between the organization and a supplier.
The [worked example](/resources/worked-example/) shows the same review across all five
scopes.

[^microsoft-manage]: Microsoft, ["Manage AI - Guidance to set up your organization's AI management process"](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai/manage), Cloud Adoption Framework, updated April 10, 2026.