AI IN GRC, MEET GOOFUS AND GALLANT
My dad subscribed to Highlights magazine when he was a kid. Decades later, he subscribed again — this time for my kids. Now the issues land in our mailbox and we tear into them before we are even back inside the house.
Last week we turned to Goofus and Gallant, the two-panel cartoon where one kid does everything wrong and the other does it right. The nostalgia hit me sideways. Then a less wholesome thought arrived: Goofus grew up. He got a laptop, a corporate login, and a chatbot tab — and he is absolutely running amok in somebody's compliance department.
I know this because I have met him. I have watched sharp people shove AI into GRC problems it has no business touching — fast, confident, and one prompt away from a breach report. The tool is not the problem. The way they use it is.
So here is the grown-up edition. Meet Cowboy Carl and Careful Carol. Same tool. Same deadline. Six rounds. Two very different outcomes.
The Copy-Paste Cowboy
Pastes the customer's SOC 2 report into a free public chatbot to "summarize it real quick." That data now lives on someone else's servers — and maybe in someone else's training set.
Runs the same summary through the company's sanctioned model. Data-loss protection on, audit logging on, nothing crosses the boundary.
The Rubber-Stamp Robot
Wires an AI agent straight into the access-request queue and lets it approve grants at runtime. No human ever lays eyes on them.
Lets the AI draft the recommendation and surface the risk — then a human makes the call and signs their name to it.
The Phantom Control
Asks the AI to "write the SSP" and pastes whatever comes back. It confidently cites a control the company has never actually implemented.
Uses the AI to draft, then checks every claim against the real system and links the real evidence before anything reaches the auditor.
The Keys to the Kingdom
Spins up an autonomous agent with a god-mode API key "to automate compliance," then forgets it is running.
Gives her agent least-privilege scopes, an inventory entry, and full logging — so it can act, but only inside the fence.
The Open Door
Points his agent at inbound vendor email and lets it act on whatever it reads. A booby-trapped message tells it to export the data room — so it does.
Treats every model input as untrusted, sandboxes tool use, and never lets the agent act on instructions hidden in the content it reads.
The "We'll Deal With It Later" Desk
Has no AI inventory, no AI policy, and no idea how many tools the team is quietly using. "We'll govern it once it matters."
Keeps a living AI inventory and maps her program to NIST AI RMF and ISO 42001 — so "it matters" never catches her off guard.
HOW TO USE AI IN GRC WITHOUT BECOMING CARL
Here is the part the comic strip never said out loud: Carl is not stupid. He is in a hurry. Every one of his disasters started as a reasonable attempt to move faster on a real deadline.
The whole job of a GRC program is to make Carol's way the fast way too — sanctioned tools that are easier to reach than the shady ones, guardrails that do not require a meeting, and governance that runs at the speed of the business. We wrote more about the regulatory side of this in our breakdown of the EU AI Act timeline.
Do that, and the next person reaching for AI on a deadline reaches for the safe option by default. That is not bureaucracy. That is just good design — the kind that would have made the magazine.
Sources
- Cost of a Data Breach Report — IBM, 2025
- The EU Artificial Intelligence Act — high-risk obligations, August 2, 2026
- AI Risk Management Framework & AI Agent Standards Initiative — NIST
- Top 10 for Large Language Model Applications — OWASP
- ISO/IEC 42001 — AI Management System — ISO
- Gartner forecast: AI-related legal disputes to exceed 2,000 by end of 2026.