A county wants AI to suggest KQL but requires analyst sign-off before saving analytics. What governance pattern is that?

Requiring analyst sign-off before saving AI-suggested KQL is human-gated AI assistance for Azure detection authoring. AI can accelerate query drafts for a county SOC, but detections that fire incidents and pages must pass human review for correctness, performance, and false-positive risk. The governance pattern is assistive generation with a mandatory approval gate before content becomes a saved analytic in the workspace.

Human-gated AI assistance for Sentinel playbook automation with required analyst approval before save has the right gate but the wrong object: it governs automated response playbooks, not AI-suggested KQL being saved as an analytic, so it does not satisfy detection-authoring governance. Human-gated AI assistance for KQL query explanation with required analyst approval before save does not satisfy the governance requirement: it covers explaining an existing query rather than approving an AI-suggested detection draft before it is saved as a new analytic. Human-gated AI assistance for Content Hub distribution with required analyst approval before save fails scope: it gates distribution of packaged content across workspaces rather than requiring analyst approval before an AI-suggested KQL draft is saved as an analytic in the workspace.

Exam caveat: Human gating should be recorded (PR approval, Sentinel change record, or ITSM). Reviewers must validate schema fit, entity mapping, severity, and suppression overlap—not just glance at KQL syntax. Treat AI output as untrusted until tested in non-prod.

Operational check: Configure the AI assist workflow so 'save to workspace' requires an analyst identity and approval step; store drafts with named owners; test suggested queries in non-prod against county log samples; and periodically audit detections authored with AI assistance for quality and ownership.