Skip to content

Commit 1ef41ff

Browse files
gstraccini[bot]gstraccini[bot]
authored
Merge branch 'main' into dependabot/npm_and_yarn/backend/npm_and_yarn-cebaad6393
2 parents 92e828f + c25f559 commit 1ef41ff

9 files changed

Lines changed: 2597 additions & 0 deletions

‎artifacts/data/compliance-matrix.csv‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
framework,jurisdiction,articles_sections,opa_rules,compliance_pct,status,certification_target,last_assessment,gap_count,critical_gaps
2+
EU AI Act,EU,Art. 1-113,48,91.2,Active,Q4 2027 Full Compliance,2026-03-01,4,1
3+
NIST AI RMF,US,GOVERN MAP MEASURE MANAGE,42,89.6,Active,Continuous Alignment,2026-03-01,6,2
4+
ISO/IEC 42001,Global,§4-§10,38,87.4,In Progress,Q3 2027 Certification,2026-02-15,8,3
5+
OECD AI Principles,Global (38),Principles 1.1-1.5 2.1-2.5,22,92.8,Active,Continuous Alignment,2026-03-01,2,0
6+
GDPR,EU,Art. 1-99,52,94.1,Active,Continuous Compliance,2026-03-01,3,0
7+
FCRA/ECOA,US,§602-§625 / §701-§706,28,89.0,Active,Continuous Compliance,2026-02-15,5,1
8+
SR 11-7,US (Banking),§§1-15,34,94.0,Active,Continuous Compliance,2026-03-01,2,0

‎artifacts/data/implementation-timeline.csv‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
week,phase,task,owner,hours,dependencies,artifacts,status
2+
1,Foundation,Provision OPA cluster (3-node HA),Platform Eng,16,None,Terraform IaC,Pending
3+
1,Foundation,Deploy Kafka cluster with WORM config,Platform Eng,20,None,Helm charts,Pending
4+
1,Foundation,Configure OpenTelemetry collectors,Platform Eng,12,None,OTEL config YAML,Pending
5+
1,Foundation,Set up Prometheus + Grafana,Platform Eng,8,None,Grafana dashboards JSON,Pending
6+
1,Foundation,Provision MLflow model registry,ML Eng,12,None,Docker Compose,Pending
7+
1,Foundation,Create OPA policy repository (Git),DevOps,4,None,Git repo + CI,Pending
8+
2,Core Policy,Implement 50 core OPA policies,AI Gov Eng,40,W1 OPA cluster,50 Rego files,Pending
9+
2,Core Policy,Configure OPA-Kubernetes integration,Platform Eng,16,W1 OPA cluster,Admission webhooks,Pending
10+
2,Core Policy,Build policy testing framework,DevOps,12,W1 Git repo,OPA test suite,Pending
11+
2,Core Policy,Create policy versioning workflow,DevOps,8,W1 Git repo,GitOps pipeline,Pending
12+
2,Core Policy,Implement Sentinel core rule engine,Platform Eng,24,W1 Infrastructure,Sentinel config,Pending
13+
3,Monitoring,Deploy drift detection (Evidently AI),ML Eng,16,W1 Infrastructure,Evidently config,Pending
14+
3,Monitoring,Configure fairness monitoring (AIF360),ML Eng,20,W1 Infrastructure,AIF360 pipelines,Pending
15+
3,Monitoring,Build 6-tier alert escalation,Platform Eng,12,W1 Infrastructure,PagerDuty config,Pending
16+
3,Monitoring,Implement audit trail pipeline,Platform Eng,16,W1 Kafka,Kafka to S3 pipeline,Pending
17+
3,Monitoring,Create Grafana governance dashboards,Frontend,20,W1 Grafana,Dashboard JSON,Pending
18+
4,CI/CD Gates,Implement 7-stage pipeline gates,DevOps,32,W2 OPA policies,Jenkins/GitLab CI config,Pending
19+
4,CI/CD Gates,Build model registry integration,ML Eng,16,W1 MLflow,MLflow plugins,Pending
20+
4,CI/CD Gates,Create deployment approval workflows,DevOps + AI Gov,12,W2 OPA,Jira + OPA integration,Pending
21+
4,CI/CD Gates,Implement canary deployment governance,Platform Eng,16,W2 Sentinel,ArgoCD config,Pending
22+
4,CI/CD Gates,Build rollback automation,Platform Eng,12,W4 Canary,Rollback scripts,Pending
23+
5,Agent Governance,Deploy EAIP gRPC mesh,Platform Eng,24,W1 Infrastructure,Proto files + config,Pending
24+
5,Agent Governance,Implement SPIFFE/SPIRE identity,Security Eng,20,W1 Infrastructure,SPIRE config,Pending
25+
5,Agent Governance,Build agent behavioral sidecars,AI Safety Eng,24,W2 Sentinel,Sidecar containers,Pending
26+
5,Agent Governance,Implement kill-switch (triple redundant),Platform Eng,16,W5 SPIFFE,Kill-switch service,Pending
27+
5,Agent Governance,Configure agent spawn controls,AI Safety Eng,12,W2 OPA,OPA agent policies,Pending
28+
6,Financial Services,Implement SR 11-7 OPA policies,AI Gov Eng,24,W2 OPA,34 Rego files,Pending
29+
6,Financial Services,Build adverse action notice generator,ML Eng,20,W4 Model registry,FCRA §615 templates,Pending
30+
6,Financial Services,Configure credit scoring bias monitoring,ML Eng,16,W3 AIF360,DI/EOD/SPD dashboards,Pending
31+
6,Financial Services,Create model validation workflow,Model Risk,12,W4 Approval workflows,Validation templates,Pending
32+
6,Financial Services,Implement SHAP/LIME explainability,ML Eng,16,W4 Model registry,Explanation service,Pending
33+
7,Dashboard,Build board KPI dashboard,Frontend,24,W3 Grafana,Next.js + D3.js,Pending
34+
7,Dashboard,Create C-suite operational dashboard,Frontend,20,W3 Grafana,Dashboard components,Pending
35+
7,Dashboard,Implement regulatory reporting automation,AI Gov Eng,16,W6 Compliance,Report templates,Pending
36+
7,Dashboard,Build RAG governance dashboard,Frontend,16,W3 Monitoring,RAG metrics panels,Pending
37+
7,Dashboard,Create audit evidence bundle generator,DevOps,12,W3 Audit trail,Evidence scripts,Pending
38+
8,Go-Live,End-to-end governance pipeline testing,QA + AI Gov,24,W1-W7 All,Test reports,Pending
39+
8,Go-Live,Crisis simulation (SIM-1) execution,All Stakeholders,8,W7 Dashboard,Simulation report,Pending
40+
8,Go-Live,Performance and load testing,Platform Eng,16,W1-W7 All,Performance report,Pending
41+
8,Go-Live,Security penetration test,Security Eng,16,W5 SPIFFE,Pen test report,Pending
42+
8,Go-Live,Documentation and runbook completion,AI Gov + DevOps,12,W1-W7 All,Runbooks SOPs,Pending
43+
8,Go-Live,Go-live sign-off and board briefing,CAIO + Board,4,W8 Testing,Sign-off document,Pending

‎artifacts/data/risk-register.csv‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
risk_id,risk_name,category,likelihood,impact,score,severity,mitigation,owner,status,framework_alignment,last_review,next_review
2+
R-001,EU AI Act non-compliance fine (up to 7% global turnover),Regulatory,Medium,Critical,HIGH,Critical,OPA rules Sentinel monitoring legal review,VP AI Governance,MITIGATING,EU AI Act Art. 71-72,2026-03-15,2026-06-15
3+
R-002,Autonomous agent causes financial loss >$10M,Operational,Medium,Critical,HIGH,Critical,Kill-switch behavioral sidecar scope limits,VP AI Safety,MITIGATING,Internal + EAIP,2026-03-15,2026-06-15
4+
R-003,AI model bias results in class action lawsuit,Legal,Medium,High,HIGH,High,Fairness testing DI monitoring FCRA/ECOA compliance,CRO,MITIGATING,FCRA §607 ECOA §701,2026-03-15,2026-06-15
5+
R-004,Data breach via AI system (PII exposure),Security,Medium,High,HIGH,High,DLP PII scanning encryption GDPR controls,CISO,MITIGATING,GDPR Art. 32-34,2026-03-15,2026-06-15
6+
R-005,Model hallucination in critical decision path,Operational,High,High,CRITICAL,Critical,RAG grounding confidence thresholds human review,VP AI Governance,MITIGATING,NIST AI RMF MEASURE,2026-03-15,2026-04-15
7+
R-006,Third-party AI model supply chain compromise,Security,Medium,High,HIGH,High,Vendor assessment model provenance sandboxing,CISO,MITIGATING,ISO/IEC 42001 §8,2026-03-15,2026-06-15
8+
R-007,AGI capability emergence (uncontrolled),Safety,Low,Catastrophic,HIGH,Critical,Containment protocols GASCF certification kill-switch,VP AI Safety,MONITORING,GASCF + Internal,2026-03-15,2026-06-15
9+
R-008,Regulatory fragmentation increases compliance cost >30%,Strategic,High,Medium,HIGH,Medium,Multi-regime OPA framework regulatory engagement,General Counsel,MITIGATING,All frameworks,2026-03-15,2026-06-15
10+
R-009,Compute resource exhaustion or denial of service,Operational,Medium,Medium,MEDIUM,Medium,Quotas autoscaling multi-cloud redundancy,CTO,MITIGATING,OECD Principle 1.2,2026-03-15,2026-09-15
11+
R-010,Competitive AI governance disadvantage,Strategic,Medium,Medium,MEDIUM,Medium,Accelerated governance program ISO certification,CTO/CRO,MITIGATING,ISO/IEC 42001,2026-03-15,2026-09-15

‎artifacts/policies/eu_ai_act_high_risk.rego‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# AGMB-GSIFI-WP-016 — EU AI Act High-Risk Classification Policy
2+
# Policy Group: ai-risk-classification (28 rules)
3+
# Regulatory Alignment: EU AI Act Art. 6, Art. 9-15, Annex III
4+
5+
package ai.governance.eu_ai_act
6+
7+
import future.keywords.in
8+
9+
default high_risk = false
10+
default compliant = false
11+
12+
# High-risk system categories per Annex III
13+
high_risk_categories := [
14+
"credit_scoring", "employment_screening",
15+
"biometric_identification", "critical_infrastructure",
16+
"education_assessment", "law_enforcement",
17+
"migration_asylum", "democratic_process",
18+
"insurance_pricing", "judicial_assistance"
19+
]
20+
21+
high_risk {
22+
input.system.category in high_risk_categories
23+
}
24+
25+
high_risk {
26+
input.system.eu_ai_act_annex_iii == true
27+
}
28+
29+
# Compliance checks for high-risk systems
30+
compliant {
31+
high_risk
32+
input.documentation.technical_file_complete == true
33+
input.system.human_oversight_mechanism == true
34+
input.system.risk_management_system == true
35+
input.system.data_governance_measures == true
36+
input.system.transparency_provisions == true
37+
input.system.accuracy_robustness_cybersecurity == true
38+
input.system.bias_di >= 0.80
39+
}
40+
41+
compliant {
42+
not high_risk
43+
}
44+
45+
# Denial rules
46+
deny[msg] {
47+
high_risk
48+
not input.documentation.technical_file_complete
49+
msg := sprintf("EU-AI-ACT-001: System %v classified HIGH-RISK requires complete technical documentation (Art. 11)", [input.system.id])
50+
}
51+
52+
deny[msg] {
53+
high_risk
54+
not input.system.human_oversight_mechanism
55+
msg := sprintf("EU-AI-ACT-002: System %v classified HIGH-RISK requires human oversight mechanism (Art. 14)", [input.system.id])
56+
}
57+
58+
deny[msg] {
59+
high_risk
60+
not input.system.risk_management_system
61+
msg := sprintf("EU-AI-ACT-003: System %v classified HIGH-RISK requires risk management system (Art. 9)", [input.system.id])
62+
}
63+
64+
deny[msg] {
65+
high_risk
66+
input.system.bias_di < 0.80
67+
msg := sprintf("FCRA-ECOA-001: System %v disparate impact ratio %.2f below 0.80 threshold", [input.system.id, input.system.bias_di])
68+
}
69+
70+
deny[msg] {
71+
high_risk
72+
not input.documentation.dpia_complete
73+
msg := sprintf("GDPR-035-001: System %v HIGH-RISK requires Data Protection Impact Assessment (GDPR Art. 35)", [input.system.id])
74+
}

‎artifacts/policies/sr_11_7_model_validation.rego‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# AGMB-GSIFI-WP-016 — SR 11-7 Model Risk Management Policy
2+
# Policy Group: financial-services (28 rules)
3+
# Regulatory Alignment: SR 11-7 §§1-15, FCRA §607/§615, ECOA §701-§706
4+
5+
package ai.governance.sr_11_7
6+
7+
default model_approved = false
8+
default validation_current = false
9+
10+
# Model approval requires all validation steps
11+
model_approved {
12+
input.model.validation.independent_review == true
13+
input.model.validation.challenger_model_tested == true
14+
input.model.documentation.model_card_complete == true
15+
input.model.monitoring.ongoing_validation_schedule != null
16+
input.model.risk_tier != "unvalidated"
17+
validation_current
18+
}
19+
20+
# Validation is current if within 12 months
21+
validation_current {
22+
input.model.validation.last_validation_date != null
23+
time.now_ns() - time.parse_rfc3339_ns(input.model.validation.last_validation_date) < 365 * 24 * 60 * 60 * 1000000000
24+
}
25+
26+
deny[msg] {
27+
input.model.risk_tier == "high"
28+
not input.model.validation.second_line_review
29+
msg := sprintf("SR117-001: High-risk model %v requires 2nd-line independent validation (SR 11-7 §4)", [input.model.id])
30+
}
31+
32+
deny[msg] {
33+
input.model.risk_tier == "high"
34+
not input.model.validation.challenger_model_tested
35+
msg := sprintf("SR117-002: High-risk model %v requires challenger model testing (SR 11-7 §5)", [input.model.id])
36+
}
37+
38+
deny[msg] {
39+
not input.model.documentation.model_card_complete
40+
msg := sprintf("SR117-003: Model %v requires complete model card documentation (SR 11-7 §7)", [input.model.id])
41+
}
42+
43+
deny[msg] {
44+
input.model.category == "credit_scoring"
45+
not input.model.fairness.adverse_action_codes_enabled
46+
msg := sprintf("FCRA-615: Credit scoring model %v must generate adverse action reason codes (FCRA §615(a))", [input.model.id])
47+
}
48+
49+
deny[msg] {
50+
input.model.category == "credit_scoring"
51+
input.model.fairness.disparate_impact < 0.80
52+
msg := sprintf("ECOA-701: Credit scoring model %v disparate impact %.2f violates equal opportunity (ECOA §701)", [input.model.id, input.model.fairness.disparate_impact])
53+
}

‎artifacts/schemas/ai-system-registration.schema.json‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://governance.enterprise.ai/schemas/ai-system-registration/v1.0.0",
4+
"title": "AI System Registration Schema — AGMB-GSIFI-WP-016",
5+
"description": "JSON Schema for registering AI systems under the AGI Governance Master Blueprint. Aligned with EU AI Act Art. 51, ISO/IEC 42001 §7, and NIST AI RMF.",
6+
"type": "object",
7+
"required": ["systemId", "name", "version", "owner", "riskClassification", "regulatoryScope", "deployment"],
8+
"properties": {
9+
"systemId": { "type": "string", "pattern": "^AIS-[A-Z0-9]{3}-[0-9]{4}$", "description": "Unique AI system identifier" },
10+
"name": { "type": "string", "minLength": 3, "maxLength": 200 },
11+
"version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
12+
"description": { "type": "string", "maxLength": 2000 },
13+
"owner": {
14+
"type": "object",
15+
"required": ["name", "role", "department"],
16+
"properties": {
17+
"name": { "type": "string" },
18+
"role": { "type": "string" },
19+
"department": { "type": "string" },
20+
"email": { "type": "string", "format": "email" }
21+
}
22+
},
23+
"riskClassification": {
24+
"type": "object",
25+
"required": ["euAiActTier", "internalRiskScore"],
26+
"properties": {
27+
"euAiActTier": { "type": "string", "enum": ["unacceptable", "high", "limited", "minimal"] },
28+
"euAiActAnnexIII": { "type": "boolean", "default": false },
29+
"nistProfile": { "type": "string" },
30+
"internalRiskScore": { "type": "number", "minimum": 0, "maximum": 100 },
31+
"sr117Applicable": { "type": "boolean", "default": false },
32+
"fcraApplicable": { "type": "boolean", "default": false }
33+
}
34+
},
35+
"regulatoryScope": {
36+
"type": "array",
37+
"items": { "type": "string", "enum": ["EU_AI_ACT", "NIST_AI_RMF", "ISO_42001", "OECD_AI", "GDPR", "FCRA_ECOA", "SR_11_7"] },
38+
"minItems": 1
39+
},
40+
"deployment": {
41+
"type": "object",
42+
"required": ["environment", "region", "status"],
43+
"properties": {
44+
"environment": { "type": "string", "enum": ["development", "staging", "production"] },
45+
"region": { "type": "array", "items": { "type": "string" } },
46+
"status": { "type": "string", "enum": ["draft", "pending_review", "approved", "deployed", "deprecated", "retired"] },
47+
"deployDate": { "type": "string", "format": "date" },
48+
"lastAuditDate": { "type": "string", "format": "date" },
49+
"nextAuditDate": { "type": "string", "format": "date" }
50+
}
51+
},
52+
"autonomyLevel": { "type": "integer", "minimum": 0, "maximum": 5, "description": "L0 Tool to L5 Self-multiplying" },
53+
"agentCapabilities": {
54+
"type": "object",
55+
"properties": {
56+
"canSpawnSubAgents": { "type": "boolean", "default": false },
57+
"maxSubAgents": { "type": "integer", "minimum": 0, "maximum": 10 },
58+
"maxSpawnDepth": { "type": "integer", "minimum": 0, "maximum": 3 },
59+
"maxLifetimeHours": { "type": "number", "minimum": 0, "maximum": 24 },
60+
"killSwitchType": { "type": "string", "enum": ["none", "software", "software_hardware", "triple_redundant"] }
61+
}
62+
},
63+
"modelDetails": {
64+
"type": "object",
65+
"properties": {
66+
"architecture": { "type": "string" },
67+
"parameters": { "type": "string" },
68+
"trainingDataCutoff": { "type": "string", "format": "date" },
69+
"biasMetrics": {
70+
"type": "object",
71+
"properties": {
72+
"disparateImpact": { "type": "number", "minimum": 0, "maximum": 1 },
73+
"equalizedOddsDiff": { "type": "number", "minimum": 0, "maximum": 1 },
74+
"statisticalParityDiff": { "type": "number", "minimum": -1, "maximum": 1 }
75+
}
76+
},
77+
"explainabilityMethod": { "type": "string", "enum": ["SHAP", "LIME", "attention_maps", "counterfactual", "other"] }
78+
}
79+
},
80+
"documentation": {
81+
"type": "object",
82+
"properties": {
83+
"modelCardComplete": { "type": "boolean" },
84+
"technicalFileComplete": { "type": "boolean" },
85+
"dpiaComplete": { "type": "boolean" },
86+
"validationReportComplete": { "type": "boolean" }
87+
}
88+
},
89+
"monitoring": {
90+
"type": "object",
91+
"properties": {
92+
"driftDetectionEnabled": { "type": "boolean" },
93+
"fairnessMonitoringEnabled": { "type": "boolean" },
94+
"sentinelRuleCount": { "type": "integer", "minimum": 0 },
95+
"opaRuleCount": { "type": "integer", "minimum": 0 },
96+
"alertEscalationTier": { "type": "integer", "minimum": 0, "maximum": 5 }
97+
}
98+
}
99+
}
100+
}

0 commit comments

Comments
 (0)