govrn × Aperture — a vetting surface, before anything is implemented. Enter the access key.
Two builds that started from the same conviction — an AI estate is only governed when you can prove it, with a signed and independent attestation — and grew toward each other from opposite ends. govrn built the standard, the assessment, and the independent attestation path. Aperture built the live command center that produces the evidence. This page maps the merge: what overlaps, what's unique to each side, and how the two halves make one product — with Grace Hill as the first proof-of-concept partner.
The standard and the judgment layer — what an auditor, board, or regulator will accept.
Both sides built these independently — convergence is the proof the thesis is right.
The command center — the living system the governed estate actually runs on.
left: ink — the standard · center: stitched — built twice, merged once · right: teal — the command center
Laid on the engagement arc both sides already use, the merge is almost embarrassingly clean: govrn is the front half, Aperture is the back half, and the build phase is where the two teams work as one.
The baseline: three-lens posture, AI-BOM, product-AI review, cost read, gap report against the standards.
govrn leadsOperating model, decision rights, policy set, autonomy tiers — and the evidence interface spec.
govrn leads · jointThe command center stands up: gateway + spend, policy-as-code, audit layer, control plane — built on the vetted toolchain.
co-buildAperture runs the estate: Mission Control, anomalies, readouts, evals — continuously emitting evidence.
Aperture runsDrawn as a starting point — the shape we would propose, not the shape we have decided. Section 06 is where it gets decided together.
Why the interface matters — a principle, not a preference: independent assessment can't rest solely on the governed system's own reporting — that's basic separation of duties, the same reason auditors don't grade their own books. So the merge keeps two distinct roles by design: Aperture produces the evidence; the govrn assessment consumes and judges it. That separation is precisely what makes the combined product credible to a board, an auditor, or a regulator — neither half can offer that alone.
The shared-spine items aren't duplication to eliminate — each was built from a different vantage point, and the merged version is better than either original:
| Capability | govrn brought | Aperture brought | Merged |
|---|---|---|---|
| Cost lens | Assessment-grade model: spend baseline, right-sizing, recoverable estimate | Live telemetry: gateway-level spend, budgets, alerts, forecasting | One lens, two modes — modeled at baseline, live once connected; the model becomes the forecast check |
| Governance & policy | The vetted toolchain: policy-as-code, machine-readable compliance evidence, LLM audit logging, telemetry standards — selected and framework-mapped | The operational design: governed-onboarding funnel, data-sensitivity classification, vendor/DPA gating | The kit meets the funnel — our tool selections become the build's components; nothing researched twice |
| Inventory | AI-BOM at assessment depth, incl. the AI the company ships | Continuous discovery of internal tools, agents, connectors | One registry, two refresh rates — point-in-time depth + always-on breadth |
| Framework mapping | Working crosswalks across six standards | NIST AI RMF / EU AI Act policy mapping in the rules engine | One crosswalk library feeding both the assessment and the policy engine |
| Reporting | The readout: posture, gaps, remediation path, attestation status | Auto-generated weekly board readouts | Operational cadence + independent verdict — weekly from the platform, attested at re-baseline |
Grace Hill is the right first partner for the merged system, for reasons that are already on the table: generative AI embedded in compliance-sensitive workflows, a regulated domain with a real external forcing function, AI-forward leadership, and a relationship where both halves of this merge are already trusted. Everything below is subject to scoping with Grace Hill — nothing on this page commits them to anything.