govrn-platform — Unified Governance Framework
Internal · 2026-06-07 · v0.1. Governance from all angles, not just security. Three lenses over one technology fleet. Every control maps to a recognized standard (we operationalize, we don't reinvent). See PROTOCOLS-GAPCHECK.md for the sourcing.
The core idea
A point-in-time assessment grades you once and dies. govrn-platform turns each control into a living signal: assessed → monitored → re-scored as the estate moves. One fleet inventory, governed across three lenses, on a dashboard that keeps watching.
┌──────────────────────────────────────────────┐
│ ONE TECHNOLOGY FLEET │
│ apps · databases · integrations · vendors │
│ · infrastructure · AI MODELS (AI-BOM) │
└──────────────────────────────────────────────┘
│ │ │
┌────────▼───────┐ ┌────▼─────────┐ ┌──────▼───────────┐
│ LENS 1 │ │ LENS 2 │ │ LENS 3 │
│ IT-Rationaliz. │ │ Cybersecurity │ │ AI-GOVERNANCE │
│ (the RFP) │ │ (CSF2/CIS) │ │ (the missing one) │
└────────┬────────┘ └──────┬────────┘ └──────┬───────────┘
└──────────────────┴─────────────────┘
│
┌───────────────▼────────────────┐
│ LIVING DASHBOARD (continuous) │
│ posture · signals · threats · │
│ drift · shadow-AI · HITL gate │
└─────────────────────────────────┘
Control schema
Every control across all three lenses shares one shape (mirrors data/types.ts Control):
| field | meaning |
|---|---|
id |
stable control id (e.g. AIG-BIAS-01) |
lens |
it-rationalization | cybersecurity | ai-governance |
domain |
sub-area (e.g. bias-fairness, prompt-injection, identity, rationalization) |
name |
human label |
standardRef |
the recognized standard it maps to (e.g. OWASP LLM01, NIST CSF 2.0: PR.AA, ISO/IEC 42001) |
whatItChecks |
the assessable question |
signalSource |
assessment (one-time) · monitored (continuous) · manual |
maturity |
honesty marker — how real the monitoring is today |
The living mechanism: a control starts signalSource: assessment (graded during the engagement). Where a continuous signal exists (CVE feed, IdP logs, model-eval webhook, drift metric), it graduates to monitored and the dashboard re-scores it automatically. Where no signal exists yet, it stays manual and is honestly labeled — we don't pretend a checkbox is live monitoring.
Lens 1 — IT-Rationalization (carries the MCG engagement)
The existing Delta Gamma deliverables become standing, monitored controls instead of a one-time deck.
| domain | control | what it checks | signal |
|---|---|---|---|
| inventory | Asset inventory completeness | every app/db/integration/vendor catalogued + owner | monitored (IdP/DNS/AP feeds catch new + shadow IT) |
| capability-map | Capability coverage | each business capability mapped to its supporting systems | assessment |
| duplicity | Duplicate/overlap detection | systems delivering the same capability flagged | assessment |
| disposition | Disposition currency | every system has a current retain/replace/retire call | monitored (re-review on contract/usage change) |
| system-of-record | SoR named per domain | one authoritative system per data domain | manual |
| integration | Integration catalog | every integration characterized (source/dest/direction/owner/failure-mode) | assessment |
| roadmap | Roadmap freshness | multi-year roadmap still reflects reality | monitored (drift vs actual) |
| sunsetting | Sunset list defensibility | each retirement has a disposition record + successor | assessment |
| roi | Savings realization | projected savings tracked vs actual (contract/invoice anchored) | monitored |
Standards: this lens is methodology (capability-based rationalization), not a certification standard — it's the program's own methodology, aligned to TOGAF-style capability mapping and COBIT/ITIL governance where useful.
Lens 2 — Cybersecurity (current frameworks)
| domain | control | standardRef | signal |
|---|---|---|---|
| govern | Security governance defined | NIST CSF 2.0: GV | manual |
| identity | Identity & access / MFA coverage | CSF 2.0: PR.AA · CIS v8.1 C5/C6 | monitored (IdP logs) |
| asset-protection | Data encrypted at rest/in transit | CSF 2.0: PR.DS · CIS v8.1 C3 | assessment |
| vuln-mgmt | Vulnerability / CVE exposure | CSF 2.0: ID.RA · CIS v8.1 C7 | monitored (CVE + vendor advisories) |
| detect | Monitoring & logging | CSF 2.0: DE · CIS v8.1 C8 | monitored |
| respond-recover | Incident response + backup/DR tested | CSF 2.0: RS/RC · CIS v8.1 C11 | assessment |
| supply-chain | Third-party / vendor risk | CSF 2.0: GV.SC · CIS v8.1 C15 | monitored (vendor advisories) |
| privacy | Privacy-law applicability + controls | state laws · GDPR · PCI DSS v4.0.1 · FERPA/HIPAA | manual |
Lens 3 — AI-Governance (the surface security misses)
Each maps to the standard from the gap-check. This is the differentiator.
| domain | control | standardRef | what it checks | signal |
|---|---|---|---|---|
| model-inventory | AI-BOM completeness | NIST AI RMF: MAP · ISO 42001 | every model/dataset/prompt/fine-tune inventoried with owner + data-access | monitored (shadow-AI discovery) |
| bias-fairness | Bias / fairness testing | NIST AI RMF: MEASURE · ISO 42005 · EU AI Act | high-impact models tested for disparate outcomes | assessment → monitored (eval webhook) |
| prompt-injection | Prompt-injection / jailbreak defense | OWASP LLM01 · MITRE ATLAS | input-attack surface tested + mitigated | monitored (red-team/eval) |
| data-provenance | Training-data lineage & consent | ISO 42001 · NIST AI 600-1 · EU AI Act | model training/RAG data origin, rights, lineage documented | manual |
| human-oversight | HITL on consequential decisions | EU AI Act Art.14 · OWASP LLM06 | a human gates any action with member/financial impact | assessment |
| drift | Model drift / performance monitoring | NIST AI RMF: MANAGE · ISO 5338 | accuracy/behavior tracked vs baseline | monitored (drift metric) |
| agentic-controls | Agentic autonomy & tool-permissions | OWASP LLM06 · MITRE ATLAS · CSA Agentic | agent tool-scope least-privilege; no excessive agency | assessment |
| foundation-model-risk | Foundation/3rd-party model risk | EU AI Act GPAI · ISO 42001 supplier · Databricks DASF | provider, weights, terms, GPAI obligations tracked | monitored (provider advisories) |
| acceptable-use | AI acceptable-use policy | ISO 42001 · NIST AI RMF: GOVERN | an AI AUP exists, is current, and is enforced | manual |
| transparency | Explainability / disclosure | EU AI Act transparency · CHAI model cards | AI use disclosed to affected people; model cards exist | manual |
| ai-incident | AI-specific incident response | EU AI Act incident reporting · NIST AI 600-1 | playbook for hallucination harm / jailbreak / serious-incident reporting | manual |
Sector overlay (pluggable): health → Joint Commission responsible-AI + CHAI model cards; finance → model-risk-management (SR 11-7); etc. Overlays add domain controls without changing the three-lens core.
Cost & Efficiency — the AI-Tokenomics dimension
Governance is usually sold as risk. But the same discipline that de-risks AI is what makes it cheap and fast — you can't right-size models you haven't inventoried, or cut waste you haven't measured. So govrn carries a cost & efficiency dimension that turns governance into a saver. (Proof: Cloudflare runs 130,000 AI code reviews across 5,000 codebases at ~$1/review — via exactly these controls.)
| domain | control | what it checks | signal |
|---|---|---|---|
| model-right-sizing | Model-tier appropriateness | frontier models used only where they earn it; workhorse / lightweight tiers assigned by task complexity | assessment |
| token-spend | Cost & usage visibility | token cost per model and per workflow tracked; cost-per-value attributable | monitored |
| context-efficiency | Context & caching discipline | prompts/context engineered to avoid waste; caching used; oversized inputs excluded | assessment |
| risk-tiered-compute | Compute scaled to stakes | low-risk tasks get cheap/small models; the full pipeline is reserved for high-stakes | assessment |
| resilience-cost | Model fallback & provider failover | graceful degradation across model tiers/providers (availability + cost) | monitored |
This dimension reuses the AI-BOM (model inventory) and extends it with cost — so it costs little to add and pays for itself. It brings the CFO/CTO to the table: govrn governs AI from security to performance.
Scoring (per-lens posture)
Each lens produces a 0–100 posture score from its ControlAssessment records (see src/scoring.ts): pass=100, partial=50, fail=0, not-assessed excluded but surfaced as coverage-gap. Lens score = mean of assessed controls; overall = weighted mean (weights tenant-configurable). The dashboard shows three lens scores + coverage so a buyer sees both how they're doing and how much isn't yet watched.
Maturity honesty (Richard's "honesty is the moat")
monitored= a real continuous signal exists and re-scores the control.assessment= graded during an engagement; goes stale until re-assessed.manual= human attestation; no automated signal yet.
Shadow-AI discovery, agentic monitoring, and live red-team signals are early — they ship labeled assessment/manual and graduate to monitored as connectors are built (docs/ROADMAP.md). We never render a manual control as if it were live.
How this sells (assessment → AIaaS)
- Engagement (one-time, ~$50K): run all three lenses → deliver the inventory, capability map, disposition, roadmap plus the AI-governance posture nobody else is giving them. The AI lens is the wedge.
- Platform (recurring, AIaaS): the same controls go live on the dashboard; monitoring keeps them current; monthly/yearly fee buys updates, new connectors, enhancements, maintenance. The deliverable stays alive instead of dying — that's the recurring value and the confidence the CTO is buying.