The Engagement — Overview
What AI governance looks like when it is implemented — from first discovery scan to the standing annuity — as one repeatable process, sized to the company.
Confidential · June 2026. This surface describes the govrn delivery model. Where it references Grace Hill's internal estate, those details are ASSUMED — modeled from a mature mid-market B2B SaaS profile and inferred from public OSINT, not confirmed facts about the company. All dollar figures are illustrative placeholders. The Aperture engine is built and tested on SYNTHETIC data; connectors are not yet run live, so we say "modeled" until connected and "measured" after.
What this surface is
Most AI-governance material stops at the framework — a policy, a checklist, a maturity score. This surface starts where that ends. It is the operational picture: what actually happens, who does it, with which tools, against which evidence, when a company hires govrn to take its AI from unmanaged to attested-and-monitored. It is written for the people who deliver the work — the delivery team, leadership, and later the trainees who scale it.
govrn is two things working together. The standard (govrn = See + Prove): a three-lens assessment across Technology, Security, and AI; a review of the AI a company actually ships; independent attestation that is never self-certified; and crosswalks to six frameworks (NIST AI RMF, ISO/IEC 42001, the EU AI Act, OWASP, MITRE ATLAS, and CSF 2.0). And the engine, Aperture (Run): deterministic — no model sits in the measurement path — metadata-only ("pointers, not payloads"), surfacing shadow AI with a dollar figure attached and attributing cost back to its owner. One record, two lenses: the same evidence answers the auditor and the CFO.
The arc
The engagement is a loop, not a project with an end date:
| Stage | What happens | What it produces |
|---|---|---|
| Assess | Run the three-lens scan; inventory the AI estate, including shadow AI; baseline against the six crosswalks. | A measured (modeled, pre-connection) record of where the company actually stands. |
| Design | Translate gaps into controls, policy-as-code, and an evidence pipeline. | A target-state design and a remediation plan, sequenced by risk and cost. |
| Implement | Stand up controls, instrument the AI systems, wire telemetry into the record. | Live governance plumbing — controls running, evidence flowing. |
| Operate | Continuous metadata-only measurement; cost and risk attributed in near-real-time. | A standing system of record that stays current as the estate changes. |
| Attest | The independent body reviews the fresh record and issues attestation. | A defensible, point-in-time attestation backed by evidence, not assertion. |
| Re-baseline | The record drifts the moment systems change; measurement restarts. | The annuity — continuous assurance, because an attestation is only valid against a current record. |
The re-baseline is the whole economic argument. An AI estate is not static; models get swapped, prompts change, new tools enter through a corporate card nobody cleared. An attestation against last quarter's record is a photograph of a system that no longer exists. Continuous measurement is what keeps the proof true — and that is why this is a relationship, not a one-time audit.
A structural note on independence: the body that builds and runs the governance is separate from the body that attests to it. That separation is the intended structure; today govrn is pre-entity, so we state it as design intent, not an accomplished fact.
Why Grace Hill
Throughout this surface we use one worked example rather than abstractions. Grace Hill is a property-management compliance and training SaaS company that ships Gracie, a generative-AI assistant embedded directly in compliance-sensitive workflows — fair-housing and tenant-screening territory, where a wrong answer is a regulatory event, not a typo. Its CTO is Chris Fontan and its leadership is AI-forward. That makes it the right teaching case: a real company, shipping real AI, into exactly the kind of high-consequence workflow the standard exists to govern. We know its public footprint from prior OSINT; everything about its internal estate in these pages is explicitly modeled and labeled ASSUMED.
How to read the rest of this surface
- The Walkthrough — Grace Hill carried end to end through every stage of the arc.
- The Process — the repeatable method, decoupled from any one client.
- The Team — the five people delivering today and the roles we hire as we scale.
- The Toolchain — the vetted build kit, by capability.
- The Estate — how we model an internal AI estate (Grace Hill, ASSUMED).
- Training — how a new assessor is brought up the curve.
- Pricing — how the engagement is sized and priced to the company.
The frame for all of it: this is a repeatable process, sized to the company. The same arc runs for a two-product startup and a multi-estate enterprise — the depth changes, the method does not.