How we build governance at scale.
The technical approach: a phased, tool-driven, human-validated governance assembly. From discovery to live dashboard. This is what the sales pitch becomes when engineering builds it.
The guiding principle.
Governance is a **live system, not a one-time report.** Every phase feeds the next; every tool output becomes the input to the next tool. Humans decide and validate; machines discover and measure.
The thesis: A repeatable, tool-enabled, human-validated engagement that scales from one client to a thousand. Discovery → Assessment → Implementation → Operations. The dashboard is where it all lives.
Inventory the AI estate. Find the gaps.
We map what's actually running, not what's supposed to be. Three discovery lenses: IT systems (what's deployed), shadow AI (what's unauthorized), and governance gaps (what's missing).
What we do
- System inventory — automated asset discovery via cloud SDKs (AWS/Azure/GCP), on-prem scanners, and network-level telemetry.
- AI tool discovery — GenAI/Copilot adoption tracking (user telemetry + API logs) + shadow-AI detection (unapproved tools, network DNS/proxy analysis).
- Standards mapping — cross-reference all systems against NIST AI RMF, ISO 42001, CIS v8.1, EU AI Act, OWASP Top 10.
- Gap analysis — identify what's exposed, what's unmonitored, what has no policy.
Tools we deploy
- Nexthink AI-DRIVE (if client already has it) — adoption + shadow-AI + ROI telemetry reuse.
- Cloud SDKs (boto3, azure-sdk, google-cloud) — automated asset enumeration.
- Custom discovery harness — ingests telemetry, dedupes, normalizes to our data model.
- NIST/ISO corpus (static, regulatory text) — real-time standard-to-finding mapping.
Effort & timeline
- **2–3 weeks** for most mid-market enterprises (<5k users, <200 AI models).
- **Data collection**: 1–2 weeks (APIs, logs, surveys).
- **Analysis & readout**: 1 week.
- **Scaling factor**: +1 week per 10x scale (5K→50K users, for example).
Score the posture. Define the standards.
We take the inventory, score it against three lenses (IT-Rationalization, Cybersecurity, AI-Governance), and produce a defensible, standards-mapped control inventory.
What we do
- Control assessment — evaluate each asset/model against a curated control library (NIST AI RMF domain-level controls, CIS Benchmarks, OWASP, ISO 42001 chapters).
- Risk scoring — pass/partial/fail per control; severity roll-up; coverage gaps.
- Framework mapping — link every finding to at least one regulatory standard (so if the board asks "are we NIST-compliant?", the answer is data-backed).
- Three-lens posture — score IT, security, and AI separately, so accountability is clear (who owns what, by lens).
- Attestation firewall — findings (what we discovered) are separate from attestations (what we certify). Only humans sign the attestation.
Tools we deploy
- Assessment engine (custom TypeScript/SQL) — scores inventory against control matrix, produces structured findings.
- NIST/ISO/CIS corpus — database of control definitions + cross-references.
- Scoring & aggregation — SQL rollups for lens-level + org-level posture.
- Evidence database — tracks every finding with its source (asset ID, config check, log entry).
Effort & timeline
- **2–4 weeks** depending on discovery completeness.
- **Assessment**: 1–2 weeks (control-by-control evaluation).
- **Scoring & analysis**: 1 week.
- **Readout prep**: 1 week (slides, findings narrative, exec summary).
Build the governance system. Stand up the controls.
We take the assessment, fill the critical gaps, and operationalize the controls. What we build: a control registry, decision gates, monitoring hooks, and the dashboard that lives it all.
What we build
- Control registry (database + API) — the single source of truth for what's required, who owns it, what its status is.
- Decision gates — intake workflows for new AI models/tools (approval, routing, escalation).
- Monitoring hooks — agents that watch for drift (is the approved control still in place? Is there an unapproved tool in use again?).
- Audit trail — immutable record of every decision, change, remediation.
- Dashboard** (the operational interface) — live posture, findings, controls, attestations, audit log.
Architecture & tools
- Control registry (PostgreSQL + REST API, TypeScript).
- Intake engine (Node.js state machine + human approval workflow).
- Monitoring layer (Cloud Functions / Lambda, scheduled; can integrate Nexthink AI-DRIVE if client has it).
- Audit/logging (immutable append-only events to S3 + database).
- Dashboard** (React/Next.js, real-time SSR from control registry).
Effort & timeline
- **4–8 weeks** depending on scope and client infrastructure.
- **Registry design & MVP**: 1–2 weeks.
- **Intake engine + monitoring**: 2–3 weeks.
- **Dashboard**: 1–2 weeks (if Figma mockups exist).
- **Testing & hardening**: 1 week.
Run it. Monitor it. Evolve it.
The system is now live. The dashboard is where decisions live. We monitor for drift, ingest new data, flag new risks, and keep the board updated.
Operational responsibility
- Daily monitoring — agents run 24/7; drift alerts surface within hours.
- Intake processing — every new model/tool flows through the decision gate; we route and escalate.
- Dashboard maintenance — keep the live posture accurate; ingest new telemetry.
- Board cadence — monthly/quarterly reports: posture trends, remediation progress, new findings, forward-looking risk.
- Continuous improvement — as new standards emerge (EU AI Act updates, NIST revisions), the control library evolves; findings re-score automatically.
Tools in motion
- Monitoring agents (Lambda/Functions, CI/CD integrations).
- Telemetry ingestion (Firehose/Pub-Sub, normalizing vendors' APIs into our schema).
- Alerting (PagerDuty / Slack / email, rule-driven).
- Reporting engine (SQL → PDF/slides, automated or on-demand).
Effort & timeline
- **Ongoing**. Start with 40% FTE (1 engineer + 0.5 analyst) per engagement, scale down to 20% as stability increases.
- **Month 1**: daily operational handoff + training.
- **Months 2–3**: proactive monitoring, findings triage, roadmap.
- **Month 4+**: predictable steady-state (drift alerts, quarterly deep-dives).
Who does the work. When they're needed.
| Role | Effort | Duration | Responsibilities |
|---|---|---|---|
| Engagement Lead (Senior Architect) | 50% | Entire engagement + ops ramp | Discovery scoping, assessment design, control library curation, board-readiness sign-off, ongoing strategy. |
| Discovery Engineer | 100% | Weeks 1–3 | Cloud SDK work, telemetry collection, data normalization, inventory assembly. |
| Assessment Analyst | 100% | Weeks 4–7 | Control-by-control scoring, risk analysis, framework mapping, findings narrative. |
| Full-Stack Engineer (Implementation) | 100% | Weeks 8–15 | Registry design, API, intake engine, monitoring layer, dashboard. |
| DevOps / SRE | 50% | Weeks 6–16 + ongoing | Infrastructure, CI/CD, monitoring, logging, security posture of the platform itself. |
| Operations Lead (ongoing) | 50% | Month 1 onwards | Daily monitoring, incident response, findings triage, board reporting, roadmap. |
Scaling notes: For large orgs (10k+ users, 500+ AI models), add a second discovery engineer + a dedicated data engineer for ETL/telemetry normalization. For heavily regulated industries (finance, health), add a compliance officer to the assessment phase.
From kick-off to live dashboard.
Standard engagement (mid-market)
- Weeks 1–3: Discovery. Inventory assets, shadow AI, gaps.
- Weeks 4–7: Assessment. Score controls, map standards, findings narrative.
- Weeks 8–15: Implementation. Build registry, gates, monitoring, dashboard.
- Weeks 16–17: Testing, training, go-live prep.
- Total: ~4 months** (can compress to 3 with parallel workstreams).
Total effort estimate
- **Discovery**: 6–8 person-weeks.
- **Assessment**: 8–10 person-weeks.
- **Implementation**: 20–24 person-weeks.
- **Operations ramp (month 1)**: 4–6 person-weeks.
- Blended**: ~20–25 FTE-weeks across the team.
Acceleration path: If the client already has Nexthink AI-DRIVE (or similar telemetry vendor), discovery compresses to 1 week — we reuse their adoption/shadow-AI signal, cutting 30% off the overall timeline.
What we ship. Why we chose it.
Discovery & assessment
- Cloud SDKs (boto3, azure-sdk-js, google-cloud) — native, vendor-maintained, no external dependencies.
- PostgreSQL — control registry + evidence store.
- TypeScript/Node.js — assessment engine, scoring logic, normalization.
- OpenTelemetry (optional intake layer) — vendor-agnostic telemetry ingest if client has Datadog/New Relic/etc.
Implementation & operations
- PostgreSQL + PostgREST API — control registry as a service.
- Node.js/Express — intake orchestration, monitoring agents, APIs.
- AWS Lambda / Azure Functions / Google Cloud Functions — serverless monitoring agents (cost-efficient, auto-scale).
- React / Next.js — dashboard (server-side rendering for performance + security).
Integration layer (Aperture, if used)
[Placeholder for Aperture details — Richard to provide integration points, data flows, and why Aperture is the right choice for [specific capability]. Once confirmed, we map Aperture into the architecture above.]
Where it all lives. How it talks.
The dashboard is the operational interface. It's fed by all the upstream systems: discovery telemetry, assessment scores, implementation control state, operational monitoring signals.
Dashboard feeds & flows
- Discovery layer → Inventory API → dashboard (asset card, system status).
- Assessment layer → Control scores API → dashboard (posture gauge, findings list, trend chart).
- Implementation layer → Control state API → dashboard (gate status, remediation progress, decision history).
- Operations layer → Monitoring alerts API → dashboard (drift alerts, policy violations, audit log).
- Nexthink / Aperture / other vendor → telemetry ingest → our normalization → feeds all layers.
Dashboard lenses (dual-use design)
- Operational view (IT/compliance teams): live inventory, control status, decision queue, alerts. Real-time, actionable.
- Strategic view (board/executive): posture trends, risk reduction, compliance timeline, ROI. Monthly snapshots.
- Analyst view (engagement lead): findings deep-dive, evidence trail, control effectiveness, forecasting. Quarterly planning.
The prize: One source of truth. One dashboard. Three audiences (operations / exec / analyst), one dataset, one audit trail. Governance becomes a live operational system, not a filing cabinet.
What we're building for you.
A repeatable, tool-enabled, human-validated system that can be stood up in 4 months, operated by your team for years, and extended as standards evolve. Not a report. Not a consulting slide deck. A live governance platform.
Questions about discovery tools? Assessment methodology? Integration with your existing vendors? Send them to the lead. That's what the engagement is for.