The architecture underneath every product.
The AI Governance Infrastructure is one architecture, not a suite of tools. This page answers one question, why seven products behave as one platform, and it describes mechanism rather than catalogue: what intercepts an operation, what it writes down, and why anyone should believe the result.
Three failures, none of them solved by a dashboard.
A claim with no record
An AI system acts. Afterwards there is an output and a log, and nothing that ties the two together. The action cannot be reconstructed because nothing captured it while it happened.
A record nobody can check
A record exists, and its integrity rests on the assurance of whoever stored it. An auditor is asked to trust the storage rather than examine the evidence.
A check that needs the vendor
Verification runs inside the product that produced the record. The proof and the thing being proved share a supplier, so the check establishes nothing an outsider can rely on.
Each of the three is a structural problem. A reporting layer added afterwards inherits all three, because it reads whatever the system happened to leave behind. The architecture below exists to address them at the point the operation occurs.
Before, not after.
Intent
The agent states what it is about to do.
Evaluation
The runtime checks it against the adopted policy.
Outcome
The operation proceeds, or it does not.
Record
Either outcome is written down.
Synchronous
The evaluation completes before the operation continues. There is no queue.
Deterministic
The same operation against the same policy returns the same result.
No model
No language model sits in the evaluation path. Nothing is inferred.
In-process
No remote call is made to reach a decision.
Because execution is synchronous and deterministic, the product has no progress bar, no estimated completion and no spinner. By the time a result renders, the run is over. That is a consequence of the architecture rather than a decision about the interface.
Three record types. One layer.
What happened
The operation as it occurred: what was requested, what the policy returned, what followed.
Proof it happened
A sealed statement bound to one envelope by its digest, carrying the time it was sealed.
Where it came from
The origin of the operation: which agent, which surface, which version produced it.
Content-addressed
A record is identified by the digest of its own bytes. Changing any part of it changes its identity, so a modified record is not a modified record. It is a different one, and the reference to the original stops resolving.
Written once
There is one evidence layer, and every surface reads it. No product keeps a private copy, so there is nothing to reconcile and no second version of what happened.
A record with no actor proves nothing.
What performed it
Named at the moment of the operation, with the version it was running. Not attached afterwards from a log.
What it was permitted
The scope in force when it acted. A later change to permissions does not rewrite what was true then.
On whose behalf
Owner and organisation scope, so a record can be placed without an external mapping table.
Identity here is a property of the record, not a login.
The architecture does not issue credentials to agents. It writes down the identity the operation already carried, so that accountability survives the session that produced it.
It is why a record remains meaningful years later.
The three fields are inside it, addressed by the same digest, and cannot drift from it.
The platform is not in the path of its own proof.
- The record is published together with the digest of its bytes.
- Anyone holding the record recomputes that digest themselves.
- The two either match or they do not. Nothing else is consulted.
proof/provenance.json
- We published
- f042bf6c191f12bd…41c16ff061febb25
- Your browser computed
- not checked not checked
Recomputed in your browser from the bytes you received. Nothing was sent anywhere.
This is the architectural answer to failure 03. A verification that depends on the vendor establishes nothing to a third party. A verification anyone can run without us is the only kind that survives an audit we are not present for.
Nothing is enforced that was not adopted.
- Unit
- A pack. A named, versioned set of rules, adopted as a whole.
- Adoption
- Explicit. A pack that has not been adopted has no effect on anything.
- Evaluation
- At the runtime, at the moment of the operation, not in a report afterwards.
- Result
- Recorded in the envelope, so the decision and its reason are part of the record.
- Distribution
- Metadata only. Nothing is executed or downloaded to obtain a pack.
- eu_ai_act
- nist_ai_rmf
- iso_42001
Four dimensions that never combine.
- Completeness
- How much of what could be recorded was recorded.
- Integrity
- Whether the bytes still match the digest that names them.
- Freshness
- When the record was written, stated as a time and not as a judgement.
- Verification
- Whether anyone has actually checked it, and who could.
The architecture refuses to compose these into a single number.
A composite would be arithmetically possible and diagnostically useless: it cannot tell you which dimension failed, and every reader would have to reverse it to act.
So each dimension stays independently visible.
A surface that wants to summarise has to say which one it is talking about.
Proving something is not the same as revealing it.
The record
Its payload
Its context
A statement about it
A proof of that statement
Nothing else
Why the architecture needs this
A record that can only be trusted by being handed over cannot be used across a boundary: between a supplier and a regulator, or between two organisations that do not share data.
What it is not
Not redaction, which removes content and asks to be believed. The proof stands on its own, and the withheld payload is not a gap in it.
Evidence outlives the thing that produced it.
The file
A hash function
This platform
An account, a licence or a network
Export is not a way out of the architecture.
It is the architecture’s native form: records are files, addressed by the digest of their own bytes, in a shape that does not require the producer to interpret it.
Which means the strongest argument against lock-in is not a policy.
It is that the record was never held hostage in the first place.
Local-first is a property, not a mode.
0 bytes
leave the perimeter to reach a decision. No telemetry is required for the runtime to function.
No service
sits in the path of an assessment. There is no hosted component to be unavailable.
No CDN
and no external asset is fetched by the product interface. It renders offline and air-gapped.
Your storage
holds every record. Evidence is written where you deploy, and stays there.
These are architectural facts, not deployment promises. A product that must reach a vendor to answer cannot be made sovereign by contract; one that never reaches out does not need to be.
The runtime is a library, not a service.
Adding an interface adds a copy of the governance logic. Two interfaces can then disagree about the same operation, and the disagreement is invisible until an audit finds it.
Adding an interface adds no engine, no store and no second policy path. It cannot reach a different outcome, because there is only one place the outcome is computed.
This is the property that makes the entry point uninteresting.
Whether an operation arrives from an editor, a script, a typed service or a screen, it is evaluated by the same code against the same adopted policy and written into the same record.
It is also why a new kind of client needs no new architecture.
One runtime, one governance model, one evidence model, one trust model: the surface is a detail of delivery, not a component of governance.
The layer reference lives in the documentation: Architecture names the five layers, their identifier prefixes and the deployment shapes. This page is the argument; that page is the reference.
Not knowing is a state, not a gap.
Everything that could look, looked.
The search completed and matched nothing. That is a finding about the estate.
Nothing could look.
The probe never reached the subsystem. That is a finding about the observation, not the estate.
Eight states, no overlap
Each carries a word, a glyph and a colour. Two states may not share a glyph or a label, and the system refuses to start if they do.
A refusal needs a reason
An answer of unknown without a stated cause is rejected at load. The reason ships with the state.
No composite anywhere
Coverage renders as a ratio. There is no score, no grade, no percentage and no severity field to rank one finding above another.
Two questions on the executive screen are answered cannot tell permanently, because nothing is stored to compare against. The architecture refuses to answer them rather than presenting an absence of history as an absence of change.
What this architecture does not do.
- It does not certify
- Findings are evidence about what happened. They are not a certification and not legal advice.
- It does not rank
- No capability produces a severity, so nothing orders one finding above another. Findings are read, not sorted.
- It does not remember
- A run is not persisted as a posture, so no period-over-period comparison is available.
- It does not predict
- Nothing forecasts risk. The architecture reports what occurred, not what may occur.
- It does not interpret
- No language model sits between the evidence and what is shown. Nothing is summarised into a conclusion.
- It does not replace judgement
- The platform is advisory. It establishes what is true; deciding what to do about it stays with a person.
An architecture is defined as much by what it refuses as by what it produces.
Every boundary above exists because the alternative would require inventing something. The products built on this architecture inherit all of it, including the refusals. Seven of them ship today, and not one is a separate application. Each is a view of this single architecture, which is why adopting a second one adds reach rather than another system to run.
This cannot be assembled afterwards.
Both architectures below produce a screen an executive can read. Only one of them was present when the operation happened. That difference is not one of quality or completeness. It is a matter of position in the path, and position cannot be retrofitted.
Governance assembled after the fact
01 The operation runs.
The decision is already made
02 A log line is emitted describing it.
03 The line is shipped, parsed and stored.
04 A pipeline reconciles it with other sources.
05 A dashboard renders the result.
Every step is an observation of something that has finished. The architecture has no position from which to withhold anything, so its output is a description, and its integrity begins wherever the description was first written down.
Governance designed into the path
01 The operation is declared before it runs.
The decision happens here
02 The adopted policy is evaluated in-process.
03 The operation proceeds, or it does not.
04 Either outcome is written and sealed at that moment.
05 Every surface reads that record. None keeps a copy.
The same position that decides is the position that records. The record is not a description of the operation. It is a byproduct of it, produced whether or not anyone was watching, and bound to it before anything downstream exists.
The moment of decision
A control that reads the record after the operation can report, escalate and alert. It cannot decline, because the thing it would decline is finished. Prevention is not a stronger form of detection; it is a different position in the sequence.
What did not happen
Collected records hold what occurred. They cannot hold what was stopped, and they cannot separate nothing matched from nothing was looking. Those leave the same trace afterwards, and only the runtime was in a position to tell them apart.
When integrity starts
Sealing a record later proves the record has not changed since it was sealed. It says nothing about the interval before that, which is exactly the interval a reader is asking about. Integrity has a start time, and the start time is a design decision made once.
Architecture A is not a failure of engineering. It is the correct architecture for a different question: what happened across a fleet of systems nobody controls. It becomes wrong only at the moment somebody asks it to answer for a decision it was never present for.
Governance is not a layer added to a system. It is a position inside it, chosen before the first operation runs.
Everything in the preceding thirteen chapters follows from that one ordering. The record format, the refusals, the locality, the eight states a reader can be told. None of them are features assembled around a product. They are what remains available once the decision to be in the path has already been made. Every product inherits that one decision, which is the whole reason they behave as one platform instead of seven applications that agree to exchange data.
See the platform on your own evidence.
An assessment runs on your own infrastructure and needs no account.