AI Governance Engineer

The stack

Five layers. One evidence chain.

The reference architecture of AI governance engineering: five layers that turn governance from a stack of parallel documents into one system with a data path from policy to proof.

Layer flow

Follow one artefact from policy to proof.

Evidence flows up 05 Assurance & Continuous Compliance 04 Runtime Controls & Observability 03 Evals & Red Teaming as Evidence 02 Inventory & Transparency 01 Govern-as-Code

Layer 01 · Govern-as-Code

A policy verdict tied to a commit, a pull request or a deploy — machine-readable and reproducible.

Artefacts

  • Policy-as-code library under version control
  • Crosswalks that map each policy to the frameworks it serves
  • CI/CD wiring that runs the policy at the right gate
  • A structured policy verdict (allow/deny, rule id, input hash, timestamp) per evaluation

Maps to

  • EU AI Act Art. 9 (risk management)
  • ISO/IEC 42001
  • NIST AI RMF (Govern)
  • CSA AICM
  • OWASP Agentic ASI02/ASI03
Read layer 01 in chapter 04
Evidence flows up: each layer emits a structured artefact that layer 05 aggregates into audit-ready assurance.

How to read it

A build order, from policy to proof.

  1. A build order, not an org chart Each layer produces an artefact the layer above consumes: Policy → Inventory → Evals → Runtime → Assurance.
  2. Evidence flows up A policy verdict, a registry entry, an eval result and a guardrail decision are structured artefacts that layer 05 aggregates into audit-ready evidence.
  3. It answers the three questions What AI is running, what it is allowed to do, and what evidence proves it — kept true as the system changes underneath.

Read in chapter 04

The five layers

Policy, inventory, evals, runtime, assurance.

Govern-as-Code

Write the rule as code

Inherited
Question it answers
What is it allowed to do?
What it proves
A policy verdict tied to a commit, a pull request or a deploy — machine-readable and reproducible.
Artefacts
  • Policy-as-code library under version control
  • Crosswalks that map each policy to the frameworks it serves
  • CI/CD wiring that runs the policy at the right gate
  • A structured policy verdict (allow/deny, rule id, input hash, timestamp) per evaluation
Tool categories
  • Policy engines
    • OPA/Rego
    • Cedar
  • Machine-readable policy artefacts (proposed)
    • Policy Cards
Maps to
  • EU AI Act Art. 9 (risk management)
  • ISO/IEC 42001
  • NIST AI RMF (Govern)
  • CSA AICM
  • OWASP Agentic ASI02/ASI03
Read layer 01 in chapter 04

Inventory & Transparency

Inventory what is running

Inherited
Question it answers
What AI is running?
What it proves
A registry entry and its attached documents, ideally written by a deployment pipeline rather than typed by hand.
Artefacts
  • Agent registry: the runtime-aware inventory of every model, service and agent, each with an owner, a scope and a status
  • Transparency documents — model cards and data cards
  • AIBOM, the bill of materials for an AI system
  • FRIA and DPIA references linked to the registry entry
Tool categories
  • Registries and governance suites
    • ServiceNow
    • Credo AI
  • Agent-discovery tools
    • Zenity
  • AIBOM formats and generators
    • CycloneDX ML-BOM
    • SPDX 3.0 AI profile
    • OWASP AIBOM generator
Maps to
  • EU AI Act Art. 11 (technical documentation)
  • EU AI Act Art. 49/71 (registration and the EU database)
  • EU AI Act Art. 50 (transparency)
  • ISO/IEC 42001
  • NIST AI RMF (Map)
  • CSA AICM
  • OWASP Agentic ASI10
Read layer 02 in chapter 04

Evals & Red Teaming as Evidence

Run evals as evidence

New
Question it answers
What evidence proves it?
What it proves
A structured eval result — pass or fail against a threshold, versioned alongside the model it tested.
Artefacts
  • Eval suites and the eval gate that runs them
  • Capability and quality evals (groundedness, regression against a golden set)
  • Adversarial and red-team evals (jailbreaks, prompt injection, tool misuse)
  • Safety-threshold evals tied to a policy from layer 01
Tool categories
  • Evaluation frameworks
    • Inspect
    • promptfoo
    • DeepEval
  • Adversarial and vulnerability probes
    • Garak
    • Mindgard
    • Giskard
  • Retrieval-augmented quality
    • Ragas
Maps to
  • EU AI Act Art. 15 (accuracy, robustness, cybersecurity)
  • EU AI Act Art. 55 (GPAI systemic-risk evaluation)
  • ISO/IEC 42001
  • NIST AI RMF (Measure)
  • CSA AICM
  • OWASP Agentic ASI01/ASI02
Read layer 03 in chapter 04

Runtime Controls & Observability

Hold the line at runtime

New
What it proves
A stream of runtime decisions and traces.
Artefacts
  • Guardrails: input/output filters and tool-call mediation at the enforcement point
  • Observability: tracing and monitoring that turn agent behaviour into a control signal
  • Agent runtime identity: a workload identity, a bounded scope and a tested kill switch per actor
Tool categories
  • Guardrail frameworks
    • NVIDIA NeMo Guardrails
    • Meta LlamaFirewall
    • Lakera
  • Observability
    • Langfuse
    • Arize Phoenix
    • OpenTelemetry
  • Agent workload identity
    • SPIFFE/SPIRE
    • Microsoft Entra Agent ID
    • Okta Agent SSO
Maps to
  • EU AI Act Art. 14 (human oversight)
  • EU AI Act Art. 15 (robustness, cybersecurity)
  • EU AI Act Art. 12 (logging)
  • ISO/IEC 42001
  • NIST AI RMF (Manage)
  • CSA AICM
  • OWASP Agentic ASI02/ASI03/ASI10
Read layer 04 in chapter 04

Assurance & Continuous Compliance

Close with continuous assurance

Inherited
Question it answers
What evidence proves it?
What it proves
A live assurance store that any of the lower layers writes into and an auditor can read from.
Artefacts
  • Machine-readable evidence in a standard format (OSCAL)
  • Framework mappings generated from the evidence, not maintained beside it
  • Incident and reporting plumbing that meets obligations on the clock
Tool categories
  • Evidence format
    • OSCAL
  • GRC and AI-governance suites
    • Vanta
    • Drata
    • OneTrust
    • watsonx.governance
    • Holistic AI
    • Saidot
Maps to
  • EU AI Act Art. 17 (quality management)
  • EU AI Act Art. 72 (post-market monitoring)
  • EU AI Act Art. 73 (serious incident reporting)
  • ISO/IEC 42001, ISO/IEC 42005
  • NIST AI RMF (Govern, Manage)
  • CSA AICM
Read layer 05 in chapter 04

Inherited and new

Three layers inherited, two the AI forces.

Inherited from GRC engineering

Govern-as-Code (01), machine-readable evidence and Assurance & Continuous Compliance (05) come almost unchanged from GRC engineering — a specialisation of a method that already works.

New, forced by AI

Evals and red-teaming as controls (03) and agent identity and runtime control (04) are what AI forces the discipline to add: a model whose behaviour must be tested and an autonomous actor acting under delegated authority have no analogue in classic GRC.

Minimum viable stack

The spine, thinly, for a team of one.

A team of one cannot build all five layers at depth, but it can build the spine thinly, end to end — one vertical slice that touches every layer beats one layer built out and four left on paper.

  1. Layer 02 first, minimally A registry that a deploy writes to, with an owner and a scope per entry, so you can answer "what is running and who owns it?" from a live source.
  2. One policy in layer 01 with teeth A single rule that matters — no deploy without a registered owner, or a data-residency check — as code, in the pipeline, blocking on failure.
  3. One eval gate in layer 03 One adversarial eval against your highest-risk agent, wired so a regression fails the build; reuse an open framework rather than writing your own harness.
  4. Identity and a kill switch in layer 04 Every agent under its own identity with a scope, and a tested way to stop it — the cheapest control with the largest blast-radius reduction.
  5. Evidence as a by-product in layer 05 Have each of the above emit a structured, timestamped record into one store; not an OSCAL pipeline yet, just a refusal to rely on screenshots.

Read in chapter 04

The tools

Categories are the substance; brands are illustrative.

Category Tool Layer
Policy engines OPA/Rego 01
Cedar
Machine-readable policy artefacts (proposed) Policy Cards 01
Registries and governance suites ServiceNow 02
Credo AI
Agent-discovery tools Zenity 02
AIBOM formats and generators CycloneDX ML-BOM 02
SPDX 3.0 AI profile
OWASP AIBOM generator
Evaluation frameworks Inspect 03
promptfoo
DeepEval
Adversarial and vulnerability probes Garak 03
Mindgard
Giskard
Retrieval-augmented quality Ragas 03
Guardrail frameworks NVIDIA NeMo Guardrails 04
Meta LlamaFirewall
Lakera
Observability Langfuse 04
Arize Phoenix
OpenTelemetry
Agent workload identity SPIFFE/SPIRE 04
Microsoft Entra Agent ID
Okta Agent SSO
Evidence format OSCAL 05
GRC and AI-governance suites Vanta 05
Drata
OneTrust
watsonx.governance
Holistic AI
Saidot

Read the stack in full.

The full reference architecture, layer by layer, with the mappings and the evidence.

Read chapter 04 in full Open the Body of Knowledge