FrameworkAI Governance Operating ModelSheet 57

CADRE (Charter, Authority, Decision rights, Records, Escalation).

A mandate not exercised on a schedule is an intention. The structure, decision rights and cadence of the AI governance function.

← Defensible AI · How the nine relate

§ 01Status

What this is.

REG-07 · AI Governance Operating Model · deliberately unmarked

Position in the architecture · Strategic Compass

Specification · No standalone specification is deposited for this framework. Its authoritative treatment is Chapters 10 and 11 of the Enterprise Playbook, ISBN 978-1-0678960-1-0, read together with the consolidation notice at section 6.2. This page and registry entry REG-07 are the most complete normative statement available in citable form.

Renamed. Three frameworks formerly asserted separately, the Governance Office Blueprint, the RACI-AI Matrix and the Governance Cadence Framework, are now the Structure, Decision rights and Cadence sections of this one. A decision-rights matrix has no operational meaning without a structure to assign the rights within, and a cadence has none without both. The three former names remain valid for citing the work published under them and must not be used for new work.

Why this one is unmarked. The former name, AI Governance Operating Model, is a descriptive phrase in common industry use: hard to register, weak to enforce, and impossible to own. That is the argument that produced CADRE rather than an argument against naming. The descriptive phrase survives as the descriptor, because it is what a reader searching for this subject will type. No trademark clearance search has been run on CADRE. That limitation is stated here for the same reason the corpus states it for the Five-Gate name: an unresolved clearance is a fact about the mark, not a detail to discover later.

The nine frameworks as one architecture The MESA Framework sits at the top as the diagnostic frame supplying four altitudes. Below it, five bands. The Regulatory Floor holds REG-08, the Sharia AI Compliance Framework, which enters as a second authority source. The Strategic Compass holds REG-07, the AI Governance Operating Model, which grants authority. Operational Machinery holds REG-06, the Five-Gate Deployment Model, as the lifecycle spine, fed from below by REG-02 model risk management, REG-04 vendor risk and REG-05 incident response. The Technical Substrate holds REG-03, data governance, which supplies the residency rule set. Beneath the altitudes sits the Boundary Invariant, an unmarked engineering-family law, carrying the BOE Declaration and REG-09, the Cross-Border Patterns, as its worked instance on the residency class. At the base is the evidence layer. Authority flows down the left side; evidence flows up the right. The nine frameworks as one architecture Nabeel Khan 2026 https://doi.org/10.5281/zenodo.22170112 https://doi.org/10.5281/zenodo.22170112 Copyright 2026 Nabeel A. Khan. Licensed CC BY 4.0. Nabeel Khan https://nabeelkhan.com/frameworks/registry THE NINE, AS ONE ARCHITECTURE REG-01 MESA Framework the diagnostic frame. It occupies no altitude AUTHORITY FLOWS DOWN EVIDENCE FLOWS UP ALTITUDE 1 · REGULATORY FLOOR REG-08 Sharia AI Compliance Framework a second binding authority source enters the same machinery as the first ALTITUDE 2 · STRATEGIC COMPASS REG-07 AI Governance Operating Model structure · decision rights · cadence grants the authority exercised below ALTITUDE 3 · OPERATIONAL MACHINERY REG-06 Five-Gate Deployment Model the lifecycle spine. G1 G2 G3 G4 G5 gate entry evidence REG-02 MESA MRM validation and approval REG-04 AVRF third-party AI diligence REG-05 AIRP reads every record below ALTITUDE 4 · TECHNICAL SUBSTRATE REG-03 AI Data Governance Framework supplies the residency rule set the patterns below architect around THE BOUNDARY INVARIANT · UNMARKED · ENGINEERING FAMILY a boundary is a clause the optimizer may not cross, and everything else is optimization BOE Declaration Boundary fixed · Optimizer freed · Evidence REG-09 Cross-Border Patterns worked instance · data residency class EVIDENCE LAYER BOE records · gate records · validations · attestations · reconstruction reports The Defensible AI Framework Registry v1.0 · Nabeel Khan · nabeelkhan.com/frameworks/registry · CC BY 4.0 · DOI 10.5281/zenodo.22170112
Figure 1. The Operating Model grants the authority every other framework operates under.
§ 02On the name, and what the registry currently says

On the name, and what the registry currently says.

CADRE stands for Charter, Authority, Decision rights, Records, Escalation. The five are drawn from the registry entry itself rather than fitted to the letters, which is the same defence MESA uses for its own expansion. Cadre independently means the nucleus of trained people an organisation is built around, which is what this framework specifies. The descriptor remains the AI Governance Operating Model and is not retired; it is what a reader searching for this subject will type. The published registry is version 1.0 and records this entry as "AI Governance Operating Model", unmarked. That file is immutable and the status band above is derived from it, so the two names will differ until registry version 2.0. Registry section 11.1 makes a canonical-name change a major version, and section 11.5 requires the identifier to survive it: this is REG-07 before and after. Cite REG-07, and cite version 1.0 for anything you read there today.

§ 03Three parts

Three parts.

Structure is the office and its place in the three lines. Decision rights assign exactly one person accountable per decision. Cadence is the rhythm on which the function operates and the escalation paths on which disputes terminate. A cadence with no meeting records is not a cadence, and a decision right held by a committee is not a decision right.

§ 04Ninety days

Ninety days.

The source treatment carries a ninety-day path from board mandate to first operating cadence. It exists because the failure mode of a governance mandate is not rejection. It is a charter that is written, approved, and never converted into a meeting that happens.

§ 05Where it applies

Which institutions, and on whose authority.

Any regulated institution

The Operating Model describes how the governance function itself exists, in three lines of defence. It is calibrated to large regulated institutions, and an unadapted structure applied to a small one produces roles nobody holds.

§ 06How it has changed

The record of its own revisions.

A framework that cannot say how it changed reads as though it never has. This is drawn from the registry entry, which versions itself independently of the specification it points at.

Change history

  • 2026-08-30 · entry v1.0 — First registry entry
  • 2026-08-30 · entry v1.0 — Records the consolidation of the Governance Office Blueprint, the RACI-AI Matrix and the Governance Cadence Framework into this framework

Former names. Governance Office Blueprint · RACI-AI Matrix · Governance Cadence Framework. Each remains the correct citation for the work published under it and must not be used for new work.

Limitations recorded in the registry

  • {"kind":"asserted","text":"That the structure fits institutions of different sizes. The source treatment is calibrated to large regulated institutions. A smaller institution MUST adapt the structure and SHOULD record what it adapted."}
  • {"kind":"missing","text":"The consolidation has not been executed in the source book, which continues to assert the three former marks until a natural reprint. This registry is the authoritative statement in the meantime."}
  • {"kind":"scope","text":"Specifies the governance function. Does not specify the competencies, training or individual credentials of the people in it."}

What would show this to be wrong. The Operating Model is falsified if institutions operating a chartered office with a documented single-accountable decision-rights assignment and a recorded cadence are found to escalate AI risks no earlier, and resolve them no more consistently, than institutions handling AI governance within existing risk committees without a distinct structure. The framework's claim is that a dedicated structure with named decision rights changes when and how a risk surfaces.

§ 07Honest limits

What this does not claim.

Scope. Calibrated to large regulated institutions. An unadapted structure applied to a small one produces roles nobody holds.

In progress. The consolidation has not yet been executed in the source book, which continues to assert the three former marks on its copyright page until a natural reprint. The registry is the authoritative statement in the meantime.

§ 08Cite

Citation.

Cite this framework. No standalone specification is deposited. Its authoritative treatment is Chapters 10 and 11 of the Enterprise Playbook, ISBN 978-1-0678960-1-0, read together with the consolidation notice at section 6.2, and its normative statement in citable form is registry entry REG-07 in 10.5281/zenodo.22170112.

§ 09Where this sits

In the practice.

§ 10Ask an assistantLive, no key

Ask your AI assistant instead.

This page is a snapshot, accurate at the release it cites. The same corpus is callable, publicly and without a key, so an assistant can query it live and return an answer carrying the source it came from. For this page that is explain_this_setup and search_knowledge, which do what this page describes rather than describe it again: the first returns how this site's machine layer is actually built, component by component, and the second queries the corpus behind this page and returns matches with the URL each came from. The page states the practice; the tools are the practice.

01 · Connect
claude mcp add --transport http concylium https://mcp.nabeelkhan.com/api/mcp

Claude Desktop, ChatGPT, Cursor, VS Code and Gemini CLI take the endpoint on its own: https://mcp.nabeelkhan.com/api/mcp. No key, no account, nothing to sign. Setup for every client.

02 · Ask

“Using Concylium, call explain_this_setup and tell me whether this site actually implements what its machine-accessible-ai-expertise page claims.”

A category page that survives being audited by the reader's own assistant is doing something a brochure cannot.

Fin · Machine-Accessible Expertise
Point your assistant at the endpoint →