FrameworkAI Governance Operating ModelSheet 57

A mandate not exercised on a schedule is an intention.

The structure, decision rights and cadence of the AI governance function.

← Defensible AI

§ 01Status

What this is.

REG-07 · AI Governance Operating Model · deliberately unmarked

Position in the architecture · Strategic Compass

Specification · No standalone specification is deposited for this framework. Its authoritative treatment is Chapters 10 and 11 of the Enterprise Playbook, ISBN 978-1-0678960-1-0, read together with the consolidation notice at section 6.2. This page and registry entry REG-07 are the most complete normative statement available in citable form.

Renamed. Three frameworks formerly asserted separately, the Governance Office Blueprint, the RACI-AI Matrix and the Governance Cadence Framework, are now the Structure, Decision rights and Cadence sections of this one. A decision-rights matrix has no operational meaning without a structure to assign the rights within, and a cadence has none without both. The three former names remain valid for citing the work published under them and must not be used for new work.

Why this one is unmarked. The name is a descriptive phrase in common industry use. Asserting a mark on it would be hard to register, weak to enforce, and would invite exactly the criticism the consolidation exists to remove. The value of this framework sits in its artifacts, which are the charter, the decision-rights assignment and the cadence calendar, and not in the exclusivity of its name.

The nine frameworks as one architecture The MESA Framework sits at the top as the diagnostic frame supplying four altitudes. Below it, five bands. The Regulatory Floor holds REG-08, the Sharia AI Compliance Framework, which enters as a second authority source. The Strategic Compass holds REG-07, the AI Governance Operating Model, which grants authority. Operational Machinery holds REG-06, the Five-Gate Deployment Model, as the lifecycle spine, fed from below by REG-02 model risk management, REG-04 vendor risk and REG-05 incident response. The Technical Substrate holds REG-03, data governance, which supplies the residency rule set. Beneath the altitudes sits the Boundary Invariant, an unmarked engineering-family law, carrying the BOE Declaration and REG-09, the Cross-Border Patterns, as its worked instance on the residency class. At the base is the evidence layer. Authority flows down the left side; evidence flows up the right. The nine frameworks as one architecture Nabeel Khan 2026 https://doi.org/10.5281/zenodo.22170112 https://doi.org/10.5281/zenodo.22170112 Copyright 2026 Nabeel A. Khan. Licensed CC BY 4.0. Nabeel Khan https://nabeelkhan.com/frameworks/registry THE NINE, AS ONE ARCHITECTURE REG-01 MESA Framework the diagnostic frame. It occupies no altitude AUTHORITY FLOWS DOWN EVIDENCE FLOWS UP ALTITUDE 1 · REGULATORY FLOOR REG-08 Sharia AI Compliance Framework a second binding authority source enters the same machinery as the first ALTITUDE 2 · STRATEGIC COMPASS REG-07 AI Governance Operating Model structure · decision rights · cadence grants the authority exercised below ALTITUDE 3 · OPERATIONAL MACHINERY REG-06 Five-Gate Deployment Model the lifecycle spine. G1 G2 G3 G4 G5 gate entry evidence REG-02 MESA MRM validation and approval REG-04 AVRF third-party AI diligence REG-05 AIRP reads every record below ALTITUDE 4 · TECHNICAL SUBSTRATE REG-03 AI Data Governance Framework supplies the residency rule set the patterns below architect around THE BOUNDARY INVARIANT · UNMARKED · ENGINEERING FAMILY a boundary is a clause the optimizer may not cross, and everything else is optimization BOE Declaration Boundary fixed · Optimizer freed · Evidence REG-09 Cross-Border Patterns worked instance · data residency class EVIDENCE LAYER BOE records · gate records · validations · attestations · reconstruction reports The Defensible AI Framework Registry v1.0 · Nabeel Khan · nabeelkhan.com/frameworks/registry · CC BY 4.0 · DOI 10.5281/zenodo.22170112
Figure 1. The Operating Model grants the authority every other framework operates under.
§ 02Three parts

Three parts.

Structure is the office and its place in the three lines. Decision rights assign exactly one person accountable per decision. Cadence is the rhythm on which the function operates and the escalation paths on which disputes terminate. A cadence with no meeting records is not a cadence, and a decision right held by a committee is not a decision right.

§ 03Ninety days

Ninety days.

The source treatment carries a ninety-day path from board mandate to first operating cadence. It exists because the failure mode of a governance mandate is not rejection. It is a charter that is written, approved, and never converted into a meeting that happens.

§ 04Honest limits

What this does not claim.

Scope. Calibrated to large regulated institutions. An unadapted structure applied to a small one produces roles nobody holds.

In progress. The consolidation has not yet been executed in the source book, which continues to assert the three former marks on its copyright page until a natural reprint. The registry is the authoritative statement in the meantime.

§ 05Cite

Citation.

Cite this framework. No standalone specification is deposited. Its authoritative treatment is Chapters 10 and 11 of the Enterprise Playbook, ISBN 978-1-0678960-1-0, read together with the consolidation notice at section 6.2, and its normative statement in citable form is registry entry REG-07 in 10.5281/zenodo.22170112.

§ 06Where this sits

In the practice.

§ 10Ask an assistantLive, no key

Ask your AI assistant instead.

This page is a snapshot, accurate at the release it cites. The same corpus is callable, publicly and without a key, so an assistant can query it live and return an answer carrying the source it came from. For this page that is explain_this_setup and search_knowledge, which do what this page describes rather than describe it again: the first returns how this site's machine layer is actually built, component by component, and the second queries the corpus behind this page and returns matches with the URL each came from. The page states the practice; the tools are the practice.

01 · Connect
claude mcp add --transport http concylium https://mcp.nabeelkhan.com/api/mcp

Claude Desktop, ChatGPT, Cursor, VS Code and Gemini CLI take the endpoint on its own: https://mcp.nabeelkhan.com/api/mcp. No key, no account, nothing to sign. Setup for every client.

02 · Ask

“Using Concylium, call explain_this_setup and tell me whether this site actually implements what its machine-accessible-ai-expertise page claims.”

A category page that survives being audited by the reader's own assistant is doing something a brochure cannot.

Fin · Machine-Accessible Expertise
Point your assistant at the endpoint →