§ 01Research

Deposited work.

Nine technical notes, each with a DOI, a version, a fixed set of files and an open licence. All are supplements to published books rather than replacements for them: the note carries the argument in citable form, the book carries the machinery. Four document the governance family (MESA, the Five-Gate Deployment Model, the Sharia AI Compliance Framework, the AI Vendor Risk Framework), three document the engineering family (the Pattern Language, PEVG, PARA), and one is the registry that fixes the names and relationships of all nine governance frameworks. Five registry entries — model risk management, data governance, incident response, the operating model and cross-border patterns — are specified in the Enterprise Playbook and do not yet have a deposited note. They will.

They are self-deposited and they are not peer reviewed. Zenodo assigns a DOI to what it is given; it does not referee it. Cite them as technical notes, which is what they are, and read the claims against their sources rather than against the presence of an identifier. Nothing here has been submitted to or accepted by a journal.

Author identity resolves on ORCID 0009-0005-5364-914X, not on the name.

§ 02Specification

The Defensible AI Framework Registry: Canonical Names, Definitions and Relationships for the Governed Production AI Discipline

Nine frameworks developed separately carried three defects no individual framework could show: three names described one subject, two instruments measured the same maturity, and nothing stated why any of them belonged in the same system. The registry fixes the names, the relationships and its own version, so a claim made against it can be dated.

Deposited 30 August 2026, version 1.0, under CC BY 4.0. It supplements the Enterprise Playbook (ISBN 978-1-0678960-1-0), and the page it documents is The Defensible AI Framework Registry.

Khan, N. (2026). The Defensible AI Framework Registry: Canonical Names, Definitions and Relationships for the Governed Production AI Discipline (Version 1.0). Zenodo. https://doi.org/10.5281/zenodo.22170112

§ 03Specification

The MESA Framework: A Four-Altitude Diagnostic Model for Institutional AI Governance

Institutional AI governance is usually scored as one capability and reported as one grade. That hides the failure that matters: an institution can hold current policy and still have nothing running at the altitude where the decision is actually made. MESA separates the four altitudes and diagnoses them apart.

Deposited 26 August 2026, version 1.0, under CC BY 4.0. It supplements the Enterprise Playbook (ISBN 978-1-0678960-1-0), and the page it documents is The MESA framework.

Khan, N. (2026). The MESA Framework: A Four-Altitude Diagnostic Model for Institutional AI Governance (Version 1.1). Zenodo. https://doi.org/10.5281/zenodo.22109836

§ 04Specification

The Five-Gate Deployment Model: A Deployment Discipline for AI Systems

A pipeline enforces a sequence. A gate assigns a person to it. Five gates in order, each with entry criteria supplied by another framework, one named accountable person, and a required record that carries the policy version in force at the moment it was passed.

Deposited 30 August 2026, version 1.0, under CC BY 4.0. It supplements the Enterprise Playbook (ISBN 978-1-0678960-1-0), and the page it documents is The Five-Gate Deployment Model.

Khan, N. (2026). The Five-Gate Deployment Model: A Deployment Discipline for AI Systems (Version 1.0). Zenodo. https://doi.org/10.5281/zenodo.22170122

§ 05Specification

The Sharia AI Compliance Framework: A Dual-Authority Governance Architecture for Islamic Finance

An Islamic financial institution operates under two binding authorities and usually builds a second governance process beside the first. This proposes that the second process is the error: one governance system, two authority sources, one record set. No Sharia Supervisory Board has reviewed or endorsed it.

Deposited 30 August 2026, version 1.0, under CC BY 4.0. It supplements the Enterprise Playbook (ISBN 978-1-0678960-1-0), and the page it documents is The Sharia AI Compliance Framework.

Khan, N. (2026). The Sharia AI Compliance Framework: A Dual-Authority Governance Architecture for Islamic Finance (Version 1.0). Zenodo. https://doi.org/10.5281/zenodo.22170143

§ 06Instrument

The AI Vendor Due-Diligence Questionnaire: AVRF Instrument for Third-Party AI Systems, Models and APIs

Most of an institution’s AI exposure arrives through a boundary it cannot inspect. Fifty-six questions in seven sections, each with a fixed answer format and a stated evidence expectation, so two completed responses are comparable rather than merely similar. Free to issue, answer, reproduce and extend.

Deposited 30 August 2026, version 1.0, under CC BY 4.0. It supplements the Enterprise Playbook (ISBN 978-1-0678960-1-0), and the page it documents is The AI Vendor Risk Framework.

Khan, N. (2026). The AI Vendor Due-Diligence Questionnaire: AVRF Instrument for Third-Party AI Systems, Models and APIs (Version 1.0). Zenodo. https://doi.org/10.5281/zenodo.22170146

§ 07Specification

The AI Incident Response Protocol: Six Stages, and the Evidence a Reconstruction Requires

An institution asked to explain an AI failure discovers, at that moment and not before, what it wrote down. The discovery is unrecoverable. Evidence is a property of the moment a decision was taken, and an institution that did not capture it then is left assembling an account from what it can still find. It reconstructs beliefs, not behaviour.

Deposited 6 September 2026, version 1.0, under CC BY 4.0. It supplements the Enterprise Playbook (ISBN 978-1-0678960-1-0), and the page it documents is The AI Incident Response Protocol.

Khan, N. (2026). The AI Incident Response Protocol: Six Stages, and the Evidence a Reconstruction Requires (Version 1.0). Zenodo. https://doi.org/10.5281/zenodo.22285057

§ 08Specification

A Pattern Language for Production LLM Platforms: Governed Routing, Agent Orchestration, and AI-Native Delivery

A platform built on large language models makes two kinds of decision, and most of its trouble comes from writing both into one clause. The patterns separate the optimisation decision from the governed one, and name the seams where that separation survives contact with production.

Deposited 26 August 2026, version 1.0, under CC BY 4.0. It supplements the Full-Stack AI Engineering series (ISBNs 978-1-0678317-1-4, -2-1 and -3-8), and the page it documents is A pattern language for production LLM platforms.

Khan, N. (2026). A Pattern Language for Production LLM Platforms: Governed Routing, Agent Orchestration, and AI-Native Delivery (Version 1.1). Zenodo. https://doi.org/10.5281/zenodo.22109864

§ 09Specification

PEVG: Planner, Executor, Verifier, Generator. Four Contracts, and the Two Boundaries a Verifier Does Not Both Hold

The verifier holds the epistemic boundary, what may be believed. It does not thereby hold the operational boundary, what may be disclosed or acted upon. Collapsing the two is one clause performing two functions, which is the classification error the Boundary Invariant forbids.

Deposited 30 August 2026, version 1.0, under CC BY 4.0. It supplements the Full-Stack AI Engineering series (ISBNs 978-1-0678317-1-4, -2-1 and -3-8), and the page it documents is PEVG.

Khan, N. (2026). PEVG: Planner, Executor, Verifier, Generator. Four Contracts, and the Two Boundaries a Verifier Does Not Both Hold (Version 1.0). Zenodo. https://doi.org/10.5281/zenodo.22170132

§ 010Specification

PARA: Perception, Action, Reasoning, Adaptation. Four Faculties, Four Authority Types, and the Registry Entry That Turns a Faculty into a Contract

The fourth faculty is Adaptation, not Reflection. Reflection is a private act with no external consequence; adaptation writes to institutional memory, which is why it needs a guardrail and why misnaming it removes the reason for one.

Deposited 30 August 2026, version 1.0, under CC BY 4.0. It supplements the Full-Stack AI Engineering series (ISBNs 978-1-0678317-1-4, -2-1 and -3-8), and the page it documents is PARA.

Khan, N. (2026). PARA: Perception, Action, Reasoning, Adaptation. Four Faculties, Four Authority Types, and the Registry Entry That Turns a Faculty into a Contract (Version 1.0). Zenodo. https://doi.org/10.5281/zenodo.22170139

Fin · Press
Press enquiry →