A control-point gap map
Every governance claim you make — access, approval, data handling, model use — marked as technically enforced or merely advisory. The advisory ones are the wishes. We show you which is which.
Consulting · AI governance
Would your AI governance survive an attacker — or just an audit?
Most AI governance passes the audit and loses to the attacker, because it lives in a document instead of the infrastructure. We assess yours against one question — what breaks if someone violates this control right now? — and hand you the gaps, ranked, with the fix for each.
Audited against a model that runs
We don't assess you against a framework we read. We assess against the model we run in production and published in the open: Govern, Manage, Enforce — every policy bound to a control point that makes it physically true.
The gateway that won't authenticate an unregistered system. Approval that's a credential, not a document. No security property that depends on the model behaving. We assess your stack the way we built ours — and the way an examiner or an attacker will read it.
What you get
Enforcement & eval maturity
Whether consequential actions run through a policy enforcement point the model can't route around, and whether your controls are actually tested — evals that block a merge, not a doc that's reviewed quarterly.
A remediation roadmap
The gaps ranked by real exposure, each with the concrete fix and roughly what it takes. A quarter of work you can defend, not a 200-item register nobody will finish.
How the engagement runs
- 01
Inventory
Start from a real census of the AI you're running (or bring your own). You can't assess governance over systems you can't list.
- 02
Map policy to control points
For each policy, we find where — if anywhere — it's made physically true. A rule with no enforcement point is advisory, however good the PDF.
- 03
Run the break test
The one question that separates a control from a belief: what breaks if someone violates this right now? If the answer is “nothing, until the next review,” it isn't a control. We also check whether the controls are tested.
- 04
Remediation roadmap
You get the ranked gaps and the fix for each — where to add a choke point, where to move a decision out of the model, where an eval gate belongs.
Starts from an inventory, ends with a plan you can act on. In a regulated industry, the same rigor produces examiner-ready evidence — see regulated-industries governance.
Who it's for
Security, compliance, and platform leaders running AI at scale who need to know — before an incident or an audit — which of their controls are real.
Why work with us
We run this model on our own platform and publish it in full. You're hiring the people who wrote the method, not a checklist vendor.
Find the wishes before someone else does.
An assessment tells you which of your controls would actually hold.