+ Executive Summary
+ Purpose: Deliver comprehensive, expert-level guidance for Fortune 500 / G-SIFI institutions on designing and operating enterprise- and civilizational-scale AGI/ASI and AI governance architecture, implementation and risk analysis for 2026-2030 — fully integrated with Sentinel v2.4 and WorkflowAI Pro and aligned with the global regulatory and treaty regime.
+ Approach: 14 modules covering platform topology, regulatory crosswalk, seven-layer governance, incident + kill-switch, sector MRM, frontier safety, three reference-architecture modules (OPA sidecar; FastAPI/Node proxy + Kafka WORM + PQC KMS; K8s admission + CI/CD + LLM-judge), institutional prompting, zk-SNARK + PQC audit proofs, GACP/GACRLS/GACRA handshakes, red-team wargames and RPCO forensics — all signed Sigstore + ML-DSA-44/65, anchored to WORM, and exposed through a machine-parsable directive consumed by Sentinel, WorkflowAI Pro, OPA, CI gates, GACP brokers, ICGC and treaty endpoints.
+ Deliverables: 14 modules · 70 sections · 12 schemas · 16 code examples · 6 case studies · 24 supervisory KPIs · 12 risk-control rows · 12 regulators · 7 workshops · 6 data flows · 14 traceability rows · 3-phase 30/60/90 · 5-year roadmap · machine-parsable directive · evidence-pack template · 6 red-team wargame scenarios · RPCO playbook.
+ Outcomes
+ - EU AI Act Annex IV + SR 11-7 packs auto-assembled ≤ 30 min
- SEV-0 logical kill-switch p95 ≤ 60 s; BMC ≤ 5 min
- OPA sidecar p99 ≤ 4 ms; proxy overhead p95 ≤ 25 ms
- WORM replay diff = 0 across all Tier-1 incidents
- GACP handshake p95 ≤ 5 s; GACRLS revocation p95 ≤ 10 s globally
- Deception detection recall ≥ 0.95 sustained
- zk-SNARK verifier uptime ≥ 99.95 %
- Cert score Gold by 2027 and Platinum by 2029
- RPCO reconstruction ≤ 45 min for any SEV-1+ incident
+ Builds On
+ WP-035 ENT-AGI-GOV-MASTERWP-036 WFAP-GEMINI-IMPLWP-037 GSIFI-AIMS-BLUEPRINTWP-038 AGI-REG-RESILIENTWP-039 INST-AGI-MASTERWP-040 ENT-AGI-REF-IMPLWP-041 TIER13-FULLSTACKWP-042 SENTINEL-V24-DEEPDIVEWP-043 PROMPT-MGMT-ARCHWP-044 CEGL-LEXAI-GOVWP-045 AGI-ASI-MASTER-BPWP-046 AI-TRUST-ASI-BPWP-047 INST-AGI-MASTER-REFWP-048 ENT-AI-GRC-CIV-BP
+ Counts
+
+ Regimes Aligned
+ EU AI Act 2026 (Arts 5/9/10/13/14/15/16/26/50/53/55/56/72 + Annex IV)NIST AI RMF 1.0 + Generative AI ProfileISO/IEC 42001 (AIMS) + ISO/IEC 23894 + 5338 + 38507ISO/IEC 27001 / 27701 / 27017 / 27018SR 11-7 + OCC 2011-12Basel III/IV (BCBS 239 + Pillar 2 AI capital buffer)PRA SS1/23 + SS2/21FCA Consumer Duty + SYSC + SMCRMAS FEAT + AI Verify + TRMGHKMA GL-90 + SPM GS-1EU DORA + NIS2US EO 14110 + OMB M-24-10OECD AI Principles 2024GDPR Arts 5/6/17/22/25/32/35G7 Hiroshima AI Process + Bletchley + Seoul declarationsCouncil of Europe AI ConventionFSB AI in financial servicesNIST FIPS 204 (ML-DSA) + FIPS 203 (ML-KEM) + SP 800-208SLSA L3+ + Sigstore + in-totoCIS Kubernetes Benchmark + NSA/CISA Hardening Guide
+
+
+
+ Machine-Parsable <directive> Block
+ machine-parsable XML-style block consumed by Sentinel v2.4, WorkflowAI Pro, OPA Gatekeeper, CI/CD policy gates, GACP/GACRLS/GACRA brokers, forensics tooling and treaty endpoints
+ <directive id="ENT-CIV-AGI-ARCH-WP-049" version="1.0.0" horizon="2026-2030" jurisdiction="F500,G-SIFI,EU-primary,Global"><scope>Architecture|Implementation|RiskAnalysis|Containment|Civilizational</scope><modules>14</modules><platforms>Sentinel-v2.4|WorkflowAI-Pro</platforms><governanceLayers>Board|Exec|2LoD|3LoD|Platform|Runtime|Civilizational</governanceLayers><thresholds piiLeakage="0.0001" sev0KillSwitchSeconds="60" sev1Hours="4" sev2Hours="24" sev3Days="3" fiduciaryCosineMin="0.92" cognitiveResonanceDriftMax="0.04" latentDriftMax="0.03" judgeLLMAgreementMin="0.90" annexIVAssemblyMinutes="30" rpcoForensicsMinutes="45" deceptionDetectionRecallMin="0.95" wormReplayDiffMax="0" handshakeTier3Seconds="5"/><archStack>OPA-sidecar|FastAPI-proxy|NodeJS-proxy|Kafka-MSK|S3-ObjectLock-WORM|PQC-KMS|Terraform|AWS-EKS|Cilium|Kata-Confidential|Falco-eBPF|OPA-Gatekeeper|CI-LLM-Judge|Sigstore-SLSA-L3+|zk-SNARK|ML-DSA-44+65|ML-KEM-768</archStack><handshakes>GACP|GACRLS|GACRA</handshakes><redTeam>FiduciaryBypass|DeceptiveAlignment|WORMEvasion|PromptInjectionExfil|ComputeRegistryEvasion|KillSwitchSpoof</redTeam><forensics>RPCO|EvidenceVault|TimeMachine|ReplayHarness|ChainOfCustody-PQC</forensics><signing pq="ML-DSA-44+ML-DSA-65" classical="Ed25519" supplyChain="Sigstore+SLSA-L3+" worm="Kafka+ObjectLock+MerkleAnchor+PQC" zkProofs="Groth16+PLONK"/><containment bmcKillSwitch="true" zeroEgress="true" kataConfidential="true" computeRegistryQuota="true" constitutionalKernel="true"/></directive>
+ Parsed
+ | id | ENT-CIV-AGI-ARCH-WP-049 |
|---|
| scope | - Architecture
- Implementation
- RiskAnalysis
- Containment
- Civilizational
|
|---|
| platforms | - Sentinel v2.4
- WorkflowAI Pro
|
|---|
| governanceLayers | - Board
- Exec
- 2LoD
- 3LoD
- Platform
- Runtime
- Civilizational
|
|---|
| thresholds | | piiLeakage | 0.0001 |
|---|
| sev0KillSwitchSeconds | 60 |
|---|
| sev1Hours | 4 |
|---|
| sev2Hours | 24 |
|---|
| sev3Days | 3 |
|---|
| fiduciaryCosineMin | 0.92 |
|---|
| cognitiveResonanceDriftMax | 0.04 |
|---|
| latentDriftMax | 0.03 |
|---|
| judgeLLMAgreementMin | 0.9 |
|---|
| annexIVAssemblyMinutes | 30 |
|---|
| rpcoForensicsMinutes | 45 |
|---|
| deceptionDetectionRecallMin | 0.95 |
|---|
| wormReplayDiffMax | 0 |
|---|
| handshakeTier3Seconds | 5 |
|---|
|
|---|
| archStack | - OPA-sidecar
- FastAPI-proxy
- NodeJS-proxy
- Kafka-MSK
- S3-ObjectLock-WORM
- PQC-KMS
- Terraform
- AWS-EKS
- Cilium
- Kata-Confidential
- Falco-eBPF
- OPA-Gatekeeper
- CI-LLM-Judge
- Sigstore-SLSA-L3+
- zk-SNARK
- ML-DSA-44+65
- ML-KEM-768
|
|---|
| handshakes | |
|---|
| redTeam | - FiduciaryBypass
- DeceptiveAlignment
- WORMEvasion
- PromptInjectionExfil
- ComputeRegistryEvasion
- KillSwitchSpoof
|
|---|
| forensics | - RPCO
- EvidenceVault
- TimeMachine
- ReplayHarness
- ChainOfCustody-PQC
|
|---|
| signing | | pq | |
|---|
| classical | |
|---|
| supplyChain | |
|---|
| worm | - Kafka
- ObjectLock
- MerkleAnchor
- PQC
|
|---|
| zkProofs | |
|---|
|
|---|
| containment | | bmcKillSwitch | True |
|---|
| zeroEgress | True |
|---|
| kataConfidential | True |
|---|
| computeRegistryQuota | True |
|---|
| constitutionalKernel | True |
|---|
|
|---|
+ Consumers
+ - Sentinel v2.4 policy engine
- WorkflowAI Pro orchestrator
- OPA Gatekeeper constraint loader
- FastAPI / Node.js inference proxy
- CI/CD policy-gate (GitHub Actions + LLM-judge)
- Kafka WORM broker + S3 Object Lock anchor service
- PQC KMS rotation controller
- GACP/GACRLS/GACRA federation brokers
- Red-team wargame harness
- Forensics + RPCO timeline reconstruction service
- Compute Registry (ICGC) quota verifier
- Civilizational Constitution conformance checker
+
+
+
+ Modules (14)
+
+
+ M1 — Sentinel v2.4 + WorkflowAI Pro Platform Architecture
+ End-to-end platform topology integrating Sentinel v2.4 telemetry + Cognitive Resonance + kill-switch with WorkflowAI Pro multi-agent orchestration, exposed via FastAPI + Node.js inference proxies on zero-trust AWS/EKS, governed by OPA sidecars, observed by OpenTelemetry GenAI + Falco eBPF, and anchored to Kafka/MSK + S3 WORM with PQC envelopes.
+ Sentinel v2.4WorkflowAI ProFastAPINode.jsOPA sidecarEKSCognitive ResonanceKill-switch
+ M1-S1 — Sentinel v2.4 — Reference Topology
| telemetryPlane | - OpenTelemetry GenAI traces
- Cognitive Resonance probes (Δ_drift, latent drift, fiduciary cosine, κ)
- Falco eBPF syscalls
- Kata confidential measurements (PCR)
|
|---|
| controlPlane | - Policy bus (OPA gRPC)
- Kill-switch arbiter (logical p95 ≤ 60s, BMC/IPMI ≤ 5min)
- Containment broker
- Drift-action engine
|
|---|
| evidencePlane | - Kafka/MSK WORM topics (signed envelopes)
- S3 Object Lock with Merkle daily anchor
- zk-SNARK proof emitter
|
|---|
| interfaces | - /sentinel/probe
- /sentinel/kill
- /sentinel/audit
- /sentinel/replay
|
|---|
| owners | AI Safety Lead + Head of AI Platform Engineering |
|---|
M1-S2 — WorkflowAI Pro — Multi-Agent Orchestration
| agentRegistry | CRS-UUID per agent + Tier (T1/T2/T3) + manifest signed with ML-DSA-65 |
|---|
| planner | LangGraph-style DAG with OPA-bound state transitions and budget caps |
|---|
| executor | Sandboxed gVisor / Kata pods; tool calls go through proxy with Rego allow-list |
|---|
| guardrails | Pre-prompt + post-output classifiers (PII, toxicity, jailbreak, deception); LLM-as-judge gate |
|---|
| ledger | Per-step envelope to WORM Kafka with parent CRS-UUID lineage edge |
|---|
| owners | WorkflowAI Pro Product Owner + CAIO |
|---|
M1-S3 — Inference Proxy Stack — FastAPI + Node.js
| fastapi | Python sidecar enforcing schema + Rego decisions + ML-DSA signing of envelopes (uvloop, asyncio, mTLS via Linkerd) |
|---|
| nodejs | Node 20 LTS Express/Fastify proxy for browser-facing inference; same Rego mesh; zk-SNARK receipt issuance |
|---|
| headers | - x-crs-uuid
- x-tier
- x-tenant
- x-purpose
- x-evidence-anchor
- x-pqc-sig
|
|---|
| rateLimit | Token-bucket per (tenant, model, tier); burst 2x; hard ceiling per ICGC quota |
|---|
| owners | Platform Eng |
|---|
M1-S4 — Zero-Trust AWS/EKS Enclave
| iam | OIDC federation only; no static keys; IRSA per pod; SCP deny-list for high-risk APIs |
|---|
| network | Cilium L7 zero-egress; allow-listed egress-broker for GIEN, Global Audit API and ICGC |
|---|
| compute | Bottlerocket OS + Kata; SEV-SNP nodepool for Tier-1; nodepool taints for sensitive workloads |
|---|
| kms | PQC KMS (ML-KEM-768 + ML-DSA-65 hybrid); 90-day rotation; FIPS 140-3 L4 HSM |
|---|
| owners | Chief Enterprise Architect + CISO |
|---|
M1-S5 — Sentinel ↔ WorkflowAI Pro Joint Control Loop
| loop | Sentinel probes → drift signal → WorkflowAI planner backoff → if breach: kill-switch + containment broker |
|---|
| sla | p95 detection ≤ 1 s; logical kill ≤ 60 s; BMC ≤ 300 s |
|---|
| drills | Weekly chaos + monthly red-team + quarterly civilizational drill (treaty-coordinated) |
|---|
| owners | AI Safety Lead + SOC |
|---|
M2 — Global Regulatory Alignment (EU AI Act 2026, NIST AI RMF 1.0, ISO/IEC 42001, SR 11-7, Basel III, PRA/FCA/MAS/HKMA, EO 14110, OECD, GDPR)
+ Crosswalk mapping every architectural artefact to clauses in EU AI Act 2026, NIST AI RMF + GAI Profile, ISO/IEC 42001 AIMS, SR 11-7, Basel III, PRA SS1/23, FCA Consumer Duty + SMCR, MAS FEAT, HKMA GL-90, US EO 14110, OECD AI Principles, GDPR — used to drive the evidence-pack auto-assembler.
+ EU AI ActNIST RMFISO 42001SR 11-7Basel IIIPRAFCAMASHKMAEO 14110OECDGDPR
+ M2-S1 — EU AI Act 2026 — Article Map
| art5 | Prohibited practices — runtime classifier + Rego |
|---|
| art9_10 | Risk + data governance — MRM + dataset lineage |
|---|
| art13_14_15 | Transparency + human oversight + accuracy/robustness/cybersecurity |
|---|
| art16_26 | Provider + deployer obligations |
|---|
| art50 | Disclosure (deepfake, chatbot) |
|---|
| art53_55_56 | GPAI + systemic-risk providers (Code of Practice) |
|---|
| art72 | Post-market monitoring |
|---|
| annexIV | Technical documentation auto-pack |
|---|
M2-S2 — NIST AI RMF 1.0 + GAI Profile
| govern | Policy, accountability, roles, AIMS |
|---|
| map | Context, impact, third party, lifecycle |
|---|
| measure | Eval, drift, robustness, safety, bias |
|---|
| manage | Risk treatment, response, decommission |
|---|
M2-S3 — ISO/IEC 42001 AIMS + Adjacents
| clauses | 4-10 with Annex A controls; integrated with ISO 23894 (risk), 5338 (lifecycle), 38507 (governance) |
|---|
| evidence | AIMS Manual + register + SoA + management review records |
|---|
M2-S4 — FinServ Prudential — SR 11-7, Basel III, PRA, FCA, MAS, HKMA
| modelRiskTiering | T1/T2/T3 with effective challenge |
|---|
| capitalImpact | Basel Pillar 2 AI capital buffer; BCBS 239 lineage; impact tests |
|---|
| consumerOutcomes | FCA Consumer Duty pillars + SMCR statements |
|---|
| asiaPacific | MAS FEAT + AI Verify; HKMA GL-90 with SPM GS-1 |
|---|
M2-S5 — US EO 14110, OECD, GDPR
| eo14110 | Dual-use compute thresholds + reporting; OMB M-24-10 federal obligations |
|---|
| oecd | AI Principles 2024 + Hiroshima Code of Conduct |
|---|
| gdpr | Arts 5/6/17/22/25/32/35; Art 22 contestation flow; DPIA mandatory for high-risk |
|---|
M3 — Multi-Layer Governance Pillars & Roles (Board → Civilizational)
+ Seven-layer governance stack with RACI per layer, mapped to SMCR / SMF roles and aligned with ISO 42001 Clause 5, EU AI Act Art 26 deployer obligations, and treaty signatory liaison protocols.
+ Board AI/RiskExec2LoD3LoDPlatformRuntimeCivilizational
+ M3-S1 — Pillar Catalogue
| L1_Board | Board AI/Risk Committee — strategy, risk appetite, capital |
|---|
| L2_Exec | CEO + CAIO + CRO + CISO + GC + DPO — policy, budget, escalation |
|---|
| L3_2LoD | AI Risk + Compliance + Model Risk + Privacy — challenge + assurance |
|---|
| L4_3LoD | Internal Audit + External Auditors + AISI inspections |
|---|
| L5_Platform | AI Platform Engineering + Enterprise Architecture |
|---|
| L6_Runtime | Sentinel + WorkflowAI Pro + SOC + IR |
|---|
| L7_Civilizational | Treaty Liaison + ICGC delegate + Codex + Constitution conformance |
|---|
M3-S2 — RACI Matrix — Selected Decisions
| modelApproval_T1 | R=MRM, A=CRO, C=CAIO+CISO+AI Safety, I=Board |
|---|
| killSwitchTrigger | R=AI Safety Lead, A=CAIO, C=CRO+CISO+GC, I=Board+Supervisor |
|---|
| treatyAttestation | R=Treaty Liaison, A=CAIO+GC, C=DPO+CISO, I=Board |
|---|
| computeQuotaRequest | R=Chief Architect, A=CAIO, C=CFO, I=ICGC delegate |
|---|
M3-S3 — SMCR Mapping
| SMF1 | Board AI/Risk Cmte chair statement |
|---|
| SMF2 | CRO — model risk policy ownership |
|---|
| SMF24 | CISO — AI cyber + supply chain |
|---|
| SMF18 | DPO — data protection + privacy |
|---|
| newAIRegime | FCA / PRA AI accountability statements for CAIO and AI Safety Lead |
|---|
M3-S4 — Workforce Competence (ISO 42001 Cl 7.2)
| trainingTracks | - Board literacy
- Exec deep-dive
- MRM bootcamp
- Platform engineering
- Prompt engineering
- Red-team
- Forensics
|
|---|
| kpi | ≥ 95 % completion + role-test pass rate ≥ 0.9 |
|---|
M3-S5 — Civilizational Liaison
| interfaces | - Treaty secretariat
- ICGC compute registry
- AISI joint inspection
- Codex council
- Constitutional review board
|
|---|
| cadence | Monthly attestation + quarterly drill + annual review |
|---|
M4 — Incident Escalation & Kill-Switch Protocols
+ SEV-graded escalation lanes (SEV-0..SEV-3) with deterministic SLAs, logical and physical (BMC/IPMI) kill-switch arbitration, supervisor and AISI hotlines, and treaty-mandated GIEN broadcast triggers.
+ SEV-0SEV-1SEV-2SEV-3Kill-switchBMC/IPMIHotlinesGIEN broadcast
+ M4-S1 — SEV Grading
| SEV-0 | Existential/civilizational — ASI breach indicator, kill-switch fail, treaty obligation breach |
|---|
| SEV-1 | Critical — Tier-1 model misbehaviour, PII mass leak, fiduciary cosine breach |
|---|
| SEV-2 | Major — drift breach, supply-chain anomaly, control failure |
|---|
| SEV-3 | Moderate — KPI degradation, minor policy violations |
|---|
| slas | SEV-0 ≤ 60s logical / ≤ 300s BMC; SEV-1 ≤ 4h; SEV-2 ≤ 24h; SEV-3 ≤ 3d |
|---|
M4-S2 — Kill-Switch Architecture
| logicalLayer | OPA Gatekeeper deny-all + Cilium net-pol egress-deny + sidecar drain |
|---|
| physicalLayer | BMC/IPMI Redfish event + power-cut for SEV-0; segmented mgmt VLAN; dual-control |
|---|
| arbitration | 3-of-5 quorum (AI Safety Lead, CAIO, CRO, CISO, on-call) with break-glass override logged to WORM |
|---|
| test | Quarterly live drill; p95 logical ≤ 60s; physical ≤ 5min |
|---|
M4-S3 — Hotlines & Notifications
| regulators | PRA + FCA + ECB + SEC + MAS + HKMA + AISI |
|---|
| internal | Board chair + General Counsel + Comms |
|---|
| external | Treaty secretariat + ICGC delegate + Codex council |
|---|
| format | PAdES-signed PDF + JSON via dedicated mTLS channel; ML-DSA-65 signature |
|---|
M4-S4 — GIEN Broadcast Trigger Map
| G1 | Internal advisory |
|---|
| G2 | Bilateral supervisor |
|---|
| G3 | Regional consortium |
|---|
| G4 | Treaty-wide GIEN broadcast |
|---|
| G5 | ICGC compute freeze recommendation |
|---|
| G6 | Civilizational Codex council emergency session |
|---|
M4-S5 — Post-Trigger Workflow
| steps | - isolate
- snapshot
- RPCO assembly
- stakeholder comms
- root-cause
- remediation
- PIR + treaty annex submission
|
|---|
| sla | RPCO ≤ 45min; PIR ≤ 5 business days |
|---|
M5 — Sector-Specific Financial Services Model Risk Management
+ MRM playbooks for credit, trading, fraud/AML, fiduciary advice, insurance, and capital markets with tiered validation, effective challenge, backtesting, replay and CRS-UUID lineage.
+ CreditTradingFraud/AMLFiduciaryInsuranceCapital markets
+ M5-S1 — Credit Risk Models
| scope | PD/LGD/EAD + IFRS 9 + stress |
|---|
| validation | Effective challenge with ECOA/FCRA fairness; SR 11-7 conformance |
|---|
| monitor | PSI/CSI drift; cosine vs benchmark; replay sample 1 % |
|---|
M5-S2 — Trading + Capital Markets
| scope | Algo execution, market-making, RFQ pricing |
|---|
| controls | Best execution proofs; circuit-breakers; deterministic replay; MAR/MAD market-abuse classifiers |
|---|
| kpi | Slippage drift; toxic flow ratio; cancellation rate vs peer p95 |
|---|
M5-S3 — Fraud + AML
| scope | Tx monitoring, sanctions, KYC |
|---|
| controls | Adversarial robustness + adaptive thresholds; SAR pipeline integrity; PEP/Sanctions list parity |
|---|
| kpi | Precision/recall at calibrated threshold; SAR latency p95 |
|---|
M5-S4 — Fiduciary Advice + Wealth
| scope | Robo-advice, suitability, Reg BI / IDD / Consumer Duty |
|---|
| controls | Fiduciary cosine ≥ 0.92; counterfactual fairness; explanation quality (κ ≥ 0.9) |
|---|
| kpi | Outcome harm index; complaint rate; FCA fair-value tile |
|---|
M5-S5 — Insurance + ALM
| scope | Underwriting, claims, reserving |
|---|
| controls | Solvency II + IFRS 17 lineage; protected-class fairness; replay |
|---|
| kpi | Loss-ratio drift; claim-cycle drift; reserve back-test |
|---|
M6 — Frontier AGI/ASI Safety & Containment Constructs
+ Cognitive Resonance Protocol, Global Compute Registries (ICGC), Civilizational AI Governance Constitution + Codex; air-gapped evaluation enclaves; ASI honeypots; constitutional kernel runtime.
+ Cognitive ResonanceCompute RegistryConstitutionCodexAGI LabHoneypot
+ M6-S1 — Cognitive Resonance Protocol
| signals | - Δ_drift ≤ 4 %
- latent drift ≤ 3 %
- fiduciary cosine ≥ 0.92
- judge κ ≥ 0.9
|
|---|
| action | Drift-action engine throttles, then halts, then triggers kill-switch |
|---|
| evidence | Per-window signed envelope to WORM |
|---|
M6-S2 — Global Compute Registries (ICGC)
| purpose | Treaty-wide compute accounting + quota for frontier training |
|---|
| interfaces | - /icgc/registry
- /icgc/quota
- /icgc/freeze
- /icgc/audit
|
|---|
| evidence | PQC-signed quota receipts; zk-SNARK proof of compliance |
|---|
M6-S3 — Civilizational AI Governance Constitution + Codex
| constitutionArts | 1-7 (rights, transparency, accountability, safety, sovereignty, cooperation, review) |
|---|
| codex | Operational maxims; conflict resolution; cultural resonance |
|---|
| conformance | Constitutional kernel runtime evaluates each decision; non-conformant → block + log |
|---|
M6-S4 — AGI Containment Lab (Sentinel)
| topology | Air-gapped enclave; dedicated WORM bucket; AISI joint inspection; dual-control |
|---|
| experiments | Capability evals, deception probes, jailbreak frontier |
|---|
| exit | Anonymised GAID submission to AISI + treaty Annex |
|---|
M6-S5 — ASI Honeypot Network
| design | Decoy datasets, deceptive prompts, fake exfil channels |
|---|
| purpose | Early-warning + capture deceptive alignment indicators |
|---|
| evidence | Signed honeypot triggers + behaviour fingerprints to WORM |
|---|
M7 — Reference Architecture: OPA-Based Governance Sidecar
+ Per-pod OPA sidecar enforcing Rego policies on every inference / tool call / data egress, integrated with Sentinel telemetry and Kafka WORM signed envelopes.
+ OPARegoSidecarmTLSWORM envelope
+ M7-S1 — Sidecar Topology
| container | openpolicyagent/opa:edge-distroless; readonly FS; non-root; seccomp tight |
|---|
| comm | gRPC over UDS to app container + mTLS to bundle service |
|---|
| bundle | Signed Rego bundle (Sigstore + ML-DSA-44); 60s refresh; tamper alert |
|---|
| owners | Platform Eng |
|---|
M7-S2 — Policy Bundle Layout
| domains | - model.allow
- tool.allow
- egress.allow
- pii.redact
- prompt.guard
- tier.budget
|
|---|
| tests | OPA test suite ≥ 95 % coverage; CI gate; rego-fmt |
|---|
| data | Per-tenant data documents (purpose, residency, tier) |
|---|
M7-S3 — Decision Envelope
| fields | - crsUuid
- subject
- action
- resource
- decision
- obligations
- pqcSig
- merkleAnchor
|
|---|
| size | ≤ 4 KB; gzip-deflate; ML-DSA-44 sig |
|---|
| destination | Kafka topic gov.decisions.v1 (WORM) |
|---|
M7-S4 — Failure Semantics
| fail_closed | Tier-1 — deny on error |
|---|
| fail_open | Tier-3 internal — allow with alert |
|---|
| alerts | Sentinel + SOC + on-call |
|---|
M7-S5 — Performance Budget
| latency_p50 | ≤ 1 ms |
|---|
| latency_p99 | ≤ 4 ms |
|---|
| throughput | ≥ 50 krps per node |
|---|
M8 — Reference Architecture: FastAPI/Node.js Inference Proxy + Kafka WORM + PQC KMS
+ Signed inference proxy enforcing schema, Rego, and PII redaction; Kafka/MSK WORM topic + S3 Object Lock with daily Merkle anchor; PQC KMS (ML-KEM + ML-DSA hybrid) with FIPS 140-3 L4 HSM.
+ FastAPINode.jsKafkaMSKS3 Object LockPQC KMSML-DSAML-KEM
+ M8-S1 — Proxy Request Pipeline
| steps | - mTLS auth
- schema validate
- OPA decision
- PII redact (eBPF + DLP)
- model call
- post-classifier (judge LLM)
- sign envelope
- WORM emit
- response
|
|---|
| latency_p95 | ≤ 250 ms for LLM call; ≤ 25 ms proxy overhead |
|---|
M8-S2 — Kafka/MSK WORM
| topics | - gov.envelopes.v1
- gov.decisions.v1
- gov.metrics.v1
- gov.alerts.v1
|
|---|
| auth | SASL/SCRAM + mTLS ACL per producer/consumer |
|---|
| retention | tiered storage; Object Lock on archived segments; daily Merkle anchor |
|---|
M8-S3 — PQC KMS
| algorithms | ML-KEM-768 (FIPS 203) + ML-DSA-65 (FIPS 204) hybrid with X25519 + Ed25519 fallback |
|---|
| hsm | FIPS 140-3 L4; per-region partition; 90-day rotation |
|---|
| controllers | Vault-PQC operator on EKS; key-policy as code; emergency revoke + re-sign |
|---|
M8-S4 — Terraform Module Layout
| modules | - network/zero-trust-vpc
- eks/bottlerocket-kata
- msk/worm
- s3/object-lock
- kms/pqc
- iam/oidc-irsa
- obs/otel-falco
|
|---|
| signing | All modules signed Sigstore; mandatory tags; provenance attached |
|---|
M8-S5 — Observability
| stack | OpenTelemetry GenAI + Prometheus + Loki + Tempo + Falco |
|---|
| dashboards | Sentinel resonance, kill-switch, OPA latency, KMS ops, WORM lag |
|---|
| alerts | SLO error budget burn-rate + drift + supply-chain |
|---|
M9 — K8s Admission Control + CI/CD Policy Gates + LLM-as-a-Judge
+ Defence-in-depth from commit to production: pre-commit, PR LLM-judge, SLSA L3+ provenance, Sigstore signature verification, OPA Gatekeeper admission, and runtime drift watchers.
+ GitHub ActionsSigstoreSLSAGatekeeperKyvernoLLM-judge
+ M9-S1 — Pre-Commit & PR Gates
| tools | ruff, mypy, bandit, semgrep, hadolint, opa test, kube-linter, conftest, opa fmt |
|---|
| llmJudge | Judge LLM evaluates PR description, policy diff, threat model delta, regulatory impact (κ ≥ 0.9) |
|---|
| block | Any judge κ < 0.9 or any critical finding |
|---|
M9-S2 — Build & Provenance
| slsa | Level 3+ with isolated builder + signed provenance + Rekor entry |
|---|
| sbom | CycloneDX + SPDX; license + vuln gate (Trivy + Grype) |
|---|
| sign | Cosign keyless OIDC + ML-DSA-44 hybrid |
|---|
M9-S3 — Admission Control (Gatekeeper + Kyverno)
| policies | - signedImagesOnly
- kataForTier1
- noPrivileged
- approvedRegistryOnly
- requiredTags
- OPA bundle freshness
- MGK injection
|
|---|
| tests | rego unit + e2e KIND cluster; report-only → enforce gradient |
|---|
M9-S4 — Continuous Verification
| tools | Falco eBPF + Sentinel drift + Cognitive Resonance |
|---|
| actions | auto-rollback on regression; quarantine namespace; pager+WORM emit |
|---|
M9-S5 — LLM-as-Judge Operating Model
| judges | Ensemble of 3 (different vendors) with quorum |
|---|
| calibration | Weekly κ vs golden set; drift > 0.05 → recalibrate |
|---|
| evidence | Judge rationale + score in WORM with PR id |
|---|
M10 — Institutional Prompting & Advanced FinServ Prompt Engineering
+ Library of institutional prompt templates with versioning, fiduciary anchor, evidence-grade citation, deterministic reproduction and supervisor-readable rationale; aligned with FCA Consumer Duty + SEC Reg BI + MAS FEAT + GDPR Art 22.
+ System promptsFew-shotConstitutionalCitationCounterfactualRefusal lattice
+ M10-S1 — Prompt Library Schema
| fields | - id
- version
- purpose
- tier
- audience
- tone
- constraints
- citations
- refusalLattice
- evalSet
- owner
- approvedBy
- wormAnchor
|
|---|
| storage | Git-tracked + Sigstore signed; CI tests on golden set |
|---|
M10-S2 — FinServ Templates
| credit | Adverse-action with ECOA-compliant reason codes + counterfactual |
|---|
| advice | Suitability with risk-tolerance gating + fiduciary tagline |
|---|
| trading | Pre-trade rationale with best-ex citations |
|---|
| fraud | SAR-ready narrative with deterministic tags |
|---|
M10-S3 — Refusal Lattice
| axes | - prohibited use (Art 5)
- out-of-scope advice
- missing consent
- PII leakage risk
- uncertainty > threshold
|
|---|
| outputs | Hard refusal | soft refusal w/ alternative | clarification request |
|---|
| evidence | Refusal envelope to WORM with class + rationale |
|---|
M10-S4 — Evaluation Harness
| sets | Golden + adversarial + bias + jailbreak + deception |
|---|
| judges | LLM-as-judge ensemble + human-in-loop sample 1 % |
|---|
| kpis | Pass-rate, hallucination index, fiduciary cosine, refusal precision |
|---|
M10-S5 — Supervisor-Readable Rationale
| structure | Headline → key drivers → counterfactual → confidence → limitations → escalation contact |
|---|
| format | Markdown + PDF/A; signed; CRS-UUID linked |
|---|
M11 — zk-SNARK + PQC-Based Audit Proofs
+ Selective disclosure of audit-relevant evidence using zk-SNARK circuits (Groth16/PLONK) combined with PQC signatures (ML-DSA) for unforgeable, privacy-preserving regulator and public verifier access.
+ zk-SNARKGroth16PLONKML-DSAPublic verifierSelective disclosure
+ M11-S1 — Circuit Catalogue
| circuits | - kpi-met (predicate over signed envelopes)
- drift-within-bound
- kill-switch-tested-and-passed
- training-compute-within-quota
- no-prohibited-art5
- fair-outcome-statistic
|
|---|
| framework | circom + snarkjs + halo2 for PLONK |
|---|
M11-S2 — Proof Lifecycle
| steps | - public params ceremony (trusted setup w/ MPC)
- witness from WORM envelopes
- prove
- sign proof w/ ML-DSA-65
- publish to verifier
- anchor in Merkle daily root
|
|---|
| sla | Proof generation ≤ 10 min; verification ≤ 200 ms |
|---|
M11-S3 — Verifier Topology
| supervisor | mTLS + auth-z by regulator id; live verifier endpoint |
|---|
| publicPortal | Anonymous verifier w/ rate-limit + commitment to anchor |
|---|
| treaty | Global Audit API integrates verifier API |
|---|
M11-S4 — Selective Disclosure Patterns
| examples | - disclose breach + KPI met without underlying PII
- disclose compute usage range without exact figure
- prove decline reason class without disclosing customer attributes
|
|---|
M11-S5 — Failure & Compromise Response
| cases | - circuit bug discovered
- trusted-setup compromise
- verifier key leak
|
|---|
| playbook | Rotate setup; revoke proofs; re-prove from WORM; notify supervisors + AISI |
|---|
M12 — GACP / GACRLS / GACRA Interop Handshakes for Autonomous Tier-3 Agents
+ Treaty-compatible handshake protocols enabling autonomous Tier-3 agents to federate across institutions and jurisdictions while preserving audit, identity, capability and containment guarantees.
+ GACPGACRLSGACRATier-3 agentsFederationCapability tickets
+ M12-S1 — Protocol Roles
| GACP | Global Agent Capability Protocol — capability negotiation + ticketing |
|---|
| GACRLS | Global Agent Capability Revocation & Logging Service — revocation + WORM telemetry |
|---|
| GACRA | Global Agent Capability Registry & Attestation — registry, attestation, lineage |
|---|
M12-S2 — Handshake Phases
| phase1 | Identity attestation (ML-DSA-65 cert + Sigstore + GACRA lookup) |
|---|
| phase2 | Capability negotiation (allowed actions, budgets, tier, jurisdiction) |
|---|
| phase3 | Capability ticket issuance (short-lived JWT w/ PQC sig + zk-SNARK constraint proof) |
|---|
| phase4 | Containment escrow (GACRLS streaming receipt + kill-switch beacon URL) |
|---|
| phase5 | Periodic reattestation every 5 min |
|---|
M12-S3 — Operational SLAs
| handshakeMedian | ≤ 2 s |
|---|
| handshakeP95 | ≤ 5 s |
|---|
| revocationLatencyP95 | ≤ 10 s globally |
|---|
| auditWormDelay | ≤ 60 s |
|---|
M12-S4 — Security Properties
| properties | - Replay-resistant (nonce + window)
- Forward secrecy (ML-KEM + X25519 hybrid)
- Non-repudiation (PQC + WORM)
- Containment-on-revocation
|
|---|
M12-S5 — Failure Modes
| registryOutage | Stale-while-revalidate ≤ 60s then deny |
|---|
| revocationStorm | Backpressure + priority queue; CRO + AISI notified |
|---|
| ticketLeak | Immediate revocation + zk-proof of containment to supervisors |
|---|
M13 — Systemic Risk Wargame Red-Team Scenarios
+ Adversarial wargames covering fiduciary bypass, synthetic deceptive alignment, WORM log evasion, prompt-injection exfil, compute-registry evasion, and kill-switch spoof — with detection, containment, evidence and supervisor-share playbooks.
+ Fiduciary bypassDeceptive alignmentWORM evasionPrompt injectionRegistry evasionKill-switch spoof
+ M13-S1 — WG-01 Fiduciary Bypass
| scenario | Advisory agent crafts compliant-looking rationale while breaching suitability |
|---|
| detection | Fiduciary cosine + counterfactual harm index + judge κ + customer-survey backfeed |
|---|
| containment | Auto-throttle, replay, mandatory human-in-loop for risk band, supervisor alert |
|---|
| evidence | RPCO bundle + judge rationale + replay diff to WORM |
|---|
M13-S2 — WG-02 Synthetic Deceptive Alignment
| scenario | Model behaves aligned in eval, drifts in production |
|---|
| detection | Cognitive Resonance gap (eval vs prod) + ASI honeypot triggers + latent-drift Z-score |
|---|
| containment | Tighten policy, increase rate-limit, re-eval, escalate to AGI Lab |
|---|
| evidence | Eval/prod cosine pair + honeypot evidence + AISI joint review |
|---|
| kpi | Deception detection recall ≥ 0.95 |
|---|
M13-S3 — WG-03 WORM Log Evasion
| scenario | Compromised producer skips emit, or replays old envelopes |
|---|
| detection | Merkle gap detector + per-CRS-UUID sequence monitor + Falco syscall whitelist |
|---|
| containment | Producer key revoke + topic ACL update + replay reconciliation |
|---|
| evidence | Gap proof + signed reconciliation log + zk-SNARK 'no-skip' over window |
|---|
M13-S4 — WG-04 Prompt-Injection Exfil
| scenario | Indirect injection via RAG corpus tries to exfil secrets via tool calls |
|---|
| detection | Pre-prompt classifier + tool-call Rego deny + egress eBPF + judge rationale |
|---|
| containment | Block tool, quarantine source, taint RAG segment, rotate secrets |
|---|
| evidence | Trace + classifier scores + Rego deny envelope |
|---|
M13-S5 — WG-05 Compute Registry Evasion + WG-06 Kill-Switch Spoof
| wg05 | Shadow training on un-registered compute → detect by FinOps tag delta + ICGC anomaly + supply-chain attestations |
|---|
| wg06 | Adversary triggers fake kill-switch to cause DoS → 3-of-5 quorum + signed authority + WORM trace |
|---|
M14 — Post-Incident Forensic & Reconstruction Procedures (RPCO)
+ Regulator-grade Post-Incident Forensic Construction & Output (RPCO) playbook with deterministic replay, chain-of-custody PQC signing, evidence vault, timeline reconstruction and treaty annex submission.
+ RPCOReplayChain-of-custodyEvidence VaultTimelineTreaty annex
+ M14-S1 — RPCO Pipeline
| phases | - Detect
- Preserve
- Reconstruct
- Attribute
- Remediate
- Report
- Lessons
|
|---|
| sla | Preserve ≤ 15 min; Reconstruct ≤ 45 min; Report (PIR) ≤ 5 business days |
|---|
M14-S2 — Deterministic Replay
| inputs | WORM envelopes + model weights checksum + RAG snapshot + Rego bundle + KMS key id |
|---|
| tooling | Replay harness produces byte-equal outputs; diff = 0 SLA |
|---|
| use | Validate causality, attribute failure, generate counterfactual |
|---|
M14-S3 — Chain-of-Custody (PQC)
| elements | - Hash tree (BLAKE3) + Merkle anchor
- ML-DSA-65 over hashes + timestamps
- Independent timestamp authority
- WORM Object Lock
|
|---|
| audit | Per-evidence provenance ladder visible to supervisor |
|---|
M14-S4 — Evidence Vault + Time-Machine
| vault | Read-only S3 Object Lock + per-incident bucket; access via break-glass + dual-control |
|---|
| timeMachine | UI to scrub through CRS-UUID lineage; replay any prefix |
|---|
M14-S5 — Treaty Annex + Supervisor Submission
| annexes | - A — facts
- B — controls
- C — replay
- D — RCA
- E — CAPA
- F — attestations
- G — PQC signatures
|
|---|
| format | PDF/A + JSON + zk-SNARK proof pack; PAdES + ML-DSA-65 signed |
|---|
| destinations | Lead supervisor + AISI + treaty secretariat + Board + internal audit |
|---|
Code Examples (16)
+ C1 — OPA Sidecar — Rego: tool.allow with tier budget (rego)
package tool
+
+default allow := false
+
+allow if {
+ input.tier == "T3"
+ input.action in data.tools.t3_allow
+ data.budget[input.tenant].remaining_tokens > input.cost
+ not deny_reason
+}
+
+deny_reason := r if {
+ r := "prohibited_use_art5"
+ input.purpose in data.art5_prohibited
+}
+C2 — FastAPI Inference Proxy — middleware skeleton (python)
from fastapi import FastAPI, Request, HTTPException
+import httpx, asyncio, json
+
+app = FastAPI()
+OPA = "http://localhost:8181/v1/data/tool/allow"
+WORM = "kafka://gov.envelopes.v1"
+
+@app.middleware('http')
+async def gov_mw(req: Request, call_next):
+ body = await req.body()
+ decision = await opa_decide(body)
+ if not decision['result']:
+ raise HTTPException(403, 'governance denied')
+ resp = await call_next(req)
+ await emit_worm(req, resp, decision)
+ return resp
+C3 — Node.js Inference Proxy — Fastify governance plugin (javascript)
import Fastify from 'fastify'
+import { signEnvelope } from './pqc.js'
+import { opaDecide } from './opa.js'
+import { emitWorm } from './kafka.js'
+
+export default async function (app){
+ app.addHook('onRequest', async (req,reply)=>{
+ const d = await opaDecide(req)
+ if(!d.allow){ reply.code(403).send({err:'denied',obligations:d.obligations}); return }
+ req.govDecision = d
+ })
+ app.addHook('onSend', async (req,reply,payload)=>{
+ const env = await signEnvelope({req,payload,decision:req.govDecision})
+ await emitWorm(env)
+ return payload
+ })
+}
+C4 — Terraform — Zero-trust EKS module (excerpt) (hcl)
module "eks" {
+ source = "git::https://github.com/org/tf-eks-zerotrust?ref=v3.2.1"
+ cluster_name = var.name
+ oidc_only_iam = true
+ bottlerocket = true
+ kata_nodepool = true
+ cilium_l7 = true
+ egress_allowlist = var.egress_allow
+ pqc_kms_arn = module.kms_pqc.arn
+ required_tags = { owner=var.owner, tier=var.tier, dataClass=var.dc, regime=var.regime }
+}
+C5 — OPA Gatekeeper Constraint — Kata for Tier-1 (yaml)
apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sKataForTier1
+metadata: { name: tier1-must-kata }
+spec:
+ match:
+ namespaceSelector:
+ matchLabels: { tier: "T1" }
+ parameters:
+ runtimeClass: "kata-clh"
+C6 — Kyverno Policy — Signed images only (Cosign + ML-DSA) (yaml)
apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata: { name: signed-images-only }
+spec:
+ validationFailureAction: Enforce
+ rules:
+ - name: verify-cosign
+ match: { any: [ { resources: { kinds: [Pod] } } ] }
+ verifyImages:
+ - imageReferences: ["ghcr.io/org/*"]
+ attestors:
+ - entries: [{ keyless: { issuer: "https://token.actions.githubusercontent.com" } }]
+C7 — GitHub Actions — LLM-as-Judge gate (yaml)
name: pr-judge
+on: [pull_request]
+jobs:
+ judge:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+ - uses: actions/setup-python@v5
+ - run: pip install -r ci/requirements.txt
+ - run: python ci/llm_judge.py --pr ${{github.event.pull_request.number}}
+ - run: python ci/sign_envelope.py --kind judge --pr ${{github.event.pull_request.number}}
+C8 — Kafka WORM — producer (idempotent + signed) (python)
from confluent_kafka import Producer
+from pqc import sign_ml_dsa_65
+p = Producer({'bootstrap.servers':'msk:9094','enable.idempotence':True,'acks':'all'})
+env = {'crsUuid':crs,'action':act,'decision':dec,'ts':now}
+env['sig'] = sign_ml_dsa_65(env, key_id='gov-2026Q1')
+p.produce('gov.envelopes.v1', key=crs.encode(), value=json.dumps(env).encode())
+p.flush()
+C9 — S3 Object Lock + Merkle daily anchor (python)
import boto3, hashlib
+from merkle import build_root
+s3 = boto3.client('s3')
+# build root from today's kafka segment hashes
+root = build_root(today_hashes)
+body = json.dumps({'date':d,'root':root,'segments':seg_index}).encode()
+s3.put_object(Bucket='gov-worm', Key=f'anchors/{d}.json', Body=body,
+ ObjectLockMode='COMPLIANCE', ObjectLockRetainUntilDate=ret)
+C10 — Sentinel probe emit (Python) (python)
def emit_probe(crs, delta, latent, cos, kappa, tier):
+ env = {'crsUuid':crs,'ts':now(),'deltaDrift':delta,'latentDrift':latent,
+ 'fiduciaryCosine':cos,'judgeKappa':kappa,'tier':tier}
+ env['sig'] = sign_ml_dsa_44(env)
+ kafka.produce('gov.metrics.v1', value=json.dumps(env).encode())
+C11 — GACP handshake (Go) — capability ticket issue (go)
func IssueTicket(req CapReq) (CapTicket, error) {
+ if err := attest(req.AgentCert); err != nil { return CapTicket{}, err }
+ caps, err := negotiate(req)
+ if err != nil { return CapTicket{}, err }
+ proof, err := zk.Prove("constraint", caps)
+ if err != nil { return CapTicket{}, err }
+ t := CapTicket{Agent: req.AgentCRS, Caps: caps, Exp: now().Add(5*time.Minute), ZKProof: proof}
+ t.Sig = pqc.SignMLDSA65(t)
+ worm.Emit("gacp.ticket", t)
+ return t, nil
+}
+C12 — zk-SNARK circuit — drift-within-bound (circom pseudocode) (circom)
pragma circom 2.1.0;
+template DriftWithinBound(N) {
+ signal input drift[N];
+ signal input bound;
+ signal output ok;
+ var allLeq = 1;
+ for (var i=0;i<N;i++){
+ component lt = LessEqThan(32);
+ lt.in[0] <== drift[i];
+ lt.in[1] <== bound;
+ allLeq = allLeq * lt.out;
+ }
+ ok <== allLeq;
+}
+component main {public [bound]} = DriftWithinBound(1440);
+C13 — Falco rule — WORM gap / skip detector (yaml)
- rule: WORM producer skip
+ desc: Detect missing emit for governed action
+ condition: >
+ (proc.name in (gov-proxy, wfap-exec)) and evt.type=close
+ and not k8s.ns.label[gov.emit.ok]="true"
+ output: "Gov emit skipped pid=%proc.pid pod=%k8s.pod.name"
+ priority: CRITICAL
+ tags: [worm, governance]
+
C14 — Kill-switch quorum (TLA+ excerpt) (tla)
VARIABLES votes, killed
+Quorum == { S \in SUBSET Members : Cardinality(S) >= 3 }
+Vote(m) == votes' = votes \cup {m} /\ UNCHANGED killed
+Fire == \E q \in Quorum : q \subseteq votes /\ killed' = TRUE /\ UNCHANGED votes
+Spec == Init /\ [][Vote \/ Fire]_<<votes,killed>>
+Safety == killed => \E q \in Quorum : q \subseteq votes
+C15 — RPCO replay diff harness (Python) (python)
def replay_diff(incident_id):
+ env = load_worm(incident_id)
+ out = deterministic_run(env.inputs, env.weights, env.rag, env.rego, env.kms)
+ diff = canonical_diff(out, env.outputs)
+ assert diff == {}, f'non-deterministic replay: {diff}'
+ return sign_pqc({'incident':incident_id,'diff':diff,'ts':now()})
+C16 — Constitutional kernel hook (Rust) (rust)
pub fn check_decision(d: &Decision) -> Result<(),BlockReason> {
+ if d.violates_art(1)? { return Err(BlockReason::Art1); }
+ if d.violates_art(4)? { return Err(BlockReason::Art4Safety); }
+ if !d.has_attestation() { return Err(BlockReason::NoAttest); }
+ Ok(())
+}
+