Architecture · AI Governance & Security
Two rings around one system: governance closest to the AI — the rules for how it's built, approved, and run — and security wrapped around that — the controls that catch what governance alone can't. Hover any node below to read what it actually does.
Hover any node in the diagram — the center, an inner GOV node, or an outer SEC node — to read what it does.
The inner ring is what you'd write down if someone asked "how do we responsibly build and run this." Lifecycle governance, use-case intake, compliance mapping, model management, risk scoring, and the enforcement controls for when something drifts — none of it assumes a bad actor. It assumes good-faith teams who still need gates, owners, and a paper trail.
The outer ring assumes the opposite: that something will bypass the inner ring, whether that's a team spinning up an unregistered LLM integration, an attacker probing for a jailbreak, or sensitive data trying to leave through a response nobody thought to filter. Discovery, posture management, threat monitoring, pen testing, and an inline firewall exist specifically to catch what governance alone can't — which is why security wraps around governance instead of sitting beside it.
Read together, the two rings answer two different questions: GOV asks "is this AI system allowed to do what it's doing," and SEC asks "is anything, right now, doing something it shouldn't." A framework that only answers one of those is watching half the picture.