Governance bolted on at the end
Risk and compliance arrive after the architecture is set — serious findings mean costly redesign.
The usual pitfalls
Practitioners will recognize these recurring patterns behind delayed launches, failed audits, and agents quietly pulled from production.
Shadow AI
Business units adopt agentic tools faster than central governance can track them.
No reconstructable audit trail
When asked how a decision was reached, the answer is often “the model decided.”
Unenforced human oversight
“Human in the loop” lives in policy documents but nowhere in the running system.
The pipeline
One open pipeline from use case to evidence. Each card links to the stage section below. Built in along the way: a CI/CD build gate that checks controls on every build, and human sign-off where it matters.
- Use Case Catalog•
Use case prioritization
From a catalog of potential use cases — prioritization by the Use Cases Working Group, mapped to AIGF and tiered by risk.
1Define the policy
Risks and mitigations, in the AI Governance Framework (AIGF).
2Describe the system
The architecture, as code, in CALM.
3Set the guardrails
Cloud controls enforced at runtime, with Common Cloud Controls (CCC).
4Orchestrate
Fluxnova runs the process, with a human in the loop.
- Control Tower5
Observe and prove
Traces, metrics and evidence from every step (Prometheus, Grafana and Tempo in the demo).
CI/CD build gate
Controls checked on every build before anything ships.
Human in the loop
Sign-off where it matters — enforced in the process, not only in policy.
Pipeline start
Use case prioritization
A catalog of potential use cases — prioritization is the result of the Use Cases Working Group, mapped to AIGF and tiered by risk. Start from a common taxonomy so institutions compare and govern use cases consistently — whether fraud detection, autonomous trading, or AI-aided software development.
Catalog & risk tiers
Draw from a shared catalog of potential pre-competitive use cases, then prioritize — mapped to AIGF risks and mitigations — so funding and delivery focus where governance matters most.
Use Cases Taxonomy
Classify systems across dimensions like AI type, architecture pattern, and data handling requirements so risk and controls scale to what a system actually does.
Explore the Taxonomy →1 — Define the policy
Define the policy
Risks and mitigations, in the AI Governance Framework (AIGF). AIGF is the foundation of the pipeline — defining what to govern so architecture, controls, and orchestration share one industry baseline.
AI Risks & Mitigations Catalog
A standardized catalog of governance controls for AI and agentic systems — covering model selection, autonomy levels, operational oversight, supply chain integrity, and regulatory alignment.
Explore the Catalog →Mapped to the rules firms already answer to
- EU AI Act
- ISO/IEC 42001
- NIST AI 600-1
- NIST SP 800-53
- SR 11-7
- FFIEC
- OWASP LLM
- OWASP Agentic
- OWASP ML
- Agent Threat Rules
- IOSCO
- UK FCA · PRA
- Canada OSFI · CSA
2 — Describe the system
Describe the system
The architecture, as code, in CALM — plus reference patterns for FSI AI systems.
CALM (Architecture as Code)
Transforms governance policies into machine-readable, executable specifications so institutions can embed compliance checks in CI/CD, development workflows, and runtime environments.
Learn more →AI Reference Architecture Library
FSI-specific AI reference architectures and threat models that consider AIGF catalog risks — including patterns for multi-agent and tool-using systems.
Explore Library →CI/CD build gate
Controls checked on every build. CALM CI/CD integration validates agents and orchestration logic against AIGF-defined policy before anything ships.
3 — Set the guardrails
Set the guardrails
Cloud controls, enforced at runtime, with Common Cloud Controls (CCC).
CCC (Common Cloud Controls)
Standardized cloud security and compliance controls for AI workloads — mapping regulatory expectations to actionable technical controls for hybrid and multi-cloud environments.
Learn more →4 — Orchestrate
Orchestrate
Fluxnova runs the process, with a human in the loop — sign-off where it matters.
Fluxnova (Agentic Orchestration)
BPMN/DMN orchestration that defines deterministic process boundaries around non-deterministic agent behavior — with full execution tracing for audit.
Human in the loop
Human oversight is enforced in the running process — gateways and decision rules that require sign-off — not only asserted in a policy document.
Learn more →
5 — Observe and prove
Observe and prove
Traces, metrics and evidence from every step. In the Steel Thread Demo that means Prometheus, Grafana and Tempo — so an institution can reconstruct how a decision was reached.
OpenTelemetry
Open instrumentation capturing real-time traces, metrics, and logs from running agents and orchestration.
Prometheus · Grafana · Tempo
Dashboards and traces that turn runtime behavior into operational and compliance signal — the evidence layer of the pipeline.
Across the pipeline: AI Evaluation and Tokenomics
Two capabilities that cut across the pipeline — both marked new for the OSFF New York message.
ProjectNew
AI Evaluation
Golden tests at build, guardrails that route to human review, and monitoring in production. A FINOS Labs project.
Working GroupNew
Tokenomics
Cost by agent, use case and department — attribution across the governed workflow.
Read · Run · Contribute
Go deeper with the Playbook, see the pipeline run, join the Use Cases Working Group, contribute controls, or get leaders trained on AIGF.
Read the Playbook
First Edition — Draft. A practical guide through the Governance-as-Code pipeline, worked against a KYC use case.
Open the Playbook →Download PDF →See it run
The AI Steel Thread Demo — the pipeline end to end, powered by the FINOS AI Fund.
Run the demo →Use Cases Working Group
Help grow the catalog, prioritize use cases mapped to AIGF, and contribute taxonomy entries.
Get Involved →Contribute
Improve the framework and the Playbook — open text a regulator or peer institution can reuse.
AIGF on GitHub →Playbook on GitHub →