Defensible AI Library

AI governance agents

Ten agents, one for each GovernanceOS module. Each works in the assistant you already use, and reads a client’s workspace only after you sign in, read-only.

How it works

Three steps, and your client’s records stay where they are

Sign up

The agents are for members. By invitation at launch: sign up, then request your access code.

Add one to your assistant

Save it as an agent in Claude Code, or use it as instructions in Claude, ChatGPT or Microsoft Copilot.

Connect one client, read-only

Add the client workspace’s address and sign in with your email code. The agent reads; it never writes.

The agents

One agent for each module

Maturity position MESAPlaces an institution on four altitudes, in words, from its records.
Used by
CRO, Compliance lead, Internal audit, and the practitioner
Produces
A maturity position report and board briefing inputs, with gaps marked missing
Never
Gives a score, a grade or a percentage
Sign up to get this agent: Maturity position
Charter and decision rights CADREDrafts the charter, decision rights and escalation paths, and checks that each approver holds authority.
Used by
CRO, Compliance lead, and the practitioner
Produces
A charter, a decision-rights table, escalation paths and the authority gaps
Never
Names a committee as an approver
Sign up to get this agent: Charter and decision rights
Gate review Five-GateAssembles the pack for a gate, G1 to G5, with each piece of evidence typed, produced or missing.
Used by
Model owner, Validator, CRO, and the practitioner
Produces
A gate record draft with one named approver, its conditions and the missing list
Never
Passes a gate, or says a system may run
Sign up to get this agent: Gate review
Model validation MESA MRMDrafts the validation report: what was tested, what was not, bias by group and the revalidation triggers.
Used by
Validator, Model owner, and the practitioner
Produces
A validation report, a bias audit report and trigger register entries
Never
Records a result for a test nobody ran
Sign up to get this agent: Model validation
Data governance Data governanceBuilds classification, lineage and residency for each system, and drafts the impact assessments.
Used by
Data lead, Model owner, Compliance lead, and the practitioner
Produces
A data governance view, lineage, a residency attestation and impact assessment drafts
Never
Takes in personal data: it works from metadata
Sign up to get this agent: Data governance
Vendor assessment AVRFIssues the questionnaire, records the vendor’s answers and prepares a decision for signature.
Used by
Procurement lead, CISO, Compliance lead, and the practitioner
Produces
The questionnaire, findings, conditions, a comparison in words and a decision draft
Never
Decides, or scores a vendor
Sign up to get this agent: Vendor assessment
Incident response AIRPTakes an incident from the first signal to the review, with its severity, timeline and reconstruction.
Used by
CISO, CRO, and the practitioner
Produces
An incident pack, draft notices, the review and the trigger that reopens a system
Never
Sends a notice, or invents a deadline no regulation row states
Sign up to get this agent: Incident response
Cross-border residency Cross-BorderNames the deployment pattern from where data sits and where the institution is supervised.
Used by
CISO, Data lead, Compliance lead, and the practitioner
Produces
A transfer risk register and a residency position for each system
Never
States a transfer basis no regulation row supports
Sign up to get this agent: Cross-border residency
Sharia dual review SACFPrepares the technical and Sharia tracks, and the questions for the Sharia supervisory board.
Used by
Sharia board liaison, Validator, and the practitioner
Produces
A dual validation draft kept as two tracks, the checklists and the board’s questions
Never
Makes or infers a Sharia ruling
Sign up to get this agent: Sharia dual review
Engineering review PEVG, PARA and BOEAsks the engineering review questions of each system and drafts its BOE Declaration.
Used by
Model owner, CISO, Validator, Internal audit, and the practitioner
Produces
Review answers with their gaps, and a BOE Declaration draft for each system
Never
Accepts a system’s own say-so as verification
Sign up to get this agent: Engineering review

Learn more about the agents

Each agent works from the GovernanceOS pages, the module’s deposited specification, which it quotes with its DOI, and the client’s records it reads through the connection.

Read-only is set by the workspace’s own sign-in, so an agent can read and never write. Each read is logged, and you can revoke an agent’s access at any time.

One client is connected at a time. A client whose regime profile denies cloud assistants has no address to connect.

Regulation comes only from the regulation rows, with the date each was checked. OSFI Guideline E-23 is read inside the gate review, data governance and vendor assessment agents.

Before you sign up

Ask from your assistant: how an assistant signs in, and what it may do
Defensible AI Library: documents that fill themselves from your records
Plain words: the terms the agents use
Regulation rows: each instrument, its regulator, its status and the date it was checked