Seven artifacts you can use right now

The one-page record the registry holds and a reviewer reads first. Identity, accountability, purpose, tier, tools, memory, models, peers, controls, evaluation, operations and retirement plan.

Score the use case and each action class on seven dimensions, derive the A1–A4 class and the autonomy ceiling, then read off the required controls. Includes promotion exit criteria you fill in yourself.

All fifteen AS controls with enforcement mechanism, evidence, and explicit mappings to ISO/IEC 42001, the NIST AI RMF, the AI 600-1 GenAI Profile, EU AI Act articles with provider or deployer role, IMDA dimensions and OWASP ASI risks. Statement-of-applicability rows included.

Structured on OWASP ASI01–ASI10. Every control is marked hard (deterministic code and configuration) or soft (probabilistic screening), so it is obvious which ones actually hold when the model is wrong.

Draft 2020-12 schema for the record a decision point writes before every action. Carries trace and span ids so it joins your OpenTelemetry data, plus the fields the GenAI conventions do not yet cover: decisions, delegation chains, deterministic limits, approvals, outcomes and retention. Fully worked example included.

Component, step, trajectory and outcome scored separately, plus safety, fairness, cost and judge calibration. Severity-weighted, with a coverage section that asks what is missing rather than only what passed.

Ten sections, scaled by action risk class A1–A4, with a go/no-go sign-off block. Any unchecked required item blocks release or becomes a time-limited exception with a named owner.

Browse or clone the whole companion folder. Fork it and make the thresholds yours. Corrections and pull requests are welcome.