> For the complete documentation index, see [llms.txt](https://www.aicontrolarchitecture.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.aicontrolarchitecture.org/docs-readme.md).

# AI Control Architecture

A vendor-neutral control architecture for governing, securing, assuring, and containing enterprise AI adoption.

> **The thesis, in one line:** the next major AI failure in the enterprise will not come from a model becoming evil — it will come from giving a **probabilistic system deterministic authority** over data, decisions, or actions **without a control architecture.** This documentation is how you build that architecture.

The framework is organized around six control questions:

```
1. What AI exists?
2. What can it see?
3. What can it decide?
4. What can it do?
5. Who is accountable?
6. How is failure evidenced and contained?
```

— which resolve into **ten control pillars** and a supporting operating model.

***

## How the documentation is structured

```
01–06   Foundation   what control means and why
07–16   Pillars      the ten control domains, in depth
17–25   Operating    how to implement, assess, run, and audit it
26      Glossary     shared definitions
```

### Foundation (01–06)

| #  | Document                                                             |
| -- | -------------------------------------------------------------------- |
| 01 | [Executive Summary](/foundation/01-executive-summary.md)             |
| 02 | [Introduction](/foundation/02-introduction.md)                       |
| 03 | [Core Thesis](/foundation/03-core-thesis.md)                         |
| 04 | [Architecture Principles](/foundation/04-architecture-principles.md) |
| 05 | [Reference Architecture](/foundation/05-reference-architecture.md)   |
| 06 | [Requirements Catalogue](/foundation/06-requirements-catalogue.md)   |

### The ten pillars (07–16)

| #  | Pillar                                                                                      | Question                      |
| -- | ------------------------------------------------------------------------------------------- | ----------------------------- |
| 07 | [Inventory & Classification](/the-ten-pillars/07-pillar-ai-inventory-and-classification.md) | What AI exists?               |
| 08 | [Identity & Access Control](/the-ten-pillars/08-pillar-ai-identity-and-access-control.md)   | Under what identity / access? |
| 09 | [Data Boundary Control](/the-ten-pillars/09-pillar-data-boundary-control.md)                | What can it see?              |
| 10 | [Input Control](/the-ten-pillars/10-pillar-input-control.md)                                | What shapes it?               |
| 11 | [Output & Decision Control](/the-ten-pillars/11-pillar-output-and-decision-control.md)      | What can it decide?           |
| 12 | [Tool & Action Control](/the-ten-pillars/12-pillar-tool-and-action-control.md)              | What can it do?               |
| 13 | [Human Accountability](/the-ten-pillars/13-pillar-human-accountability.md)                  | Who is accountable?           |
| 14 | [Assurance & Testing](/the-ten-pillars/14-pillar-assurance-and-testing.md)                  | Do the controls hold?         |
| 15 | [Monitoring & Evidence](/the-ten-pillars/15-pillar-monitoring-and-evidence.md)              | Can we reconstruct it?        |
| 16 | [Containment & Recovery](/the-ten-pillars/16-pillar-containment-and-recovery.md)            | Can we stop and recover?      |

### Operating (17–25)

| #  | Document                                                                                         |
| -- | ------------------------------------------------------------------------------------------------ |
| 17 | [Implementation Checklists](/operating-the-architecture/17-implementation-checklists.md)         |
| 18 | [Control Maturity Model](/operating-the-architecture/18-control-maturity-model.md)               |
| 19 | [Common AI Control Patterns](/operating-the-architecture/19-common-ai-control-patterns.md)       |
| 20 | [Common Failure Scenarios](/operating-the-architecture/20-common-failure-scenarios.md)           |
| 21 | [Adoption Playbook](/operating-the-architecture/21-adoption-playbook.md)                         |
| 22 | [Governance & Operating Model](/operating-the-architecture/22-governance-and-operating-model.md) |
| 23 | [Metrics & Reporting](/operating-the-architecture/23-metrics-and-reporting.md)                   |
| 24 | [Assurance & Audit Guide](/operating-the-architecture/24-assurance-and-audit-guide.md)           |
| 25 | [Triage & Minimum Controls](/operating-the-architecture/25-triage-and-minimum-controls.md)       |

### Reference

| #  | Document                              |
| -- | ------------------------------------- |
| 26 | [Glossary](/reference/26-glossary.md) |

***

## Supporting assets (repository root)

* [`templates/`](/templates-and-examples/templates-readme.md) — reusable intake, risk-tiering, per-pillar control, assurance, evidence, and incident templates.
* [`mappings/`](/standards-crosswalks/mappings-readme.md) — standards crosswalks (NIST AI RMF, ISO/IEC 42001, EU AI Act, SR 11-7, NYDFS Part 500, OWASP LLM & Agentic, US state AI laws).
* [`examples/`](/templates-and-examples/examples-readme.md) — worked use-case examples.
* [`../QUICKSTART.md`](/quickstart.md) — a single AI use case walked from intake to evidence.

***

## Where to start

**New to the architecture** → read the foundation in order: `01 → 02 → 03 → 04 → 05`, then skim `06`.

**Implementing controls** → start with the [Quickstart](/quickstart.md), then `17` (checklists), `21` (adoption playbook), `22` (governance).

**Assessing maturity** → `18` (maturity model) + `23` (metrics) + the maturity-assessment template.

**Understanding a control domain** → the relevant pillar (07–16).

**Understanding how AI fails** → `20` (failure scenarios).

**Testing or auditing** → `24` (assurance & audit) + the assurance and evidence templates.

**Just need the minimum** → `25` (triage & minimum controls).

***

*Version 0.1.0 · Licensed under the terms in* [*LICENSE.md*](https://github.com/ai-ankqush/ai-control-architecture/tree/main/LICENSE.md)*.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.aicontrolarchitecture.org/docs-readme.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.