# AI governance

Essays and notes tagged AI governance.

- [Self-describing knowledge: why the Open Knowledge Format matters, and what enterprises must add](https://muthub.org/writing/self-describing-knowledge-open-knowledge-format.md) (Sep 15, 2026): In June, Google Cloud published the Open Knowledge Format, and July's v0.2 added provenance, verification and freshness. It is the right foundation. Regulated enterprises still need to add ownership, classification and a policy for how much trust an agent needs before it acts.
- [Inside an Architecture-as-Code platform: a C4 walkthrough](https://muthub.org/writing/inside-an-architecture-as-code-platform.md) (Jun 9, 2026): The open prototype at aac.muthub.org, described in its own notation and validated by its own rules. A level-by-level C4 walkthrough of the design decisions that mattered, and what I would change before an enterprise ran it.
- [Model is a tool, harness is the strategy](https://muthub.org/writing/model-is-a-tool-harness-is-the-strategy.md) (May 26, 2026): Handing an AI agent a production codebase without a harness is like putting a teenager in a sports car with no dual brakes. Deterministic guardrails and sensors, owned as a platform, are what make agents safe to scale.
- [Architecture that runs: why AI-era governance must be code](https://muthub.org/writing/architecture-that-runs.md) (May 12, 2026): AI now writes code faster than any review board can read it, while architecture still moves at meeting speed. Governance has to become something that executes in the pipeline and in the agent's context.
- [If you can't prove why an AI wrote it, you can't ship it](https://muthub.org/writing/if-you-cant-prove-why-an-ai-wrote-it.md) (Feb 24, 2026): Shipping AI-generated code without recording where it came from is unmanaged risk. Regulated teams need deterministic provenance for non-deterministic models: line-level attribution, Git-native session history and AI bills of materials.
- [Spec-driven development for regulated industries: audit the contract, not every line](https://muthub.org/writing/spec-driven-development-for-regulated-industries.md) (Oct 21, 2025): For complex work in regulated sectors, prompt-to-code cannot pass an audit. Making the specification the contract an AI must fulfil can, provided the spec stays anchored to the code and machines check conformance.
- [Designing an enterprise MCP registry: the control point agents need](https://muthub.org/writing/designing-an-enterprise-mcp-registry.md) (Sep 18, 2025): As agents multiply, every enterprise needs an authoritative directory of the tools they can call. What a governed MCP registry must do, what the official registry leaves to you, and the mistakes to avoid.
- [Adopting MCP in a bank: the four risks to solve first](https://muthub.org/writing/adopting-mcp-in-a-bank.md) (Apr 22, 2025): The Model Context Protocol standardizes how agents connect to tools and data. It is silent on whether they should. Four risk areas a regulated institution should resolve before agents get tools.
- [Governance belongs in the catalog](https://muthub.org/writing/unified-governance-in-the-catalog.md) (Apr 14, 2025): When business meaning, data products and relationships live in one open catalog, agents stop guessing at tables and governance travels with the data.

---
Muthukrishnan (Muthu) Bommiah · https://muthub.org · Views are my own and do not represent my employer.