The Constraint Layer
What determines how far the operating model can be pushed. These are not the thesis; they are what makes velocity survivable.
What determines how far the operating model can be pushed. These are not the thesis; they are what makes velocity survivable.
Cross-Cutting Domains
Four concerns that refuse to localize to a stage: agent identity, provenance, evaluation infrastructure, governance.
The Control Maturity Model
Five levels, scored as the minimum across dimensions rather than the average.
The Four Gates
Intake, merge, release, and operational action — each a pass-or-fail decision, never a scorecard.
Metrics and Executive Reporting
What to report, what to keep separate, and the numbers that mislead most when combined.
Tooling Evaluation Criteria
A vendor-agnostic scoring instrument, and how to read a vendor who cannot describe their own product's behavior.
Standards Crosswalk
Where these controls map onto ISO 27002, SSDF, PCI DSS, SOC 2, ISO 42001, and the EU instruments.
Open Problems
What the framework cannot yet answer, and what evidence would close each gap.