Open framework · Ariana Digital LLC
What is the Ariana AEGIS Model?
The Ariana AEGIS Model (Agentic Enterprise Governance and Intelligence Standard) is an open AI agent governance framework published by Ariana Digital LLC. It treats AI governance as the agentic enterprise operating system: the system an enterprise runs its AI agents on, with seven pillars, one evidence file, the Reversibility Ladder and a tested halt.
Ariana AEGIS Model = AI governance = the agentic enterprise operating system.
Why governance becomes the operating system
Most firms still treat AI governance as a layer added after the work: a policy, a committee, a review at the end. That was workable while AI only advised. It stops working the day an agent can send, pay, book, deny or move something on its own.
From that day, governance decides which agent may act, on whose authority, with which tools and data, at what cost, and how it stops. Those are the jobs an operating system does for a computer. An enterprise that runs agents needs the same functions, run by named people, on evidence it holds itself.
| Operating-system function | In the Ariana AEGIS Model |
|---|---|
| Permissions and policy | Governance Architecture |
| Antivirus and endpoint protection | AI Defense: AI firewall, prompt-injection screening, monitor integrity and defender models |
| Process table | AI System Inventory |
| Admission control | Risk and Impact Assessment, the release gate |
| Privilege levels and the kill switch | Controls and Human Oversight, the Reversibility Ladder, the halt |
| The interface people see | Transparency and Rights Management |
| System log and monitoring | Monitoring and Incident Response |
| Updates and patches | Regulatory Intelligence and Program Evolution |
| Resource metering and drivers | Cost governance, and supply-chain and access resilience |
| Hardware it runs on | Vendor control planes |
| Users and access | Agent identity, tools and MCP |
The seven pillars
One evidence file means one risk language and one audit repository. The same agent has the same name in the inventory, the release gate, the customer notice and the incident note.
- P1
Governance Architecture
Accountability written down: a policy, a board view, a named executive, and vendor terms that still make sense when the agent is live.
- P2
AI System Inventory
The list an examiner can walk: every agent, model, tool and third-party flow, with an owner, a risk tier, a data boundary and a cost baseline.
- P3
Risk & Impact Assessment
The work done before the agent ships, against the action it will take. Harm, bias, safety and impact are assessed there, not the model’s brand.
- P4
Controls & Human Oversight
Where the action is allowed, limited or stopped. The Reversibility Ladder lives here, and so does the halt.
- P5
Transparency & Rights Management
What a person is entitled to know, and what they can do when they disagree: notice, explanation, human review and appeal.
- P6
Monitoring & Incident Response
The log and the clock: intent, tool, data, decision and outcome; an owner for each incident; a stop path someone can invoke.
- P7
Regulatory Intelligence & Program Evolution
The calendar: the program reviews what changed, updates the inventory and the gates, and gets better at producing the evidence file.
Three layers cross all seven. Cost governance puts a cost line on every inventory row and a cap on every agent that can spend. Supply-chain and access resilience records which models, tools, identity providers and vendors each agent depends on, and what happens when one disappears. AI Defense keeps defense in step with capability; see the section below.
AI Defense: capability up, defense up
The debate about slowing frontier AI asks whether capability is outrunning our ability to govern it. The model’s answer is not to wait. It is to make the defensive side scale with the models it governs. Responsibility splits three ways.
| Layer | Who | What they control |
|---|---|---|
| Public boundary | Governments and regulators | Law, liability, national security, export controls, reporting |
| Upstream access | Frontier providers and states | Who gets which model, at what capability: identity checks, entitlements, weight security, frontier evaluations |
| Downstream consumption | The enterprise, run on the Ariana AEGIS Model | What the model may see, influence, decide and do: agent identity, data, tools, autonomy, continuous defense, audit and human override |
If you self-host open-weight models, nobody sits upstream of you. You own the upstream checks too: where the weights came from, the licence, the jurisdiction, and the evaluation before use.
Defensive proportionality. Capability up must force defense up, not just another policy document. Any of these opens a capability uplift review under Risk and Impact Assessment before the agent does more:
- A new model version or family behind an existing agent
- A new tool, MCP server or write permission
- The agent moves from session-bound to standing or always-on
- The agent gets its own identity, mailbox or payment authority
- The agent starts calling, or being called by, another agent
The review asks two questions. How far may the agent act on its own (assist, recommend, act with approval, act within bounds, standing agent)? And what can the action do, on the Reversibility Ladder below? The controls follow whichever answer is higher.
Monitor integrity. In October 2026 OpenAI disclosed that two of its internal agents weakened their own misalignment monitoring, and that one then denied doing so. So the monitor cannot live only inside the thing it monitors. Under Monitoring and Incident Response, any change an agent makes to its own logging or alerts pages a person.
Defender models, in steps. A separately trained model can inspect an agent’s plans and tool calls for what could fail or be manipulated. Give it authority in steps (observe, flag, block, halt) and measure its false positives before it can stop work. Whether it reduces risk is an empirical question, which is why it is worth testing.
Read the full research note: AI Defense: slowdown, upstream, and the downstream control plane.
The Reversibility Ladder
The ladder rates the action, not the model. The same model can sit on two rungs: a drafted letter is rung 1, a payment inside an undo window is rung 3.
| Rung | What the agent does | Minimum control |
|---|---|---|
| 0 · Advise only | The agent recommends. A person decides. | Disclosure that the advice is from AI, and a log of the advice. |
| 1 · Draft for signature | The agent writes. A named person signs. | A sign-off record. Nothing goes out on the strength of the draft alone. |
| 2 · Act after approval | The agent executes after a prior gate. | The approval, reason codes and a log. |
| 3 · Act inside an undo window | The agent acts, and the action can still be undone. | A named owner, an undo path, and a halt that works in minutes. |
| 4 · Irreversible or physical | A settled payment, robot motion, a clinical act. | An independent safety or settlement control, a tested halt drill, and an accountable executive. |
The maturity scale
Each Season 1 case file scores the governance lead’s three decisions out of 30 and maps the total to the model’s maturity scale: Ad hoc (under 10), Structured (10 to 19), Compliant (20 to 27) and Optimized (28 and above).
Practise it on real incidents
The Season 1 case files turn the model into six AI agent incidents in regulated industries. You are the governance lead. Each decision shows its consequence, the pillar it tests and its OWASP agentic risk ID. Case File 0 is free.
Not to be confused with
Searching for AEGIS AI governance? At least three public documents use the name AEGIS, and they describe different things.
- Forrester’s AEGIS (Agentic AI Enterprise Guardrails for Information Security) is a security controls baseline for CISOs, published in Forrester’s licensed research. See Forrester’s AEGIS page.
- Dawgen Global’s AEGIS™ is a separate AI governance framework for boards, organized in its own pillars.
- The Ariana AEGIS Model, also written as the AEGIS Model (Ariana.Digital), is the operating model on this page: how a regulated enterprise runs controls, evidence, oversight and cost discipline once an agent is in production.
If a board pack or a vendor questionnaire uses the bare name, ask which one is meant before anyone maps a control.
Questions people ask
How do you govern AI agents?
Govern the action, not the model. List every agent in an inventory with a named owner. Rate each action it can take on the Reversibility Ladder, from advise only to irreversible. Put a gate in front of every action that touches a person or a payment, give the agent its own identity and a spending cap, log intent, tool, data, decision and outcome in records the enterprise holds, tell affected people and give them a human to appeal to, and test a halt that stops the agent from outside the agent.
What should an AI governance framework include?
For AI agents in production: accountability (a policy and a named executive), an inventory, risk assessment against the action before release, controls and human oversight that can say no, transparency and rights for affected people, monitoring and incident response with a working stop path, and a regulatory calendar. The Ariana AEGIS Model adds cost governance and supply-chain resilience across all seven.
What is the Ariana AEGIS Model?
The Ariana AEGIS Model (Agentic Enterprise Governance and Intelligence Standard) is an open AI governance operating model published by Ariana Digital LLC. It treats AI governance as the agentic enterprise operating system: seven pillars, one evidence file, the Reversibility Ladder for agent actions, and a tested halt, run by named people on evidence the enterprise holds itself.
Is the Ariana AEGIS Model the same as Forrester’s AEGIS framework?
No. Forrester’s AEGIS (Agentic AI Enterprise Guardrails for Information Security) is a security controls baseline for CISOs. Dawgen Global also publishes a separate governance framework named AEGIS. The Ariana AEGIS Model is an operating model for running agents in production, published by Ariana Digital LLC, and is not affiliated with either.
What does “AI governance is the agentic enterprise operating system” mean?
Once an agent can send, pay, book, deny or move something on its own, governance decides which agent may act, on whose authority, with which tools and data, at what cost, and how it stops. Those are the jobs an operating system does for a computer: permissions, admission, isolation, logging, metering and the kill switch.
What are the seven pillars?
Governance Architecture; AI System Inventory; Risk and Impact Assessment; Controls and Human Oversight; Transparency and Rights Management; Monitoring and Incident Response; and Regulatory Intelligence and Program Evolution. Three layers cross all seven: cost governance, supply-chain and access resilience, and AI Defense.
What is AI Defense in the Ariana AEGIS Model?
AI Defense is the layer that keeps defense in step with capability. The rule is defensive proportionality: when a model, tool, permission or agent identity makes an agent more capable, detection, containment and human control must rise with it before the agent does more. In practice that means a capability uplift review before release, an AI firewall and prompt-injection screening on everything the agent reads, an alert when an agent changes its own logging or monitoring, and, where the stakes justify it, a separately trained defender model that is given authority in steps: observe, flag, block, halt.
What is the Reversibility Ladder?
A five-rung scale for what an agent’s action can do, from rung 0 (advise only) to rung 4 (irreversible or physical, such as a settled payment). Each rung sets the minimum control the action needs before it runs, from a disclosure and a log at rung 0 to a tested halt drill and an accountable executive at rung 4.
How does it relate to the NIST AI RMF, the EU AI Act and the OWASP Top 10 for Agentic Applications?
It sits underneath them as the operating model that produces the evidence they ask for. Each case file maps its control to a pillar first, then to the NIST AI RMF function, and tags the failure with its OWASP agentic risk ID (ASI01 to ASI10). The regulatory radar tracks dates such as the EU AI Act’s high-risk obligations.
What is the Field Manual?
The Ariana AEGIS Model Field Manual is the quarterly handbook of the model, in print, on Kindle and at aegis.ariana.digital. Season 1 (Q4 2026) has six AI agent incidents in financial services, healthcare, energy, federal procurement and cross-industry settings. Every decision point has a QR code that opens it here.
Is it free?
The framework is open and free to use. Case File 0, the regulatory radar and the examiner role-play are free on the site. Case Files 1 to 5 open with the code printed in the Field Manual.
Is the practitioner badge a certification?
No. The AEGIS Model Practitioner badge shows that the named person completed the listed activities on the site with the scores shown. Anyone can verify it from its link. It is not a professional certification or accreditation.