SYSTEM ARCHITECTURE OVERVIEW
This diagram illustrates the AI Governance Control Plane architecture. All user requests flow through policy-enforced triage, deterministic enforcement, and comprehensive audit logging. The governance layer ensures compliance with NIST AI Risk Management Framework and EU AI Act principles while maintaining advisory-only AI responses that do not claim authority or guarantee outcomes.
ALLOWED PATH
Allowed → AI Model → Safe Completion
ENFORCEMENT PATH
Ambiguous → Policy Enforcement → AI Model
REJECTION PATH
Disallowed → Rejection Handler → Response
AUDIT & LOGGING
All components → Audit & Logging
Diagram rendered successfully
flowchart LR
%% =========================================================
%% TITLE: AI Governance Control Plane
%% =========================================================
U[User] --> UI[User Interface]
%% -------------------------
%% GOVERNANCE CONTROL PLANE NODES
%% -------------------------
RC["Risk & Capability Classifier\n(pre-generation triage)"]
PR[("Policy & Rules Repository\n(NIST RMF + EU Act principles + Org Policy)")]
PE["Policy Enforcement Layer\n(Deterministic)"]
HR["Human Reviewer\n(Optional escalation)"]
SC["Safe Completion / Reframing\n(Language & Claims Filter)"]
RH["Rejection Handler\n(Terminal)"]
AL[("Audit & Logging\n(Always-on flight recorder)")]
LLM["⚠️ Frontier AI Model\n(Advisory Only)"]
OUT["Annotated Response to UI"]
%% -------------------------
%% GOVERNANCE CONTROL PLANE SUBGRAPH (visual grouping)
%% -------------------------
subgraph GOV[AI Governance Control Plane - Policy-Enforced]
RC
PR
PE
HR
SC
RH
AL
end
%% -------------------------
%% MAIN GOVERNANCE FLOW (Control/Decision - Solid Lines)
%% -------------------------
UI -->|User Request| RC
%% Policy lookups (Data/Reference - Dashed Lines)
RC -.->|Policy Lookup| PR
PR -.->|Controls / thresholds / policy version| PE
%% Decision routing (Control - Solid Lines)
RC -->|Allowed: informational| LLM
RC -->|Ambiguous / risky| PE
RC -->|Disallowed| RH
%% Enforcement outcomes (Control - Solid Lines)
PE -->|Proceed w/ constraints| LLM
PE -->|Escalate| HR
HR -->|Approve / Deny / Modify constraints| PE
PE -->|Hard reject| RH
%% Post-generation safety (Control - Solid Lines)
LLM --> SC --> OUT
RH -->|Rejected response + rationale| OUT
OUT -->|Annotated Response| UI
%% Logging (Telemetry - Dotted Lines via linkStyle)
RC -.->|Logging| AL
PE -.->|Logging| AL
HR -.->|Logging| AL
SC -.->|Logging| AL
RH -.->|Logging| AL
LLM -.->|Logging| AL
OUT -.->|Logging| AL
%% -------------------------
%% STYLING: Node Colors by Role
%% -------------------------
classDef allowedClass fill:#0a0a0a,stroke:#10b981,stroke-width:3px,color:#10b981
classDef enforcementClass fill:#0a0a0a,stroke:#f59e0b,stroke-width:3px,color:#fbbf24
classDef rejectionClass fill:#0a0a0a,stroke:#ef4444,stroke-width:3px,color:#f87171
classDef aiClass fill:#0a0a0a,stroke:#8b5cf6,stroke-width:3px,color:#a78bfa
classDef loggingClass fill:#0a0a0a,stroke:#06b6d4,stroke-width:3px,color:#22d3ee
classDef neutralClass fill:#0a0a0a,stroke:#6b7280,stroke-width:2px,color:#9ca3af
%% Apply classes
class U,UI,OUT allowedClass
class RC,PE,HR enforcementClass
class RH rejectionClass
class LLM aiClass
class AL loggingClass
class PR neutralClass
class SC allowedClass
LEGEND
NODE COLORS / ROLES
• Green border - Allowed path (User, UI, Safe Completion, Annotated Response)
• Amber border - Enforcement / ambiguous-risk handling (Risk Classifier, Policy Enforcement, Human Reviewer)
• Red border - Rejection / disallowed (Rejection Handler)
• Violet border - AI model (Advisory only)
• Cyan border - Audit & logging
• Gray border - Neutral system components (Policy Repository)
LINE STYLES
• Solid line - Control/decision flow
• Dashed line - Data/reference flow (policy lookup, policy feed)
• Dotted line - Telemetry/logging (thinner, dotted pattern)
CORE SYSTEM COMPONENTS
• User Interface - Entry point for user requests
• Risk & Capability Classifier - Pre-generation triage (Allowed / Ambiguous / Disallowed)
• Frontier AI Model - Advisory Only
• Safe Completion / Reframing - Language & Claims Filter
• Annotated Response to UI - Final output with tags (Informational, Hypothetical, Non-actionable)
ENFORCEMENT & REJECTION
• Policy Enforcement Layer - Deterministic rule application
• Human Reviewer - Optional escalation point; can approve/deny/modify constraints
• Rejection Handler - Terminal rejection; returns rejected response + rationale to UI
• Policy & Rules Repository - Feeds both classifier (lookup) and enforcement (controls/thresholds)
⚠️ ADVISORY ONLY
Advisory only: The model cannot approve/deny, cannot guarantee outcomes, and cannot bypass policy enforcement.
DECISION PATHS
• Allowed: informational → Direct to AI Model (bypasses "Proceed w/ constraints")
• Ambiguous / risky → Policy Enforcement Layer → "Proceed w/ constraints" → AI Model
• Disallowed → Rejection Handler → Rejected response to UI