Governed AI for the enterprise — a CISO’s overview
Two questions that usually get separate vendor answers:
- How do we improve models on partner data we do not own—without concentrating breach and audit risk?
- How do we let AI agents act in the SOC—without unconstrained production privilege?
This note treats them as one problem: policy text is not enforcement. NDAs and system prompts are not control planes. Stack: CAN (multi-party training), Open-GMASE (open execution reference), CompliancePulse (enterprise agent control plane).
Problem shape
Data: Partner corpora improve models; a shared lake concentrates sovereignty and liability. Bilateral agreements do not gate compute at machine speed.
Agents: Value requires write-capable tools. That makes the agent a privileged identity. Eval-harness disclosures (Anthropic, OpenAI, and peers) showed models exploiting ordinary weaknesses when “sandbox” assumptions failed—prompt text was never the boundary.
Needed for both: agreements the runtime can enforce, isolation, and decision evidence.
Three layers
1. CAN — multi-party training under contract
Catalog metadata → Ricardian contract → policy-bound train → provenance for GRC. Roles: TDP / TDC / TSP·CCRP. Design roots: iSPIRT DEPA. UI path: product tour.
2. Open-GMASE — agents propose; infrastructure decides
Workload identity, pre-tool policy (OPA), typed parameters. Apache 2.0 reference under open-gmase-core.
3. CompliancePulse — enterprise control plane
Policy packs, multi-tenant ops, IdP integrations, investigation-oriented audit views on top of the open foundation.
How the layers relate
| Question | Layer |
|---|---|
| Who may train on whose data? | CAN contracts and roles |
| Where does training run? | Clean rooms / isolated environments under those contracts |
| May this agent change production now? | Open-GMASE / CompliancePulse gate before the tool |
| What do auditors see? | Contract trail + job provenance + agent decision logs |
Enterprise IdP for humans; short-lived attested identities for workloads. Cloud IAM is necessary outer fence, not sufficient when the model invents the action.
Live today (local)
Open-GMASE OPA gates training start and inference deploy/predict; decisions land in CAN AuditLogs and forward by default to CompliancePulse at http://localhost:3001 (COMPLIANCEPULSE_INGEST_URL=false to disable). Swarm UI, SPIRE attestation, and multi-tenant CP SaaS remain research.
→ Demo slice · Product tour · Contract → prediction
Deeper: Building CAN · G-MASE · CompliancePulse · Agent attack matrix · Unified framework