What I've learned, what I'm learning, and hopefully some things you can learn from me.¶
This is my personal notebook: what I'm learning, what I want to teach, and what I'm thinking through. My consulting and standards work lives at AAM Cyber. My projects live at portfolio.pharns.com.
Publications¶
What the 2026 AI Governance Frameworks Bind, and What They Leave Open Two bodies of AI governance work get read as one conversation. They aren't. Assessment work defines when an evaluation counts as independent. Enforcement work binds an action before it happens. I mapped what each actually specifies, and where both stop: outside one financial-services proposal, neither produces a result you can compare across organizations.
The Five Laws of AI Governance The minimum conditions for governing an autonomous system independently. The system can't be its own judge, witness, owner, or executioner. And governance binds before the act, not after.
SDOS Runtime Governance Framework: Control Catalog and Framework Alignment Library 24 controls for runtime governance of autonomous and agentic systems, across 9 domains, mapped to 17 established frameworks. Three of those mappings are Final in NIST's OLIR catalog. That's published mapping data, not a NIST endorsement. The library says what each control is for, not how it's built.
Each links to its canonical copy. Cite that copy, not this page.