← Back to Projects

ARGUS

AI Governance Compliance Engine

Compliance-as-code for AI system inventories—classify, evaluate, gate, and produce audit evidence before deployment.

The Problem

AI governance requirements are difficult to enforce consistently before deployment. Most teams track AI systems in spreadsheets or policy documents that go stale the moment an engineer ships a new model. Security teams have learned to gate infrastructure in CI—AI governance rarely gets the same treatment.

The Approach

AI System Inventory (YAML)
↓
EU AI Act Classification (prohibited / high / limited / minimal)
↓
Control Catalog Evaluation (frameworks/controls.yaml)
↓
CI Gate (gate --fail-on critical)
↓
Evidence Pack (report + findings + SoA + SHA-256 manifest)

Architecture

Python CLI pipeline reading inventory/ai_systems.yaml, evaluating controls from a machine-testable catalog, and generating outputs to output/.

  • Input: AI system inventory YAML with intentional demo flaws for testing
  • Engine: Python 3.12 classifier + control evaluator + pytest suite
  • Gate: GitHub Actions workflow on push/PR to main
  • Output: HTML dashboard, model cards, evidence pack with integrity manifest

Governance Coverage

  • EU AI Act (Regulation 2024/1689) — tier classification per system
  • NIST AI RMF 1.0 — crosswalked in control catalog
  • ISO/IEC 42001:2023 — crosswalked in control catalog; SoA-style output
  • GDPR Art. 22 — referenced for automated decision controls

Roadmap (not shipped): OSCAL export, live cloud collectors, Vanta/Drata sync.

Enforcement

GitHub Actions workflow governance-gate.yml runs pytest, then python src/main.py gate --fail-on critical. Nonzero exit on critical findings blocks merge. CI uploads output/ as a 90-day artifact even on failure.

Evidence

Each run produces output/evidence_pack/ containing:

  • assessment_report.json — structured findings
  • findings_register.csv — exportable register
  • statement_of_applicability.md — ISO 42001-style SoA
  • MANIFEST.json — SHA-256 hashes for integrity verification

Integrity is manifest-based (SHA-256), not Cosign-signed—that pattern lives in the HIPAA capstone project.

Lessons Learned

  • AI governance controls must be machine-testable—if you can’t write a pytest for it, it won’t survive CI.
  • Classification and control evaluation should be separate steps; mixing them makes failures hard to diagnose.
  • Evidence packs need integrity manifests—auditors should verify hashes, not trust filenames.
  • Demo inventories with intentional flaws are essential for proving the gate actually catches problems.
  • Crosswalking three frameworks in one catalog is maintainable only when controls are parameterized, not copy-pasted.
View on GitHub All Projects