3
NIST OLIR
Cataloged
Cataloged
334
Patent Claims
Filed
Filed
17
Framework
Alignments
Alignments
2
Governed
Domains
Domains
EU AI Act general-purpose AI obligations enforceable from 2 August 2025.
Category position
A filed governance architecture covering both domains.
Most governance architectures address one or the other. AQ Score™ measures both.
Digital Domain
AI agent dispatch governance. Classifies, bounds, and enforces at the moment of action — before execution. Produces the AQ Score™ from infrastructure outside the agent.
Physical Domain
Drone, RF, and critical infrastructure governance. Same enforcement architecture, sensor-layer substrate. TraceLock™ extends AQ Score™ into the physical world.
The Gap
Autonomous systems are acting.
The governance layer that binds them is mostly empty.
The governance layer that binds them is mostly empty.
The trade press covers AI agent incidents in one column, drone near-misses in another, critical infrastructure vulnerabilities in a third. Nobody is writing about the connecting thread.
The connecting thread is this: an autonomous system acts without a human at the controls in that moment. Every incident shares one structural failure — the system that should have governed the action either did not exist or did not bind. That is the gap. That is what runtime governance is for.
My perspective comes from working across the autonomy continuum: automation → autonomy → AI, from remotely operated underwater vehicles and small unmanned aircraft, through RF and spectrum sensing, to cybersecurity and digital AI agents. I governed machines that could cause harm before I governed software, and the control problem turned out to be the same one.
The connecting thread is this: an autonomous system acts without a human at the controls in that moment. Every incident shares one structural failure — the system that should have governed the action either did not exist or did not bind. That is the gap. That is what runtime governance is for.
My perspective comes from working across the autonomy continuum: automation → autonomy → AI, from remotely operated underwater vehicles and small unmanned aircraft, through RF and spectrum sensing, to cybersecurity and digital AI agents. I governed machines that could cause harm before I governed software, and the control problem turned out to be the same one.
The Standard — Five Properties
01
Measurement layer that survives the system
A shared scale for what an autonomous system was authorized to do versus what it did — independent of the governed system narrating its own compliance.
02
Dispatch-time enforcement
Governance binds at the moment of action, not at the moment of audit. Post-hoc observation is the start of incident response. It is not its prevention.
03
Tamper-evident attestation
Audit trail produced by infrastructure outside the governed system. The autonomous system cannot be the only witness to its own compliance.
04
Federated authority
No single vendor measures itself. Separable certifying parties, published criteria, verifiable evidence chains. The practitioner who builds it first does not own the standard.
05
Fail-closed off-switch
Control is revocable from outside the governed system, and loss of governance fails closed — execution halts rather than continuing on its last authority. A system that can outlive its own off-switch was never under control.
How It Fits Together
Doctrine — the Five Laws of AI Governance
What must hold for autonomous action to be governed at all. Published, DOI-anchored, citable.
Standard — the Five Properties, measured by AQ Score™
What qualifies as independent measurement, and the scale that reports it: −3 to +13.
Implementations — governed execution and TraceLock™
Two runtimes demonstrating the standard holds in practice: one over software agents, one over physical RF sensing. Not products for sale — existence proofs.
Evidence — everything below this line
NIST Online Informative References (OLIR), patent filings, framework mappings, runtime records. Each one checkable without asking permission.
Why This Is Different
One standard across both domains
AI agents and physical autonomous systems — drones, RF, critical infrastructure — governed and measured under one architecture. We are not aware of another filed system covering both. This is not a roadmap item.
Dispatch-time enforcement, not post-hoc observation
Governance binds at the moment of action. Not after the agent acted. Not at audit time. At dispatch. A 200-page methodology is not enforcement.
Audit evidence the governed system can't edit
Tamper-evident attestation produced outside the autonomous system. A system that decides to act against its operator will also not narrate that decision accurately.
A score that survives the system being measured
AQ Score™ is not a self-reported maturity model. It measures what the autonomous system was authorized to do versus what it did — from outside the system. That distinction is not optional.
Published Doctrine
Autonomy Has No Scorekeeper
The architectural case for a measurement authority separable from whoever builds first. Start with the essay, or go straight to the canonical Foundational Framework — the Five Laws, the five-property test, and the work already filed. The doctrine and the control catalog are both deposited with permanent identifiers: 10.5281/zenodo.21271749 and 10.5281/zenodo.22787187, ORCID 0009-0009-0791-4124. Cite it, version it, contest it.
The Architecture — Two Substrates, One Standard
Platform · Digital Layer
Governed Execution Framework
The governed execution framework that classifies, bounds, and enforces AI agent actions at dispatch — before they execute. Patent-filed across five U.S. provisionals. NIST OLIR Trifecta cataloged. Produces AQ Score™ from infrastructure architecturally separated from the agent.
Platform · Physical Layer
TraceLock™ — Multi-Domain Sensing System
RF and sensor-layer governance for drones, critical infrastructure, and physical autonomous systems. Same enforcement architecture as the governed execution framework — extended into the physical domain. Governance does not end at the API.
The Receipts — Verifiable Today
The architecture is already in the public record. Anyone can read it, audit it, contest it, or extend it. That is the point. The doctrine behind it is published in the Foundational Framework.
3
NIST OLIR
Crosswalks Cataloged
Crosswalks Cataloged
5
U.S. Provisional
Patents · 334 Claims
Patents · 334 Claims
17
Framework Alignments
300+ Control Mappings
300+ Control Mappings
2
Governed Domains
Digital + Physical
Digital + Physical
215+
Days Production
Runtime
Runtime