Evidence — The Receipts for AQ Score™¶
These are the receipts that ground the standard. The standard itself — the Five Laws of AI Governance and the five-property test for an independent measurement authority — is published in the Foundational Framework. Both the doctrine and the control catalog are deposited with permanent identifiers and an ORCID, so they can be cited, versioned, and checked against later: The Five Laws of AI Governance (v1.0.1) — 10.5281/zenodo.21271750 (this version) · 10.5281/zenodo.21271749 (all versions) — and the SDOS Runtime Governance Framework: Control Catalog and Framework Alignment Library (v1.10) — 10.5281/zenodo.22787187. ORCID 0009-0009-0791-4124. Both are version-pinned deliberately: a reader can verify exactly which version made a given claim.
My perspective comes from working across the autonomy continuum: automation → autonomy → AI. It started in the initial cohort of MiraCosta College's ROV/Drone Operator Technician Program — remotely operated underwater vehicles and unmanned aircraft, machine design and FAA regulation — which I returned to teach in 2019. From there: physical autonomous systems, RF and spectrum sensing, then cybersecurity and digital AI agents. I governed machines that could cause great harm before I governed software, and the control problem turned out to be the same one. That is why the governance layer here covers a physical sensing domain as well as a software one — it was built by someone who had to answer for both.
What anyone can verify without asking me.
Cataloged in the public record today — the NIST OLIR catalog, the USPTO filing record, and the open SDOS Reference Library. No NDA, no briefing, no permission required.
Across three NIST OLIR Concept Crosswalks cataloged as Final Informative References: AI RMF 1.0 (Ref ID 220), CSF 2.0 (Ref ID 215), SP 800-53 Rev 5.2.0 (Ref ID 217). The row count is that of the submissions hosted in the NIST OLIR catalog, not of the summary pages in this library. Catalog inclusion is an informative reference, not a NIST endorsement.
Across five U.S. provisional applications filed April–May 2026, spanning 45 patent families. Filing receipts are available to editors, counsel, and diligence reviewers on request.
300+ control mappings published in the open SDOS Reference Library. Open it and count — the library is public, and this is a documentation figure, not an enforcement figure.
The system runs. Here is what it does when it does.
Measured on the production build, not modeled from a design document. Figures below are engineering benchmarks of this system — see the methodology disclosure for exactly what each one counts.
Verified 2026-09-29 on the current build: 61 governed tools across 10 modules, each carrying a signed manifest. The suite runs against the same build that serves live traffic; the test report is available to diligence reviewers on request.
The same governance layer applies to software agents and to physical RF sensing hardware running since July 2026 at research grade; production references are not claimed. Governance built for software alone does not transfer to the physical domain; this was designed for both from the start.
Measured internally on the governed execution framework production build through governed model selection — routing tasks to the right model tier instead of defaulting to the most expensive. See methodology.
Modeled (not client-measured) for a representative mid-market enterprise operating 50+ governed agent workflows. Based on production cost data from governed model selection. See methodology.
Measured internally on the governed execution framework production build. Share of agent tasks routed to local inference models, eliminating per-call cost. See methodology.
Selected founder and AAM Cyber engagement outcomes.
Client identities are withheld under confidentiality obligations. Outcomes and scope are representative of the type of governance work delivered. References available under NDA for qualified buyers — request during the readiness assessment.
HIPAA + SOC 2 Readiness
Identified 12 control gaps across a healthcare MSP’s compliance posture. Delivered a prioritized 90-day remediation roadmap. Client achieved audit-ready status within the remediation window.
PCI-DSS Endpoint Hardening
Mapped 47 controls to CIS benchmarks for a financial services SMB. Delivered complete endpoint hardening with audit-ready evidence pack in under 48 hours.
Production Infrastructure Security
Built and maintained IT security infrastructure for a production organization over 7 years. Implemented CIS Controls v8 (IG1-IG2) mapped to NIST CSF and SOC 2. Remediated 15,000+ vulnerabilities across production systems.
Patent-backed governance architecture, positioned for buyer evaluation rather than disclosure theater.
Patent-Filed Governance System
The underlying governance system is covered by five U.S. provisional patent applications filed April–May 2026 — 45 patent families, 334 total claims across five provisionals. Filing receipts are available to editors, counsel, and diligence reviewers on request.
Production Governance Posture
Policy enforcement, governed model selection, and risk-aware oversight of agent actions — operating, not specified on paper. On 2026-09-23 the enforcement layer refused a request from its own operator, returning a recorded refusal with an audit identifier rather than performing the action. That is one dated result, not a guarantee of every outcome.
Compliance Translation Layer
Maps operating architecture into language risk, compliance, procurement, and executive stakeholders can actually use.
- —policy enforcement for agent actions
- —deny-by-default protection for agent actions
- —risk-aware oversight of agent actions
- —governed model selection
- —compliance mappings across 17 frameworks
- —Active professional certifications across security, networking, and operations — independently verifiable on Credly
- —Career Air Force veteran
- —FCC Amateur Radio License (Technician) and FCC GMRS License — federally licensed to operate in the spectrum this work governs
- —Former CEO of a drone logistics company
- —WGU B.S. Cybersecurity and Information Assurance completed
- —M.S. Cybersecurity and Information Assurance begins November 2026
Governance claims are easy to make. Evidence is harder.
If you are evaluating AI governance support, the real question is whether the advisor has named the problem clearly, built a system that addresses it, and can translate it into a defensible operating model for your environment.
AAM Cyber's proof set combines measured operating outcomes, compliance structure, and patent-backed design into a format leadership can actually use.
Review Services Browse the Framework Crosswalk Catalog Review the Standard Contact
What Each Number Counts¶
Several figures appear across this site and they count different things. A reader comparing them without the definitions could reasonably think they disagree. They do not — the denominators differ.
| Figure | What it counts | Where it comes from |
|---|---|---|
| 24 controls | The canonical SDOS control catalog, across 9 governance domains. The controls themselves, not their mappings. | SDOS Reference Library, v1.10 |
| 17 frameworks | Frameworks the catalog is crosswalked to. 16 have their own reference page; NIST AI RMF 1.0 is documented in the library index as an OLIR submission. | Reference library page count |
| 300+ control mappings | Relationships between the 24 controls and the 17 frameworks — one control maps to many framework provisions. A documentation figure. A smaller subset is enforced at runtime in the production build. | 2026-09-18 recount: 312 on a row-per-mapping basis, 657 on a controls-mapped basis. 300+ is published as a conservative floor, not a precise integer, because frameworks do not share one counting unit. |
| 824 OLIR mapped rows | Rows in the three Concept Crosswalks as submitted to and hosted by NIST, not in the summary pages of this library. | The submitted OLIR workbooks. Conservative: a row count of the current submissions runs higher. |
| 6 NIST OLIR crosswalks: 3 Final + 3 in public review | Final Informative References cataloged by NIST: AI RMF 1.0 (Ref ID 220), CSF 2.0 (215), SP 800-53 Rev 5.2.0 (217). In 30-day public review since 2026-10-06: three Five Laws of AI Governance crosswalks to the same frameworks (Draft). | NIST OLIR catalog |
| 334 patent claims | Total claims across five U.S. provisional applications, spanning 45 patent families. | Filing receipts, available on request — provisionals are unpublished by statute |
| 328 passing tests · 61 tools · 10 modules | The production build of the governed execution framework, verified at source 2026-09-29. | Build artifact; verifiable under NDA |
⚠️ Published coverage is not active enforcement. The mapping counts describe what is documented in the public reference library. What a given deployment enforces at runtime is a smaller, separate number, and this site does not claim otherwise.
⚠️ Counts drift. Figures here were verified on the dates given. Where a number could be reconstructed differently by a careful reader — mapping counts especially — the published form is deliberately a floor rather than an exact integer.
Methodology and Measurement Disclosure¶
The numbers presented above are derived from internal benchmarking of the governed execution framework production build and modeled projections, not from third-party-audited client deployments. Buyers evaluating this work should read these numbers in the spirit they are intended: as engineering benchmarks of the system's design, not as warranties of identical outcomes in any specific deployment.
75.3% token cost reduction — Measured on the governed execution framework MCP production build by comparing the cost of executing a representative agent workload (a) without governed model selection (every task routed to the highest-tier commercial model) against (b) with governed model selection, in which each task is routed to a model tier according to its risk classification rather than every task defaulting to the highest tier. The 75.3% figure represents the reduction in aggregate token-billing cost across the workload under the governed-dispatch configuration. Single-build benchmark, not multi-tenant production data.
53% zero-marginal tasks — On the same governed execution framework production build benchmark, the share of agent tasks classified at R1 (low-risk, C1 dispatch eligible) and routed to local inference models that incur no per-call commercial cost. Single-build benchmark; the ratio in any given deployment depends on workload composition.
$960K projected annual savings — Modeled, not client-measured. Projection for a representative mid-market enterprise operating 50+ governed agent workflows at typical commercial-AI token-consumption rates, applying the 75.3% reduction figure above. This number is illustrative of what governed model selection can be expected to deliver at that scale — it is not a measured outcome from any specific client deployment.
300+ control mappings across 17 frameworks — PUBLISHED LIBRARY figure. These are the mappings documented in the public SDOS Reference Library — 16 framework pages plus NIST AI RMF 1.0, which is documented in the library index as an OLIR submission rather than a separate page. A 2026-09-18 recount produced 312 mapping rows on a row-per-mapping basis and 657 on a controls-mapped basis; 300+ is published as a conservative floor rather than a precise integer, because frameworks do not share a single counting unit (CSF 2.0 and SP 800-53 are OLIR submissions with declared totals and cannot be row-counted the same way). The library is public — open it and count.
⚠️ This is a DOCUMENTATION figure, not an enforcement figure. A smaller subset of these mappings is actively enforced at runtime in the production build. Published coverage is not the same as active enforcement, and this page does not claim otherwise. The runtime enforcement scope is available to diligence reviewers on request.
NIST OLIR Trifecta — Final — Three Concept Crosswalks listed in the NIST OLIR catalog: AI RMF 1.0 (Reference ID 220, Final), CSF 2.0 (Reference ID 215, Final), and SP 800-53 Rev 5.2.0 (Reference ID 217, Final). All three are Final Informative References. Public review concluded with zero comments: AI RMF 1.0 on 2026-06-15, CSF 2.0 and SP 800-53 Rev 5.2.0 on 2026-06-22. Catalog inclusion is an informative reference, not a NIST endorsement.
NIST OLIR, Five Laws of AI Governance — Draft — Three further crosswalks, mapping the Five Laws of AI Governance to AI RMF 1.0, CSF 2.0 and SP 800-53 Rev 5.2.0, passed NIST screening and validation and were catalogued as Draft Informative References on 2026-10-06. They are in their 30-day public review.
Engagement outcomes (Healthcare, Financial Services, Enterprise blocks above) — Representative scope and outcome patterns from prior governance work delivered under standard consulting confidentiality. Client identifiers are protected. References available under NDA for qualified buyers.
If you need the underlying benchmark data, raw cost-trace logs, or the governed execution framework build version against which the 75.3% / 53% figures were measured, request it during a readiness assessment and it can be shared under NDA.