About CALIBRE Governance Fabric

The one-sentence pitch. Enterprise AI initiatives fail governance not because organisations lack policies, but because policies, risk assessments, governance frameworks, and AI inventories live in disconnected spreadsheets and manual review meetings. This platform connects them into a single lifecycle-aware system.

Four capabilities, one platform

Capability	Question it answers	Where it runs
ARA (Agentic Risk Analyst)	Should we build it? What could go wrong?	Separate Render app; called via HTTP API
CALIBRE	How intensely must this AI be governed?	Native Python port of CALIBRE's deterministic scoring
Secure-RAG	What does trusted evidence say?	Separate Render app; called via HTTP API
Governance Fabric (this app)	What should the enterprise DO? Track every AI initiative over time.	This service. FastAPI + SQLite.

Data flow

             User (scenario or question)
                         |
                         v
              CALIBRE Governance Fabric
                         |
        +----------------+----------------+
        |                |                |
        v                v                v
       ARA            CALIBRE         Secure-RAG
   (LLM-based)      (deterministic)   (RAG-based)
        |                |                |
        +----------------+----------------+
                         |
                         v
             Structured Findings (JSON)
                         |
                         v
                Decision Engine
                         |
                         v
        Executive Decision Pack + Trust Score
                         |
                         v
              AI Initiative Register (SQLite)
  

Trust Score formula

Trust = 0.40 × (100 − ARA_residual_pct)
      + 0.30 × (100 − band-consistent GII)
      + 0.30 × evidence_coverage_pct

band-consistent GII = max(GII, lower limit of final band: 0 / 26 / 51 / 76)
No ARA run (CALIBRE-only)      -> Trust Score not available
No regulations to cover        -> weights renormalised to 0.40/0.70 and 0.30/0.70
Rounded half up (62.5 -> 63)
  

Deployment

The Governance Fabric is deployed on Render (FastAPI + SQLite). It calls ARA and Secure-RAG over HTTP. CALIBRE's scoring is ported natively into the Fabric for speed and to avoid a browser-only dependency. Set ARA_URL and SECURE_RAG_URL env vars to connect the sister apps.

---

v1.1 additions (September 2026)

Version 1.1 introduces four constructs that address the strongest recurring theme in early practitioner critique of v1.0: that governance approval at time T0 does not by itself confer execution authority at time Tn for a specific consequential action taken by the AI system later. These are documented in Sections 13.4 through 13.7 of the research paper.

Construct	Question it answers	Where it lives in the Fabric
Runtime Authority Envelope	May this specific AI-authorised action of consequence execute right now?	Runtime Authority page. Three simultaneous conditions: approval validity, scope match, state stability. Returns Permit / Deny / Escalate.
Runtime Evidence Contract	What is the running AI system actually doing? How has it changed since approval?	Runtime Evidence page. Seven event types (quality_evaluation, access, incident, human_override, cost, drift_signal, model_version_change) streamed from MLOps.
Decision-Level Governance	Which specific consequential actions is the AI authorised to take, by whom, under what delegation?	Decision Classes page. Decision Classes, Decision Events, Delegation Chains.
Jurisdictional Overlays	Which jurisdiction-specific obligations apply in addition to the three anchor frameworks?	Jurisdictional Overlays page. First-class extension for APRA, DORA, HIPAA, India IT Rules 2026, and others.

How the Register serves both forensic and active-control layers

The Fabric Register is not only a forensic log. Every Assessment, Finding, Runtime Event, Decision Event and Authority Check preserves what happened, when, and under what authority (Layer A: forensic evidence for after-the-fact review, audit, and regulator investigation). The same Register is also queried by the Runtime Authority Envelope at commit time to decide whether to Permit the next action (Layer B: active-control substrate). Both layers use the same schema.

Actor and overseer, structural separation

The Fabric does not act. The Envelope is deterministic. Decision Classes, Delegation Chains and Overlays are declarative. The AI system being governed is the actor; the human owner named on each Decision Class is the overseer; the Envelope is an authority check, not an autonomous decider. This is the framework's response to the concern that AI governance requires separation between the systems that act and the humans who oversee them: the separation is preserved by construction at every layer.

Cite as: Dani, C. (2026). CALIBRE: A Governance Intensity Framework for Artificial Intelligence Systems, with Architecture-Sensitive Amplification. Zenodo DOI to follow.