Method

The AI Control Layer is the outcome.
Weftline is how it's built.

Governance-first, with the NIST AI RMF as the baseline and jurisdiction-specific requirements layered on top. The framework exists so the work is repeatable, transferable, and legible to someone who was not in the room — which is the only kind of governance record worth having.

The Weftline Framework

Five movements, with influence mapping running through all of them.

Builds on the NIST AI RMF and adds what the baseline leaves to the practitioner: IEEE 7000 ethical value elicitation, and structured bias testing.

Strategic Intent

What the organization is actually trying to accomplish with AI, stated precisely enough that a control can be tested against it.

Decision Authority

Who decides, who reviews, who can override, and who is accountable when the determination is wrong. An org chart question before a technology one.

III

Operational Integration

How the control lives inside the workflow rather than beside it. Governance that requires an extra step gets skipped by week three.

Workforce Enablement

Whether the people holding the authority know they hold it, and what to do at the moment of decision.

Technical Infrastructure

Logging, traceability, testing, and the evidence plumbing that makes the record reproducible instead of anecdotal.

AI Influence Mapping runs across all five — the technique that surfaces where AI shapes a determination and no control is present. It is what makes the difference between a governance program that covers the systems you remembered and one that covers the systems you have.

How an Engagement Runs

One dataset. Every artifact rendered from it.

Findings are structured records before they are prose — consequence × evidence confidence, named owner, effort, remediation wave. Which means the report, the workbook, the readout, and the submission set cannot disagree with one another.

Intake

A questionnaire and evidence-request list issued before work begins. Intake quality is the ceiling on deliverable quality — so it is an instrument, not a kickoff chat.

Evidence Review

What exists, what is claimed, and the distance between them. Assessed against the full published obligation set, not the headline instrument alone.

Findings Register

Every finding scored on consequence and evidence confidence, with a named owner, effort estimate, and remediation wave. The single source everything else renders from.

Deliverable Set

Report, workbook, readout, submission set — generated from the register, verified citation by citation against primary sources, and signed by the principal.

30-Day Checkpoint

A return visit after the readout, because the value of a remediation roadmap is decided in the thirty days nobody schedules.

Standards Applied

Baseline, then jurisdiction.

A framework alone does not discharge an obligation. The baseline establishes the discipline; the binding local instrument decides what the record has to contain.

NIST AI RMF — the methodology baseline across every lane.
IEEE 7000-2021 — ethical value elicitation, added where the baseline defers to the practitioner.
ISO/IEC 42001 — AI management system structure for commercial and multi-jurisdiction clients.
DC: MO 2024-028 · OCTO AI/ML Governance Policy · AI Procurement Handbook and clauses E.1–E.4 · OCTO IT Procurement and IT Project Policy.
Federal: OMB M-25-21 and M-25-22 · CMMC L2/L3 · NIST SP 800-171 · DFARS 252.204-7012.
OWASP LLM Top 10 — agentic and MCP-connected workflow risk.

Standing Commitments

The constraints we accept before you ask.

Every citation verified at ship

Each regulatory citation in a client-facing deliverable is re-checked against the primary source before delivery, and the verification is documented citation by citation. A governance finding built on a misremembered section number is worse than no finding.

Principal-signed, principal-defended

The principal reviews and signs every deliverable, and defends every finding in the room. AI is used as back-office leverage in research and drafting; judgment and accountability are not delegated.

Editable source form

Every artifact ships in a form the client can maintain. Your governance record should not depend on our availability, and it should not be hostage to a file format.

Vendor-neutral, with nothing to disclose

No referral fees, no reseller relationships, no platform partnerships. Nothing a competitor can characterize as steering, and no finding that costs us revenue to make.

The AI Control Layer is the outcome.Weftline is how it's built.