consumption governance management

Enterprise-scale general-purpose agents lack built-in, reusable governance mechanisms for autonomous cross-tool operation, making it difficult to satisfy requirements for compliance, auditability, and behavioral controllability. This work proposes the CUGA policy system, which embeds runtime governance capabilities into five critical checkpoints of the agent execution pipeline—intent protection, playbook guidance, tool invocation control, human approval gating, and output formatting—through a modular “policy-as-code” architecture. Without requiring model fine-tuning, CUGA enables proactive, continuous, and structured behavior control. By integrating typed governance primitives, dynamic playbook injection, and human-in-the-loop approval, the system effectively blocks malicious requests, enforces structured tool sequences, and triggers manual review for high-risk operations in healthcare scenarios, significantly enhancing policy adherence, execution consistency, and deployment safety.

This study addresses the challenges of open-source software governance, where ambiguously defined roles and permissions often lead to unclear accountability and excessive burdens on core maintainers. For the first time, it systematically analyzes governance documents such as GOVERNANCE.md in GitHub projects, applying institutional grammar to structurally dissect roles in terms of their scope, authority, obligations, and lifecycle. The research uncovers a phenomenon termed “role drift” and identifies the “maintainer paradox”: while core contributors foster community engagement, they frequently become bottlenecks in governance. Empirical findings reveal substantial variation in responsibilities among identically named roles across projects and demonstrate that a small number of individuals often concentrate technical, managerial, and community-facing functions. These insights provide critical foundations for improving role design and enhancing the sustainability of open-source communities.

This paper addresses the challenge of clarifying and coordinating responsibilities among six key actor roles—providers, deployers, authorized representatives, importers, distributors, users, and notified bodies—under the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). Applying systematic legal text analysis, the study examines all 113 articles, 180 recitals, and 13 annexes. It proposes a dynamic role-transformation mechanism grounded in the principle that “control determines responsibility,” revealing how obligations cascade along the AI supply chain. The paper’s primary contribution is an original AI regulatory actor mapping framework that operationalizes the “responsibility follows control” principle to enable distributed, cooperative governance. This framework balances fundamental rights protection with innovation support by clarifying role-specific duties and interdependencies. It delivers actionable guidance for regulators, AI providers, deployers, and other compliance stakeholders on role identification and obligation fulfillment under the AI Act.

Ensuring dynamic regulatory compliance in cross-organizational, multi-domain data processing—particularly in healthcare—is challenging due to heterogeneous legal constraints, contractual obligations, and evolving individual consents, requiring simultaneous privacy preservation, accountability distribution, and policy adaptability. Method: We propose a decentralized policy fragmentation framework enabling autonomous agents to generate, propagate, and dynamically compose local policy fragments to justify data operations—without requiring a global policy view. We introduce the first logic-programming–based justifiable action model, integrated with a distributed gossip protocol and externally synchronized configuration. Contribution/Results: The framework achieves reproducible authorization, auditable accountability, and verifiable governance under weak centralization. Evaluated in the Brane healthcare system, it demonstrates robust compliance assurance, seamless cross-domain interoperability, and audit traceability with full reproducibility.

Existing AI governance research predominantly addresses macro-level regulatory principles, leaving a critical gap in enterprise-level implementation frameworks. This paper proposes a three-layer conceptual framework for organizational AI governance—spanning data, models, and systems—structured around the triad of “actor–artifact–mechanism.” It introduces two novel elements: (1) a data-value quantification methodology and (2) formally defined, role-specific AI governance positions. Leveraging literature-driven modeling, multi-dimensional structural decomposition, and cross-layer alignment techniques, the framework is designed for seamless integration into existing corporate governance infrastructures. The resulting implementation pathway bridges the translational gap between high-level regulatory guidance and operational AI governance practice. By unifying theoretical rigor with practical feasibility, this work establishes a new paradigm for institutionalized AI governance, directly addressing the longstanding challenge of converting abstract governance principles into actionable, organizationally embedded practices. (149 words)

This study addresses the inefficiencies in SaaS onboarding within regulated enterprises, where siloed security and compliance controls—spanning third-party risk management, cybersecurity, identity and access management, and disaster recovery—often result in process delays, redundant assessments, and ambiguous accountability. To overcome these challenges, this work proposes an end-to-end, control-driven SaaS onboarding framework that integrates multi-domain controls into a unified lifecycle model encompassing requirement intake, architectural validation, identity design, resilience assessment, and post-deployment governance. By leveraging cross-domain control mapping, phased process modeling, and governance checklists, the framework codifies key design patterns such as secure connectivity, federated identity, least-privilege access, and shared-responsibility disaster recovery. Empirical implementation demonstrates that the approach significantly reduces onboarding friction, enhances audit traceability, and strengthens both the security posture and operational resilience of SaaS platforms.

This work addresses the inadequacy of existing large language model (LLM) lifecycle frameworks, which predominantly emphasize operational efficiency while lacking explicit support for security-critical activities—such as data provenance, component signing, and access control—and failing to align governance requirements with specific lifecycle phases. The paper proposes the first security-oriented LLM system lifecycle model, structured not by workflow but by security boundaries, organizing 32 phases into four layered pipelines: data, model, distribution, and application, while integrating LLMOps and governance pillars. It uniquely identifies 13 distinct security-critical phases and exposes a structural imbalance wherein regulatory evidence is concentrated at deployment despite pivotal decisions occurring during development. By mapping key standards—including NIST AI RMF, the EU AI Act, and ISO/IEC 42001—the study establishes a phase-to-governance correspondence mechanism, yielding a comprehensive, lifecycle-spanning security analysis framework that offers structured guidance for compliance and secure design.

This study addresses the challenges of collaboration and quality control in open-source deep learning projects stemming from inadequate governance mechanisms. Drawing on the Institutional Analysis and Development (IAD) framework, it employs a mixed-methods empirical approach combining document content analysis and code commit tracking across PyTorch, TensorFlow, and PaddlePaddle. The analysis encompasses 109 governance documents and over 1,700 code commits, systematically uncovering the structure, temporal evolution, and functional dimensions of governance rules. The research identifies 17 rule themes and 7 rule types, revealing a distinct evolutionary pattern wherein operational rules emerge early and undergo frequent revisions, while structural rules appear later and evolve more steadily. Four core governance functions are distilled, culminating in 33 actionable recommendations for effective open-source AI project governance.

This study addresses the ineffectiveness of platform governance assessments caused by overlooking participants’ adaptive responses. We propose a theoretical framework conceptualizing governance as an intervention within an adaptive system. By developing a multi-agent best-response model and a full-platform simulator, we validated a dynamic evaluation framework across 72 case studies. Experimental results demonstrate that the simulator achieves an adaptation quality score of 0.836 and attains a 100% win rate against all baselines, significantly outperforming traditional static methods. This research overcomes the limitations of static assessment paradigms, offering novel theoretical insights into complex governance interactions and providing a high-precision quantitative tool for evaluating dynamic platform ecosystems.

本文提出Brain API，一种意图感知控制平面，通过决策工件解决现有系统中缺乏意图级决策治理的问题。