design credential governance

Current AI systems rely heavily on manual auditing and documentation, which hinders scalable governance for automated services. This work proposes Ontological Knowledge Blocks (OKBs), a novel framework that formalizes regulatory obligations as quintuples comprising ontologies, SHACL rules, evidence requirements, and provenance links. By leveraging RDF/OWL modeling, PROV-O for provenance tracking, and an intermediate representation–driven deterministic compiler, the approach enables dynamic switching of governance configurations without modifying service code. Evaluation in an AI-assisted HPC scheduling scenario demonstrates that compliance checks are configuration-sensitive, violations accumulate strictly additively, SHACL validation incurs only 12.6–100.3 milliseconds of latency, and the Combined configuration provides the most comprehensive coverage.

This work addresses the inadequacy of existing large language model (LLM) lifecycle frameworks, which predominantly emphasize operational efficiency while lacking explicit support for security-critical activities—such as data provenance, component signing, and access control—and failing to align governance requirements with specific lifecycle phases. The paper proposes the first security-oriented LLM system lifecycle model, structured not by workflow but by security boundaries, organizing 32 phases into four layered pipelines: data, model, distribution, and application, while integrating LLMOps and governance pillars. It uniquely identifies 13 distinct security-critical phases and exposes a structural imbalance wherein regulatory evidence is concentrated at deployment despite pivotal decisions occurring during development. By mapping key standards—including NIST AI RMF, the EU AI Act, and ISO/IEC 42001—the study establishes a phase-to-governance correspondence mechanism, yielding a comprehensive, lifecycle-spanning security analysis framework that offers structured guidance for compliance and secure design.

This study addresses the challenges of open-source software governance, where ambiguously defined roles and permissions often lead to unclear accountability and excessive burdens on core maintainers. For the first time, it systematically analyzes governance documents such as GOVERNANCE.md in GitHub projects, applying institutional grammar to structurally dissect roles in terms of their scope, authority, obligations, and lifecycle. The research uncovers a phenomenon termed “role drift” and identifies the “maintainer paradox”: while core contributors foster community engagement, they frequently become bottlenecks in governance. Empirical findings reveal substantial variation in responsibilities among identically named roles across projects and demonstrate that a small number of individuals often concentrate technical, managerial, and community-facing functions. These insights provide critical foundations for improving role design and enhancing the sustainability of open-source communities.

To address static permission bloat, coarse-grained auditing, and inadequate support for zero-trust principles in CI/CD pipelines, this paper proposes a dynamic credential proxy architecture grounded in runtime-verifiable identities (SPIFFE/SVID). The architecture decouples identity from access permissions and enables instantaneous, short-lived (second-scale) cross-trust-domain credential issuance via OAuth 2.0 Token Exchange. It integrates a gRPC-based proxy with unified RBAC/ABAC policy enforcement, enabling fine-grained, policy-driven authorization. This work introduces the first pipeline-centric dynamic credential proxy design paradigm, bridging a critical engineering gap in applying zero-trust identity models to continuous delivery. Evaluation in production demonstrates sub-500 ms policy enforcement latency, substantial reduction in long-lived credential exposure risk, and significant improvements in audit real-time performance and traceability.

This study addresses the pervasive lack of structural integrity in current AI governance documents, which often fail to meet critical requirements such as traceability, dynamic re-verification, and objective evidence. To bridge this gap, the work systematically adapts structural governance principles from aviation software certification standards (DO-178C/DO-330) and proposes a novel integrity framework tailored for static AI governance artifacts. The framework introduces three key concepts—“epoch constraints,” “proof surfaces,” and “structural gaps”—and establishes the seven-principle PromptQ system. Structural analysis of mainstream governance documents reveals that 37% fall below a basic quality threshold, thereby demonstrating the framework’s effectiveness and practicality in enhancing the rigor and verifiability of AI governance documentation.

Existing agent interoperability protocols primarily focus on task coordination and lack support for governance-constrained collective decision-making in multi-agent communities. Drawing on organizational theory and corporate governance standards, this work proposes a six-dimensional governance framework encompassing membership management, deliberation, voting, dissent reservation, human escalation, and audit replay. The study systematically evaluates five prominent protocols—MCP, A2A, ACP, and others—and reveals, for the first time, that the core deficiency lies not in insufficient protocol-level features but in the absence of a dedicated architectural layer for governance. It further distinguishes between scalability gaps and structural gaps. The analysis demonstrates that current protocols universally lack voting and dissent reservation mechanisms, provide only partial support for deliberation, and offer no complete set of governance primitives.

This study addresses the challenges of collaboration and quality control in open-source deep learning projects stemming from inadequate governance mechanisms. Drawing on the Institutional Analysis and Development (IAD) framework, it employs a mixed-methods empirical approach combining document content analysis and code commit tracking across PyTorch, TensorFlow, and PaddlePaddle. The analysis encompasses 109 governance documents and over 1,700 code commits, systematically uncovering the structure, temporal evolution, and functional dimensions of governance rules. The research identifies 17 rule themes and 7 rule types, revealing a distinct evolutionary pattern wherein operational rules emerge early and undergo frequent revisions, while structural rules appear later and evolve more steadily. Four core governance functions are distilled, culminating in 33 actionable recommendations for effective open-source AI project governance.

This work addresses the challenge of governing high-risk actions in heterogeneous multi-agent systems, where runtime disparities hinder consistent enforcement—particularly concerning authorization rationale, approval semantics, and execution evidence. To overcome this, the paper proposes a runtime-agnostic governance model centered on action certificates that supplant vendor-specific logs. The model structures control logic across five critical checkpoints and integrates portable action envelopes, runtime and approval receipts, and replayable proofs. Innovatively, it introduces externality-aware action certificates that embed boundary facts and replace binary approval states with explicit executability categories, enabling unified cross-runtime governance. Evaluation on a benchmark of 96 trajectories spanning four distinct runtimes demonstrates that the approach preserves path quality while revealing distinct failure modes under ablation, effectively supporting runtime-portable governance policies.