Ten domains.
One operating model.

Current public claims need an accountable owner and an evidence expiry date.

Track AI purpose, data boundaries, owners and change-triggered reviews.

Separate intake assertions, public information and verified evidence.

Connect narrowly scoped technical tests to control objectives.

Inspect modeled exposure and treatment ownership without a slide deck.

Distinguish provider duties, deployer duties and legal applicability.

Test data-egress decisions without retaining the submitted prompt.

Evidence must be current before an answer becomes a customer claim.

Treat contract assertions and signed evidence as different records.

Show unknown and stale states instead of assuming that missing evidence passes.

Ten domains.One operating model.