# bridgecoreai/ai-grc-engineering architecture

> Architecture diagram of the GitHub repository bridgecoreai/ai-grc-engineering, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-19). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/bridgecoreai/ai-grc-engineering
- Repository: https://github.com/bridgecoreai/ai-grc-engineering

## Overview

1. **Repository purpose**
   - This is not an application runtime; it is an **AI GRC engineering portfolio** built around documentation, reusable templates, and a few Python automation scripts.
   - The architecture centers on turning governance frameworks into **operational controls, workflows, and audit evidence**.

2. **Primary content hierarchy**
   - The repo is organized by **framework** under `frameworks/`.
   - `frameworks/nist-ai-rmf/` is the most developed track and serves as the main reference implementation for the portfolio.
   - `frameworks/iso-42001/` is structured similarly, but appears to be a parallel learning/content stream rather than the main operational focus yet.

3. **NIST AI RMF as the core domain model**
   - `frameworks/nist-ai-rmf/modules/` contains the learning and design backbone: overview, the four functions, key concepts, risk assessment, governance controls, audit readiness, GRC engineering, templates, and capstone material.
   - `frameworks/nist-ai-rmf/references/` holds compact lookup artifacts for recurring concepts such as lifecycle stages, risk types, human oversight levels, and trustworthy AI properties.
   - This folder is effectively the **framework knowledge layer** that everything else maps back to.

4. **ISO 42001 track as a parallel framework**
   - `frameworks/iso-42001/modules/` mirrors the same “module” pattern but is oriented around ISO 42001 topics like clauses, annex controls, audit cycles, risk treatment, performance evaluation, and continual improvement.
   - Its structure suggests a future **cross-framework mapping** role: NIST concepts on one side, ISO clause/control concepts on the other.

5. **Operational templates as reusable control artifacts**
   - The top-level `templates/` folder is the repository’s **process layer**.
   - `templates/intake/ai-intake-workflow.md` indicates a front-door workflow for evaluating AI use cases before they enter governance/risk processes.
   - The README also references a risk assessment template and control library, indicating the repo is designed to standardize intake, assessment, and control definition.

6. **Automation scripts as the engineering layer**
   - `scripts/` contains the repo’s main automation boundary, currently centered on Python.
   - File names imply a small pipeline of GRC automation tasks: generating a risk register, rating risk, classifying risk tier, checking evidence freshness, and packaging evidence for audit use.
   - This is the point where documents become **computed outputs** rather than static reference material.

7. **Likely data flow across the repo**
   - The implied flow is: **framework content → intake workflow → risk assessment/rating → risk register/evidence artifacts → audit-ready package**.
   - In other words, the docs define the policy and control logic, templates capture operational inputs, and scripts turn those inputs into maintained records and evidence bundles.

8. **Evidence and audit boundary**
   - The repository emphasizes **version-controlled evidence** as a first-class output.
   - `scripts/check_evidence_staleness.py` and `scripts/package_evidence.py` suggest a maintenance boundary where evidence is validated for freshness and assembled for review or audit.
   - This aligns with the repo’s stated philosophy: policy must be enforced at execution, not just documented.

9. **Cross-framework and applied knowledge layers**
   - The README references future `control-mappings/`, `case-studies/`, and `dashboards/` areas.
   - Architecturally, these represent three important extensions: crosswalks between frameworks, industry-specific applications, and reporting/metrics surfaces.
   - They are not the core system today, but they show the intended end-state of a broader GRC operating model.

10. **Tooling and runtime implications**
   - The current repo is Markdown-first, with Python for automation and GitHub workflows planned for CI.
   - Streamlit is mentioned as the future dashboard layer, which would likely consume structured outputs from the scripts and templates.
   - Because most artifacts are human-readable files, the repository behaves more like a **governance knowledge base with executable support tooling** than a conventional software product.

11. **How to diagram the architecture**
   - A useful diagram would show four layers: **framework knowledge**, **operational templates**, **automation scripts**, and **evidence/reporting outputs**.
   - The central domain is AI governance/risk/compliance, with NIST AI RMF currently the dominant source of truth and ISO 42001 positioned as a second framework track.
   - The key boundary is between **static guidance** and **operationalized governance**: the repo’s value comes from moving content across that boundary into workflows and evidence.

Main entry points: [`README.md`](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/README.md) (AI GRC Repo), [`frameworks/nist-ai-rmf/README.md`](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/frameworks/nist-ai-rmf/README.md) (NIST RMF), [`templates/intake/ai-intake-workflow.md`](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/templates/intake/ai-intake-workflow.md) (Intake workflow), [`scripts/risk_rating.py`](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/scripts/risk_rating.py) (Risk rating)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_group_frameworks["Framework knowledge"]
  node_nist_track["NIST RMF<br/>framework track<br/>[README.md]"]
  node_nist_modules["NIST modules<br/>module set"]
  node_nist_refs["NIST refs<br/>reference layer"]
  node_iso_track["ISO 42001<br/>framework track"]
  node_iso_modules["ISO modules<br/>module set"]
  node_future_mappings["Crosswalks<br/>future mapping layer"]
end

subgraph group_group_process["Operational templates"]
  node_intake_workflow["Intake workflow<br/>process template"]
  node_risk_assessment_template["Risk assessment<br/>process template"]
  node_control_library["Control library<br/>process template"]
end

subgraph group_group_automation["Automation scripts"]
  node_generate_register["Register generator<br/>automation script"]
  node_risk_rating["Risk rating<br/>automation script<br/>[risk_rating.py]"]
  node_tier_classifier["Tier classifier<br/>automation script"]
  node_evidence_freshness["Evidence check<br/>automation script"]
  node_package_evidence["Evidence packager<br/>automation script"]
end

subgraph group_group_outputs["Outputs"]
  node_risk_register_out[("Risk register<br/>maintained record")]
  node_evidence_bundle_out["Evidence bundle<br/>audit artifact"]
  node_future_cases["Case studies<br/>future application layer"]
  node_future_dashboards["Dashboards<br/>future reporting layer"]
end

node_repo_overview["AI GRC Repo<br/>portfolio repo<br/>[README.md]"]

node_repo_overview -->|"centers on"| node_nist_track
node_repo_overview -->|"also includes"| node_iso_track
node_repo_overview -->|"operationalizes via"| node_intake_workflow
node_repo_overview -->|"automates with"| node_generate_register
node_nist_track -->|"expands into"| node_nist_modules
node_nist_track -->|"anchors"| node_nist_refs
node_iso_track -->|"expands into"| node_iso_modules
node_nist_modules -->|"informs"| node_intake_workflow
node_nist_modules -->|"shapes"| node_risk_assessment_template
node_nist_refs -->|"supports classification"| node_tier_classifier
node_intake_workflow -->|"feeds"| node_generate_register
node_risk_assessment_template -->|"drives"| node_risk_rating
node_control_library -->|"constrains"| node_risk_rating
node_generate_register -->|"passes to"| node_risk_rating
node_risk_rating -->|"refines"| node_tier_classifier
node_tier_classifier -->|"writes"| node_risk_register_out
node_evidence_freshness -->|"validates"| node_evidence_bundle_out
node_package_evidence -->|"assembles"| node_evidence_bundle_out
node_risk_register_out -->|"supports"| node_evidence_bundle_out
node_future_mappings -->|"crosswalks"| node_nist_track
node_future_mappings -->|"crosswalks"| node_iso_track
node_future_cases -->|"applies"| node_intake_workflow
node_future_dashboards -->|"reports on"| node_risk_register_out
node_future_dashboards -->|"reports on"| node_evidence_bundle_out

click node_repo_overview "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/README.md"
click node_nist_track "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/frameworks/nist-ai-rmf/README.md"
click node_nist_modules "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/frameworks/nist-ai-rmf/modules/module-01-overview.md"
click node_nist_refs "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/frameworks/nist-ai-rmf/references/ai-lifecycle-stages.md"
click node_iso_track "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/frameworks/iso-42001/modules/module-01-overview.md"
click node_iso_modules "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/frameworks/iso-42001/modules/module-02-seven-clauses.md"
click node_intake_workflow "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/templates/intake/ai-intake-workflow.md"
click node_generate_register "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/scripts/generate_risk_register.py"
click node_risk_rating "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/scripts/risk_rating.py"
click node_tier_classifier "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/scripts/risk_tier_classifier.py"
click node_evidence_freshness "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/scripts/check_evidence_staleness.py"
click node_package_evidence "https://github.com/bridgecoreai/ai-grc-engineering/blob/main/scripts/package_evidence.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_nist_track,node_nist_modules,node_nist_refs,node_iso_track,node_iso_modules,node_future_mappings toneBlue
class node_intake_workflow,node_risk_assessment_template,node_control_library toneAmber
class node_generate_register,node_risk_rating,node_tier_classifier,node_evidence_freshness,node_package_evidence toneMint
class node_risk_register_out,node_evidence_bundle_out,node_future_cases,node_future_dashboards toneRose
class node_repo_overview toneNeutral
```

## Components

### Framework knowledge

Source-of-truth guidance, concepts, and reference material for AI governance frameworks.

- [NIST RMF](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/frameworks/nist-ai-rmf/README.md): framework track · Primary framework track and main reference implementation for the portfolio. · `frameworks/nist-ai-rmf/README.md`
- [NIST modules](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/frameworks/nist-ai-rmf/modules/module-01-overview.md): module set · Learning and design backbone covering functions, concepts, assessment, controls, audit readiness, and templates. · `frameworks/nist-ai-rmf/modules/module-01-overview.md`
- [NIST refs](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/frameworks/nist-ai-rmf/references/ai-lifecycle-stages.md): reference layer · Compact lookup artifacts for lifecycle stages, risk types, oversight levels, and trustworthy AI properties. · `frameworks/nist-ai-rmf/references/ai-lifecycle-stages.md`
- [ISO 42001](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/frameworks/iso-42001/modules/module-01-overview.md): framework track · Parallel ISO 42001 content stream with a similar module structure and future mapping role. · `frameworks/iso-42001/modules/module-01-overview.md`
- [ISO modules](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/frameworks/iso-42001/modules/module-02-seven-clauses.md): module set · ISO 42001 topics spanning clauses, annex controls, audits, risk treatment, evaluation, and improvement. · `frameworks/iso-42001/modules/module-02-seven-clauses.md`
- **Crosswalks**: future mapping layer · Planned framework and control mapping layer across standards.

### Operational templates

Reusable intake and assessment artifacts that operationalize governance work.

- [Intake workflow](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/templates/intake/ai-intake-workflow.md): process template · Front-door workflow for evaluating AI use cases before governance and risk processing. · `templates/intake/ai-intake-workflow.md`
- **Risk assessment**: process template · Reusable assessment structure referenced by the repository for governance evaluation.
- **Control library**: process template · Reusable control definitions that standardize governance expectations and evidence needs.

### Automation scripts

Python utilities that compute and maintain governance records and evidence.

- [Register generator](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/scripts/generate_risk_register.py): automation script · Builds structured risk register outputs from governance inputs. · `scripts/generate_risk_register.py`
- [Risk rating](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/scripts/risk_rating.py): automation script · Assigns risk ratings from assessment inputs and control context. · `scripts/risk_rating.py`
- [Tier classifier](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/scripts/risk_tier_classifier.py): automation script · Classifies assessed risk into tiers for governance handling and escalation. · `scripts/risk_tier_classifier.py`
- [Evidence check](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/scripts/check_evidence_staleness.py): automation script · Checks whether evidence is current and ready for review. · `scripts/check_evidence_staleness.py`
- [Evidence packager](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/scripts/package_evidence.py): automation script · Assembles evidence artifacts into an audit-ready package. · `scripts/package_evidence.py`

### Outputs

Maintained records, packaged artifacts, and future reporting surfaces.

- **Risk register**: maintained record · Computed record of assessed risks, ratings, tiers, and governance actions.
- **Evidence bundle**: audit artifact · Version-controlled package of supporting evidence for review or audit.
- **Case studies**: future application layer · Planned applied knowledge layer for industry-specific examples and implementations.
- **Dashboards**: future reporting layer · Planned reporting and metrics surface for structured outputs.

### Other components

- [AI GRC Repo](https://github.com/bridgecoreai/ai-grc-engineering/blob/main/README.md): portfolio repo · Documentation-first repository for operationalizing AI governance, risk, and compliance. · `README.md`

## Connections

- AI GRC Repo → NIST RMF: centers on · The repository’s primary reference track is NIST AI RMF.
- AI GRC Repo → ISO 42001: also includes · A parallel ISO 42001 track broadens the framework coverage.
- AI GRC Repo → Intake workflow: operationalizes via · Templates translate guidance into repeatable intake and assessment steps.
- AI GRC Repo → Register generator: automates with · Scripts convert documentation and inputs into maintained records.
- NIST RMF → NIST modules: expands into · The NIST track is developed through its module sequence.
- NIST RMF → NIST refs: anchors · Reference artifacts provide compact concept lookups for the track.
- ISO 42001 → ISO modules: expands into · The ISO track is organized through mirrored module content.
- NIST modules → Intake workflow: informs · Framework concepts feed the intake and assessment workflow.
- NIST modules → Risk assessment: shapes · The NIST domain model informs the assessment template structure.
- NIST refs → Tier classifier: supports classification · Reference definitions help normalize tiers and oversight levels.
- Intake workflow → Register generator: feeds · Intake outputs become inputs to the register pipeline.
- Risk assessment → Risk rating: drives · Assessment inputs are scored through the rating logic.
- Control library → Risk rating: constrains · Control definitions provide context for rating and mitigation decisions.
- Register generator → Risk rating: passes to · Register generation is paired with scoring logic.
- Risk rating → Tier classifier: refines · Ratings are further grouped into governance tiers.
- Tier classifier → Risk register: writes · The classifier contributes to the maintained register.
- Evidence check → Evidence bundle: validates · Freshness checks gate evidence included in audit packages.
- Evidence packager → Evidence bundle: assembles · Evidence artifacts are packaged for review and audit.
- Risk register → Evidence bundle: supports · The maintained register is part of the audit evidence set.
- Crosswalks → NIST RMF: crosswalks · Future mapping layer ties NIST concepts to other frameworks.
- Crosswalks → ISO 42001: crosswalks · Future mapping layer ties ISO concepts to other frameworks.
- Case studies → Intake workflow: applies · Case studies would demonstrate workflow use in context.
- Dashboards → Risk register: reports on · Dashboards would visualize structured governance outputs.
- Dashboards → Evidence bundle: reports on · Dashboards would surface evidence status and readiness.