Resources

Field notes, references, and playbooks for governed AI.

Everything we’ve learned building governed AI for regulated organizations — long-form and practical, with examples throughout.

22 long-form articles

Blog

Field notes on governed AI — standards, security, agents, workflows, and where the work is going.

105 terms, in plain English

AI glossary

Industry nomenclature translated — models, agents, memory, governance, security, and frameworks.

How to actually use AI

Playbooks

Copy-and-adapt playbooks — the prompt, artifacts & memory, and climbing the maturity ladder, privately.

Interactive · 30 seconds

ROI calculator

Put in your numbers — team size, hours, cost — and see the time and money one governed workflow gives back.

Looking for capabilities instead? Browse the skill library →

Frameworks & compliance

The standards regulated AI is held to — explained.

ISO 42001, NIST AI RMF, OWASP, and the architecture frameworks behind a governed AI program — written to be useful, not to impress an auditor. New here? Start with the ISO 42001 compliance guide.

Guide · the practical path

ISO 42001 compliance

What the AI management system standard asks for, the path to certification, and making the evidence a by-product of running your AI.

The standard, explained

ISO 42001 explained

A plain-English tour of the AI management system standard — clauses, Annex A controls, and what certification really checks.

Two frameworks, one program

NIST AI RMF + ISO 42001

How NIST structures the risk work and ISO makes it auditable — without doing the analysis twice.

AI application security

OWASP LLM Top 10

The ten failure modes of LLM apps — prompt injection, data leakage, and the rest — and how to govern them.

Cloud pillars, applied to AI

Well-Architected AI

The Well-Architected lenses mapped onto what a governed AI system actually needs.

Diagrams people can read

The C4 model

Communicating AI architecture at four zoom levels — context, container, component, code.

Prefer definitions? The governance glossary → covers the terms in plain English.

Hosted MCP servers · proprietary

Connectors we built, host, and govern.

Proprietary MCP servers for the systems regulated teams depend on — governed access through Nunc, every call authenticated, PII-stripped, and logged. No connector to build or maintain yourself, and the list keeps growing.

Finance & accounting