Mar 2026· arXiv.org· Vol abs/2603.03394· 0 citations· 19 references
Computer Science
TL;DR
This work designs and operationalizes a governance-aware, multi-tenant AI sandbox that supports structured experimentation and produces reusable evaluation evidence across stakeholders and yields lessons learned and practical considerations that inform deployment and future evolution of governance-aware sandbox platforms.
Abstract
Collaborative AI experimentation in industry-academia requires environments that support rapid trials while maintaining controlled access, organisational isolation, and traceable workflows. Although interest in AI sandboxes is increasing, practical guidance on designing and building governance-aware experimentation platforms remains limited. This work designs and operationalizes a governance-aware, multi-tenant AI sandbox that supports structured experimentation and produces reusable evaluation evidence across stakeholders. The sandbox was developed in an industry-academia ecosystem using iteratively validated requirements gathered from industrial partners. The solution adopts a layered reference architecture that separates a multi-tenant presentation layer from a backend control plane and isolates execution and data management concerns into dedicated layers. The sandbox supports governed onboarding, project-based collaboration, controlled access to AI services, and traceable experimentation through approval workflows and audit logging. By structuring experiment context and governance decisions as persistent records, the sandbox enables evaluation evidence to be reused and compared across projects and stakeholders. The development experience yields lessons learned and practical considerations that inform deployment and future evolution of governance-aware sandbox platforms.
This work presents the design and implementation of a governance-aware, multi-tenant AI sandbox for structured experimentation and the generation of reusable evaluation evidence across projects and stakeholder groups.
Muhammad Waseem, M. Islam, Md Nasir Uddin Shuvo et al.· 0 citations
Enterprises are increasingly building agentic AI systems out of reusable skills — modular units that bundle prompts, reasoning strategies, tool integrations, and execution policies, and that get reused across many AI use cases. This pattern speeds up delivery, but it creates a risk that current AI governance frameworks were not designed for. A single privileged skill, reused across dozens of workflows, can quietly accumulate excess privilege, expand the operational blast radius of every workflow it touches, and drift from its original policy boundary. The NIST AI Risk Management Framework, ISO/IEC 42001, MITRE ATLAS, and OWASP's guidance for LLM and agentic applications all treat AI systems as a single object. None of them gives an organization a way to govern reusable skills as the cross-cutting assets they have become.
This paper argues that reusable agent skills should be treated as first-class governed enterprise assets, and that the enterprise agent harness — not the skill, the model, or the use case — must serve as the runtime trust boundary at which a skill's authority is granted. The paper proposes a runtime governance framework built on three constructs. Skill Risk Inheritance is a design-time model for reasoning about how risk flows through the composition of skills, tools, and use cases. Dynamic Capability Projection (DCP) is the runtime mechanism by which the harness grants, on each invocation, only the subset of a skill's declared capabilities authorized for the current use case and principal. Risk-Adaptive Capability Projection (RACP) extends DCP across time: the granted subset widens or narrows as runtime risk signals change. The framework is grounded in the object-capability tradition, modern policy engines such as OPA and Cedar, and Zero Trust architecture. It is validated through a prototype implementation on Open Policy Agent and a graph-based simulation, which together show that DCP reduces the runtime capability surface to 41% of declared scope withholding 59% of potential capabilities per invocation–at a median policy-evaluation overhead of 8.9ms, negligible against LLM inference latency. Critically, inheritance analysis revealed that 93% of simulated use cases operated at higher effective risk than their declared classification, a finding with immediate implications for enterprise AI risk programs.
Sandeep Kumar Anuguthala· International Journal for Sc...· 0 citations
A practical framework for organizations introducing API performance testing from scratch and a knowledge management framing that treats performance testing outputs as reusable organizational assets are contributed.
Inga Zilinskiene· European Conference on Knowl...· 0 citations
Enterprise IT organizations increasingly face challenges in delivering scalable, efficient, and
governed digital services across complex environments. ServiceNow, as a leading cloud-based IT
Service Management (ITSM) platform, offers extensive capabilities for automating workflows,
consolidating enterprise processes, and enabling data-driven decision-making. This study
proposes a conceptual and applied framework for the design, governance, and scalable delivery
of ServiceNow programs across organizations. The framework integrates strategic program
planning, modular architecture design, and best-practice governance structures to ensure
alignment with organizational objectives, regulatory compliance, and operational efficiency. Key
elements include the standardization of process workflows, role-based access controls, and
continuous performance monitoring to support iterative improvement and value realization.
Applied methodologies focus on phased program deployment, stakeholder engagement, and
change management strategies that mitigate operational risks and enhance adoption. The
framework further emphasizes scalability through reusable configuration patterns, integration
with enterprise systems, and automated orchestration of cross-functional processes. Case-based
scenarios illustrate how the framework addresses common challenges such as service delivery
bottlenecks, inconsistent process adoption, and governance gaps, while enabling measurable
performance improvements. This research contributes to both theory and practice by providing a
structured approach to ServiceNow program management, demonstrating how conceptual design
principles can be translated into practical, enterprise-scale implementations. Ultimately, the
proposed framework supports organizations in achieving resilient, adaptive, and high-performing
IT service operations, fostering sustainable growth and digital transformation. Future studies may
explore the integration of artificial intelligence, predictive analytics, and real-time operational
dashboards within the framework to further optimize service delivery and strategic decisionmaking.
Joseph Edivri· INTERNATIONAL JOURNAL OF SOC...· 0 citations
Enterprise AI adoption has reached a structural inflection point: while a majority of organizations have deployed generative AI, few have established mature governance models for autonomous agents. This disparity reflects a fundamental architectural gap: Multi-Agent Systems, Enterprise Architecture, AI agent deployment, and software architecture have approached agent coordination from separate disciplinary perspectives, with no single framework integrating persistent memory, semantic interoperability, orchestration, human oversight, and normative enforcement. Following Design Science Research, this article develops the Agentic Enterprise Capability Framework (AECF), a five-layer architecture structured around Context Persistence (CPL), Semantic Interoperability (SIL), Hybrid Orchestration (HOL), Human Governance Interface (HGI), and Governance Envelope (GEL). The framework introduces the co-evolution constraint: technical capability layers cannot mature independently of governance capacity. This constraint is operationalized through Context-Enriched Pre-Execution Validation (CEPEV), which grounds compliance checks in operational memory. Five architectural propositions formalize inter-layer dependencies (P1), scalability boundaries (P2), governance effectiveness (P3), performance accumulation (P4), and a governance scaling law (P5). The study contributes an integrated architectural model, propositional formalization, and validation agenda for governed enterprise AI agent deployments.
Khammal Adil, Hamzane Ibrahim, Marzak Abdelaziz et al.· International Journal of Adv...· 0 citations
Modern enterprise applications rely on extensive third-party code, automated build systems, cloud-native infrastructure and rapidly changing vulnerability intelligence. Security controls are then spread out across the development, the software supply-chain assurance and production operations making it hard to relate some process deficiency with the subsequent impact seen in operations. This paper proposes an AI-driven DevSecOps approach focusing on governance with connections between Secure Software Development, Software Provenance, Runtime Observability, AI for analysis, Deterministic Policy Enforcement, and Responsible Human Decision Making. The framework is developed in a design-science methodology, and structured as the following layers: mission and regulatory context; AI-augmented DevSecOps pipeline; cloud-native runtime; unified observability and threat intelligence; AI intelligence and decision support; and policy governance with human oversight. It has a core principle that AI can correlate evidence, assess risk, and inform action but cannot override the requirements of policy, or authorize high impact operational decisions. A healthcare software-supply-chain scenario is the basis for an example of - a controlled rollback enabled by software bills of materials, provenance records, runtime telemetry, vulnerability intelligence, AI reasoning, policy checks, and human approval. It provides an end-to-end conceptual architecture, a decision model driven by policy, and a standards-based foundation for implementation. Since the evaluation is scenario based, the framework should be viewed as a design artifact and it is necessary to prototype and empirically validate it across multiple sectors.
Mir Fawad, Mir Jawad Yaqoob, Khawar Muhammad Saad· American Journal of Engineer...· 0 citations
Related blog posts
MIT News · Artificial Intelligence· news.mit.eduSep 9, 2026
A weeklong summer workshop brought higher education faculty to campus to explore how AI and machine learning materials can be adapted for their classrooms.
MIT News · Artificial Intelligence· news.mit.eduAug 3, 2026
What does it take to trust AI-driven HVAC optimization? Our AI Model Factory combines agents, machine learning, reinforcement learning and deterministic checks in a governed workflow designed for messy, real-world building data. The post We built an AI factory for HVAC control appeared first on GPT-Lab.
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
