Authority Validity Check
Is the authority still valid?
Governance Architecture
Trestano Governance Architecture Model™
Most AI governance is assembled document by document, and falls apart at the seams. The Trestano Governance Architecture Model™ is the blueprint we build against — eight connected layers, from business intent to certification readiness, designed once and sized to your organisation.
Attributable Authority™
Trestano doesn’t just define governance structures. It defines who gives AI permission to act, under what authority, and within what boundaries.
Why governance needs an architecture
A policy is not a framework. The organisations that pass audits are the ones whose governance holds together as a system — not a folder of documents.
Governance without a design becomes paperwork
Policies, registers and risk assessments written one at a time drift apart. An architecture gives every document a place in a single structure — so the parts reinforce each other instead of contradicting.
Most frameworks are written for enterprises
A 500-person governance function doesn't translate to a 40-person business. The model scales the layers down honestly: fewer controls, but each one owned, recorded and defensible.
Auditors test the connections, not the documents
An ISO/IEC 42001 auditor doesn't ask if you have a policy — they ask whether it names an owner, whether risk feeds review, and whether review changes anything. Architecture is what connects them.
Growth breaks ad-hoc governance
The framework that works at five AI tools fails at twenty. A layered architecture defines how new systems, new people and new obligations attach — so governance grows with the business instead of being rebuilt.
The eight layers
Each layer rests on the one above it and feeds the one below. Together they form a single, traceable structure — from what the business wants to what an auditor can verify.
Business Intent
Governance starts with why. What the organisation is trying to achieve with AI — growth, efficiency, better service — and the boundaries it will not cross. Every later layer traces back to a business decision, which is what makes it defensible in front of a board or an auditor.
- Who owns it
- Board or senior leadership, with the named AI Owner translating intent into direction.
- Evidence it must produce
- A recorded statement of AI intent and boundaries, board or leadership minutes adopting it, and a risk-appetite statement signed at leadership level.
AI Strategy
Intent becomes direction: which AI capabilities the business will adopt, which it will build, which it will rent, and the appetite for risk in each case. Strategy also decides sequencing — what gets governed first and what waits.
- Who owns it
- The AI Owner, accountable to leadership for keeping strategy current as the business changes.
- Evidence it must produce
- A written AI strategy with adopt/build/rent decisions, sequencing priorities, and a dated review record showing it is revisited — not written once.
AI Readiness
An honest baseline. The tools actually in use, the data they touch, the skills and gaps in the team, and the obligations already applying. Readiness work is what turns a governance design from an ideal into something that fits the organisation as it is today.
- Who owns it
- The AI Owner with the AI Steward, drawing input from every team that uses AI.
- Evidence it must produce
- A system inventory and boundary map, a capability and skills assessment, and a readiness report with a dated baseline that later reviews can be measured against.
Governance Architecture
The structural layer. Policy, roles, decision rights, accountability and the evidence model — designed as one framework with named owners. This is where the question 'who is accountable for this decision?' gets a specific, recorded answer.
- Who owns it
- The AI Owner designs it; leadership ratifies it; every named role holder owns their part.
- Evidence it must produce
- The governance framework document itself — policies, role definitions, decision-rights matrix and accountability assignments, each with a named owner and adoption date.
Governance Operations
The framework in motion. Approvals before deployment, registers kept current, incidents managed and reviewed. Architecture that isn't operated is theatre — this layer is where governance becomes daily practice.
- Who owns it
- The AI Steward runs the day-to-day cycle; the AI Owner answers for its results.
- Evidence it must produce
- Operational records produced as work happens: approval logs, a current system register, incident and intervention records, and change logs for models and vendors.
Risk & Compliance
The obligations layer. Risk assessments, the Statement of Applicability, and the mapping between what the business does and the rules that reach it — UK GDPR, sector regulators, and ISO/IEC 42001. Each control here traces to a risk or a requirement.
- Who owns it
- The AI Reviewer, working with whoever holds data-protection responsibility in the business.
- Evidence it must produce
- Risk and impact assessments per system, a Statement of Applicability with justifications for included and excluded controls, and an obligations register mapping rules to systems.
Continuous Assurance
Proof over time. Monitoring, internal audit and management review check that the layers above still hold as tools, data and rules change — and preserve the evidence trail, so your position stays defensible between reviews.
- Who owns it
- The AI Reviewer leads audits and monitoring; leadership owns the management review.
- Evidence it must produce
- Monitoring reports, internal audit findings with corrective actions, management review minutes, and a preserved evidence trail covering the period between reviews.
Certification Readiness
The destination layer. Because the lower layers generate evidence as a by-product of operation, arriving at an ISO/IEC 42001 audit — or a customer or insurer review — is assembly, not archaeology.
- Who owns it
- The AI Owner coordinates; every layer owner contributes their records.
- Evidence it must produce
- An assembled audit pack: the evidence from every layer above, organised against the standard's clauses, plus a gap log showing anything still in progress.
Structure alone doesn’t tell you who gave a system permission to act. Attributable Authority™ does — and it is what the Governance at Execution™ controls test in practice.
Read about Attributable Authority™ →Attributable Authority™
Relationship to Governance at Execution™
Attributable Authority™ supports:
Execution Boundary Check
Does the requested action fall within approved limits?
Conditional Delegation Rules
Do current conditions allow execution?
Together these controls ensure authority is:
- Defined
- Validated
- Governed
- Reviewable
Attributable Authority™
Evidence Requirements
Evidence should include:
- Approval records
- Decision rights documentation
- Governance ownership matrix
- Risk assessment
- Delegated authority record
- Review history
- Authority withdrawal records
Attributable Authority™
What Good Looks Like
A mature organisation can answer the following question within minutes:
“Who authorised this AI system to perform this action, under what authority, and within what boundaries?”
If the answer cannot be produced quickly, governance is dependent on assumption rather than evidence.
The Trestano Methodology™
Position Within the Trestano Methodology™
Attributable Authority™ is not a standalone artefact. It sits between the architecture an organisation designs and the operations it runs day to day.
- 1
AI Readiness
- 2
Governance Architecture
- 3
Attributable Authority™
- 4
Governance at Execution™
- 5
Governance Operations™
- 6
Continuous Assurance
- 7
Certification Readiness
What the model is built on
Four principles run through every layer of the architecture.
Traceable decisions
Every control and document can be traced up to a business intent and down to an operational record. Nothing exists just because a template said so.
Named accountability
Every layer has an owner. Ownership is a person with a role, not a committee or a job title on a policy cover page.
Proportionate by design
The model sizes each layer to the organisation. An SME's architecture has fewer controls than an enterprise's — but each one is real, recorded and followed.
Evidence as a by-product
The architecture is arranged so that running the business produces the evidence auditors ask for. Compliance stops being a separate annual project.
Where the Governance Architecture Model™ fits
The model is the blueprint for stage two of the Trestano Methodology™. It builds on the readiness assessment, and it is the framework that Governance Operations™ then runs day to day.
Discover your AI Governance Maturity Score
The Trestano AI Governance & Readiness Diagnostic™ measures where you stand across five dimensions — and gives you a prioritised plan for what to do next.
Book a Diagnostic