ISO/IEC 42001:2023
AI Management System
The first international standard for managing AI risk across the system lifecycle.
Certifiable. Increasingly required in procurement for enterprise AI.
How Synchronicity maps: Action descriptors and actor metadata to §8.2 (AI
system inventory). Append-only log to §8.5 (monitoring and measurement). Policy version
resolution to §6.1.2 (risk assessment). Fail-closed semantics to §6.1.3 (risk treatment).
Change management on the model layer to §8.4.
NIST AI RMF 1.0
AI Risk Management Framework
The U.S. federal reference for AI risk management. Four functions: Govern, Map, Measure,
Manage. Cited in federal procurement and increasingly in enterprise AI policy.
How Synchronicity maps: Policy authoring supports Govern. Structured action
descriptor ontology supports Map. Append-only artifact log supports Measure. HOLD and
termination authority support Manage. Synchronicity covers the technical control dimensions;
organizational governance and stakeholder engagement remain the deploying organization's
responsibility.
EU AI Act
Regulation 2024/1689
The EU's high-risk AI regulation. Articles 9 through 15 spell out the technical obligations
for high-risk systems — risk management, data governance, logging, transparency, human
oversight, accuracy and robustness.
How Synchronicity maps: Designed to support compliance with Arts. 9, 10, 11,
12, 13, 14, and 15. Confidentiality of regulator-held information is preserved via Art. 78 +
Recital 71 (trade-secret protection). Art. 40 presumption-of-conformity path stays open.
Notified-body conformity assessment remains the deployer's responsibility.
OWASP AISVS
AI Security Verification Standard
The community standard for verifying the security of AI applications. Fourteen chapters
covering data, models, agents, infrastructure, and oversight. Synchronicity contributes
evidence to twelve of them.
How Synchronicity maps:
- C2 User input validation — SPADs (Structured Proposed Action Descriptors) carry input lineage; untrusted inputs denied at the authority.
- C3 Model lifecycle & change control — policy versioning and signed snapshots provide change-control evidence for model behavior.
- C4 Infrastructure & deployment security — the authority is the deployed control plane; default-deny on failure.
- C5 Access control & identity — actor-to-capability binding, scope enforcement, privilege-escalation prevention (C5.6, C5.6.5, C5.6.6).
- C6 Supply chain — policy rules can require attested model and data provenance; untrusted versions are rejected.
- C7 Model behavior & output control — every model-proposed action is gated by policy before execution.
- C9 Autonomous orchestration & agentic action — the core domain. Tool eligibility, action chains, agentic boundaries.
- C10 MCP security — MCP tool invocations are governed actions; tool identity verified per call.
- C11 Adversarial robustness — prompt injection contained at the action layer (C9.7.7); model attacks can't unilaterally execute.
- C12 Privacy & personal data — policy rules enforce data-class restrictions; signed log of every data-touching action.
- C13 Monitoring, logging & anomaly detection — the signed append-only decision log is the substrate.
- C14 Human oversight & trust — HOLD outcomes route to human approval; replay reconstructs any historical decision.
Out of direct scope: C1 (training data governance) and C8 (memory and vector-database
internals). Both feed the architecture but aren't enforced by it.
The founder is an active contributor to AISVS controls
C9.7.7, C5.6.5, and
C5.6.6.
NIST SP 800-207
Zero Trust Architecture
The federal Zero Trust reference. Authoritative policy decision and policy enforcement as
separate components. No implicit trust based on network location.
How Synchronicity maps: §2.1 Tenets 1-3 (resource access subject to dynamic
policy) and Tenet 6 (all access authenticated and authorized) are realized at the action
layer. §3.3 identity binding and §3.4.1 resource access. The governance authority is the PDP
for autonomous agent actions.
NIST AI Agent Security RFI
2026-00206 — Pre-Action Authorization
NIST is currently scoping Pre-Action Authorization (PAA) as an emerging control category for
agentic AI. Synchronicity is built around PAA from the architecture up.
How Synchronicity maps: Direct architectural reference for what PAA looks
like in practice. Formal response submitted to the RFI. If PAA becomes a formal NIST control,
the architecture documented here is the reference implementation.
IEEE Autonomous Intelligent Systems
Trustworthy & Agentic AI
The IEEE Autonomous Intelligent Systems portfolio covers transparency, fail-safe design,
bias, organizational governance, and the emerging generation of agentic AI standards.
Synchronicity is designed against the gaps these standards identify. No IEEE
endorsement is claimed or implied.
Published standards — Synchronicity maps to:
- 7001-2021Published Transparency of autonomous systems — signed decision artifacts with content-hashed policy snapshots; every action is reproducibly replayable.
- 7009-2024Published Fail-safe design — default-deny semantics, fail-closed on authority unavailability, policy-snapshot availability monitoring.
- 7003-2024Published Algorithmic bias considerations — the append-only signed action log is the population-level substrate bias analysis runs against.
Drafts in progress — Synchronicity is designed against the gaps these drafts identify:
- P7009.1Draft Safety management — interventions in anomalous behavior. HOLD outcomes are designed as the formal intervention primitive routed to human approval before execution.
- P7022Draft Trustworthy generative & agentic AI in the enterprise. The core domain: agentic-AI governance with a forensic-grade audit substrate.
- P2863Draft Organizational governance of AI. The architecture is designed to provide a technical complement to the organizational principles and processes in the P2863/D2 (March 2026) draft.
Out of direct scope: P7008 (nudging), 7010 (well-being metrics), 2933 (clinical IoT
TIPPSS), and 2807.1 (knowledge graphs). They aren't enforced at the action layer.
The founder has submitted formal comments to the
IEEE P2863 working group on the D2 draft, and is a
participant in the IEEE P3301 working group. Comments and
participation are not endorsements; the working groups have not adopted or published
any of this work.
SOC 2 & ISO/IEC 27001
Operational Security
The two standards every procurement team will already have a checklist for. Synchronicity
doesn't replace these — it strengthens the AI-specific evidence base they rest on.
How Synchronicity maps: Tenant isolation maps to SOC 2 CC6.1. Append-only,
signed audit log maps to ISO/IEC 27001 A.12.4 and NIST SP 800-53 AU-9. Cross-border data
flow controls map to GDPR Arts. 44-50 and ISO/IEC 27701.