{ "$schema": "https://json-schema.org/draft/2020-12/schema", "brand": { "name": "aioperatingmodel.work", "tagline": "AI Governance Board Framework & Operating Model", "positioning": "A Microsoft-Centred Governance, Risk and Compliance Offering for C-Suite Decision Makers", "design_archetype": "High-End Strategic Advisory × British Heritage Banking (NatWest Purple Core)", "influences": ["NatWest Royal Purple Identity", "McKinsey Quarterly Editorial Elegance", "Accenture Strategy Rigour", "EY Parthenon Precision"], "version": "1.0.0", "date": "2026-09-22" }, "palette": { "primary": { "natwest_purple": { "hex": "#4A154B", "rgb": "rgb(74, 21, 75)", "hsl": "hsl(299, 56%, 19%)", "role": "Brand hero core, primary navigation, authoritative headers" }, "royal_violet": { "hex": "#5A287D", "rgb": "rgb(90, 40, 125)", "hsl": "hsl(275, 52%, 32%)", "role": "Secondary brand anchor, gradient transitions, active states" }, "deep_obsidian": { "hex": "#0F071A", "rgb": "rgb(15, 7, 26)", "hsl": "hsl(265, 58%, 6%)", "role": "Executive dark mode ground, high-contrast board cards" }, "midnight_plum": { "hex": "#230A2B", "rgb": "rgb(35, 10, 43)", "hsl": "hsl(285, 62%, 10%)", "role": "Deep container backgrounds, card borders, table header fills" } }, "accents": { "electric_magenta": { "hex": "#DE0059", "rgb": "rgb(222, 0, 89)", "hsl": "hsl(336, 100%, 44%)", "role": "NatWest signature high-energy accent, critical metrics callout, active pill borders" }, "consulting_gold": { "hex": "#D4AF37", "rgb": "rgb(212, 175, 55)", "hsl": "hsl(46, 65%, 52%)", "role": "Executive prestige badges, C-suite advisory seals, tier 1 indicators" }, "azure_cyan": { "hex": "#0078D4", "rgb": "rgb(0, 120, 212)", "hsl": "hsl(206, 100%, 42%)", "role": "Microsoft & Azure ecosystem linkage tags (Foundry, Purview, Entra, Copilot)" } }, "neutrals": { "pure_white": "#FFFFFF", "platinum_mist": "#F8FAFC", "alabaster_surface": "#F1F5F9", "border_subtle": "rgba(255, 255, 255, 0.08)", "border_light": "rgba(74, 21, 75, 0.12)", "text_primary_dark": "#FFFFFF", "text_secondary_dark": "#CBD5E1", "text_muted_dark": "#94A3B8", "text_primary_light": "#0F071A", "text_secondary_light": "#334155", "text_muted_light": "#64748B" }, "governance_rag": { "green": { "hex": "#10B981", "surface": "rgba(16, 185, 129, 0.12)", "border": "rgba(16, 185, 129, 0.3)", "label": "Approved / Compliant", "definition": "Current evidence demonstrates the approved criterion is met; no unresolved failure" }, "amber": { "hex": "#F59E0B", "surface": "rgba(245, 158, 11, 0.12)", "border": "rgba(245, 158, 11, 0.3)", "label": "Stale / Non-Critical", "definition": "Noncritical gap, degraded coverage or evidence uncertainty within agreed tolerance" }, "red": { "hex": "#EF4444", "surface": "rgba(239, 68, 68, 0.14)", "border": "rgba(239, 68, 68, 0.4)", "label": "Critical / Contained", "definition": "Mandatory criterion fails, tolerance is exceeded or material harm is credible" }, "unknown": { "hex": "#8B5CF6", "surface": "rgba(139, 92, 246, 0.12)", "border": "rgba(139, 92, 246, 0.3)", "label": "Missing / Unassessed", "definition": "Evidence missing, stale or not yet assessed. Never treat as Green." } } }, "typography": { "font_families": { "editorial_serif": { "name": "Playfair Display, Cormorant Garamond, Newsreader, Georgia, serif", "usage": "Editorial hero display titles, executive quotes, C-suite pullouts" }, "executive_sans": { "name": "Plus Jakarta Sans, Syne, Inter, -apple-system, BlinkMacSystemFont, sans-serif", "usage": "Primary UI headings, navigation, scorecard controls, body copy" }, "tabular_mono": { "name": "JetBrains Mono, Fira Code, SF Mono, Menlo, monospace", "usage": "Evidence hashes, entity IDs (EV 301, AGT 001), task tracking, timestamps" } }, "hierarchy": { "display_hero": { "size": "3.5rem (56px)", "line_height": "1.1", "letter_spacing": "-0.03em", "weight": "700" }, "section_headline": { "size": "2.25rem (36px)", "line_height": "1.2", "letter_spacing": "-0.02em", "weight": "600" }, "card_title": { "size": "1.25rem (20px)", "line_height": "1.4", "letter_spacing": "-0.01em", "weight": "600" }, "body_lead": { "size": "1.125rem (18px)", "line_height": "1.65", "weight": "400" }, "data_micro": { "size": "0.75rem (12px)", "line_height": "1.4", "letter_spacing": "0.05em", "text_transform": "uppercase", "weight": "600" } } }, "design_principles": [ { "principle": "C-Suite Editorial Density", "description": "Never dumb down enterprise complexity. Present 30-control governance with the visual poise of a McKinsey executive memo and the precision of NatWest institutional risk." }, { "principle": "Conservative Deterministic Rollups", "description": "No optimistic colour averaging. A single Red mandatory test turns the box Red, the layer Red, and the executive rollup Red until verified closure." }, { "principle": "Continuous Evidence Lineage", "description": "Every RAG status must trace back to immutable evidence (EV 301), an assessment record (AS 031), a finding (F 001), an owner (Platform Engineer), and a board decision (D 001)." }, { "principle": "Microsoft Ecosystem Grounding", "description": "Directly address Copilot, Copilot Studio agents, Microsoft Foundry, Purview, Entra ID, and MCP server security boundary controls." }, { "principle": "High-End Bespoke Abstract Visuals", "description": "Generative abstract 3D forms, royal purple crystalline architecture, parametric ribbons, and luminous glass surfaces echoing deep institutional trust." } ], "layers_taxonomy": [ { "group": "Adopt", "layer_id": "01", "title": "AI Inventory", "board_question": "Do we know what AI exists and who owns it?", "controls": ["01A AI System Inventory", "01B Risk Classification", "01C Ownership and Roles", "01D Model and Tool Registry", "01E Usage Visibility"] }, { "group": "Adopt", "layer_id": "02", "title": "Responsible Deployment", "board_question": "Are intended uses and changes approved and safe to release?", "controls": ["02A Use Case Selection", "02B Architecture and Model Choice", "02C Deployment Practices", "02D Change Control", "02E DevSecOps Integration"] }, { "group": "Defend", "layer_id": "03", "title": "AI Security and Access", "board_question": "Can AI access or change only what it is authorised to?", "controls": ["03A Identity and Access", "03B Context and Data Protection", "03C Tool and MCP Controls", "03D Access Controls", "03E Data Integrity"] }, { "group": "Defend", "layer_id": "04", "title": "Testing and Monitoring", "board_question": "Can we detect harmful behaviour and respond?", "controls": ["04A Pre Production Evaluation", "04B Red Teaming and Threats", "04C Runtime Monitoring", "04D Drift Detection", "04E Incident Response"] }, { "group": "Govern", "layer_id": "05", "title": "Human Oversight", "board_question": "Can accountable people challenge, intervene and stop AI?", "controls": ["05A Decision Review", "05B Escalation Paths", "05C Override Authority", "05D Output Validation", "05E Accountability Mapping"] }, { "group": "Govern", "layer_id": "06", "title": "Compliance and Audit", "board_question": "Can we explain obligations, decisions and supporting evidence?", "controls": ["06A Policy and Decision Rights", "06B Regulatory Alignment", "06C Audit Evidence", "06D Incident Reporting", "06E Audit Trails and Logs"] } ] }