6.2
AI Governance Triangle
Organizational, technical, and human residual risk.
Risk dimensions
Dimension scores
Normalized residual risk exposure by dashboard dimension.
AI lifecycle
Lifecycle readiness map
Dashboard backbone from needs identification through deployment and monitoring.
Top risks
Highest residual risk exposure
Prioritized by current residual score after mitigation progress.
| ID | Risk | Dimension | Residual | Level | Owner |
|---|
Risk register
AI project risk register
0 risks shown
| ID | Risk and evidence | Dimension | Lifecycle phase | P | I | D | Raw normalized | Residual | Status | Approval | Owner | Mitigations | Actions |
|---|
Mitigation workflow
Mitigation management
0 mitigation actions shown
| ID | Mitigation action | Linked risk | Status | Progress | Effectiveness | Due date | Owner | Evidence | Residual impact | Actions |
|---|
Deployment gate
Gate decision workflow
Loading
Loading gate result.
Reviewer decision
Evidence traceability rules
Each criterion stores the calculated evidence, reviewer note, review status, and optional evidence reference. This creates the audit trail expected by the design-first model.
- Blocked criteria require reviewer notes.
- External evidence can be a URL or internal document reference.
- Reviewer decision is stored separately from calculated gate status.
Gate criteria
Criteria notes and evidence
| ID | Criterion | Required | Actual | Status | Evidence | Reviewer controls |
|---|
Gate history
Persisted deployment gate evaluations
0 persisted gate evaluations
| Gate ID | Evaluated | Calculated status | Review status | Reviewer | Blocking criteria | Evidence links | Action |
|---|
Audit trail
Governance audit events
| Audit ID | Time | Actor | Entity | Entity ID | Action |
|---|
ISO-style indicator catalog
Risk indicators and measurands
Operational implementation of measurable AI risk indicators.
AI model evidence
Experiments and model metrics
Model performance, stability, reproducibility, and fairness status used as risk evidence.
| ID | Experiment | Model | Accuracy | F1 | Precision | Recall | AUC | Bias | Stability | Reproducibility |
|---|
Project management integration
Multi-application integration layer
Shared adapter model for Trello, Jira, Asana, and Microsoft Planner. This keeps COSMIC risk logic independent from each project-management tool.
| Application | Workspace / project | Connection | Sync direction | Object mapping | Last sync | Actions |
|---|
External mappings
Risk to work-item traceability
Shows how COSMIC AI risks are represented in external project-management applications.
| Application | COSMIC risk | External item | External status | Sync status | Last synced |
|---|
Sync history
Project-management sync runs
Audit-friendly record of synchronization activity.
| Run | Application | Status | Created | Updated | Failed | Summary |
|---|
Reporting
Instructor-ready reports and exports
Exports package the current risk register, mitigation evidence, deployment gate, indicators, PM mappings, and audit trail.
Report contents
Evidence package coverage
Export notes
Submission use
The executive HTML report is designed for browser printing or saving as PDF. CSV exports are intended for spreadsheet review. JSON exports preserve the full evidence structure for technical review.
The reporting module is an implementation extension. It packages the measurable risk evidence requested by the source framework.
Step 8
User roles and access control
Switch actor to test role-based permissions for risks, mitigations, gates, reports, OAuth, and PM sync.
Users
Application users
| User | Role | Status |
|---|
Roles
Permission matrix
| Role | Permissions |
|---|
Traceability
Source alignment and implementation extensions
The dashboard separates source-derived concepts from software design logic.
| Element | Source status | Dashboard interpretation |
|---|