1 May 2027. OSFI asks every bank in Canada. Most will answer with:
01Hundreds of models
They decide credit, fraud, pricing and AML for millions of customers.
Most inventories are incomplete or out of date.
Proof of governance is assembled after the fact, every time.
02One spreadsheet
That is the model inventory at most institutions.
Nobody can prove who changed what, or when.
One analyst leaves, and the knowledge leaves with them.
03Six weeks
That is how long one answer takes.
Teams stop their work to reconstruct what was never written down.
Every model keeps deciding while the search goes on.
Exhibit II The Instrument
The 5D operational architecture.
Every model on the same picture. Every decision on one append-only record.
1D The Atom
Every model is one card with one named owner.
MINERVA breaks the inventory into its atoms: one card per model, carrying its owner, its rating, its validation and the tests it must pass. Nothing is governed in bulk.
Core
Who owns what
Unit
One model
2D The Map
Every model located, and strung to everyone who touches it.
MINERVA draws the register on one plane: each model tied to who built it, who validated it, who approved it, the vendor it depends on and the policy that governs it. Independence is a drawing, not a claim.
Core
Hands and rules
Unit
One string
3D The Model
The whole institution, live — every model as it runs.
MINERVA keeps the map moving with the work: a model in production wears its watch, a figure past its line raises a breach, and a state changes only through a door. What the examiner sees is what is running.
Core
Standing and watch
Unit
The live register
4D The Timeline
An append-only record anyone can recompute.
MINERVA keeps each change as a hash-chained row, time-stamped by an outside authority. Verify it offline, without us.
Core
Evidence
Unit
One row
5D The Multiverse
Every automated decision proposed, gated and kept.
An agent may propose and may not decide. Each move passes one door a person holds — the gate refuses its own author — and the one future chosen lands on the record. Many futures, one gate, one record.
Core
Governance
Unit
The gate
Exhibit III The Engine
Zero switching cost. Full interoperability. Nothing leaves your data centre.
E1 MIGRATION ENGINE
Drop the spreadsheet. Every row lands drawn. Nothing re-keyed.
E2 CONNECTORS
MLflow, a file drop, any export. A drift becomes a proposal.
E3 OPEN API
Scoped tokens. One OpenAPI spec. Signed webhooks.
E4 INTEROPERABILITY
SSO over OpenID Connect. One container, in your racks.
Exhibit IV The Standard
What an auditor actually asks.
A certification is a report about your controls. This is the record those controls are supposed to leave behind. It is written while the work happens, not put together in the six weeks before an audit.
Q1Who approved this change?
A named person, and the version they approvedSOC 2 · CC8.1 CHANGE MGMT
Q2Prove nobody changed it afterwards.
A fingerprint on every entry you can check yourself, offlineISO/IEC 27001 · LOGGING & AUDIT TRAIL
Q3Who checks what the AI does?
A person has to approve every proposalISO/IEC 42001 · HUMAN OVERSIGHT
Q4Show six months of it.
The record made at the time, not rebuilt laterSOC 2 TYPE II · OPERATING EFFECTIVENESS
Q5Who is responsible for this decision?
Every decision names the person who made itISO/IEC 42001 · ROLES & RESPONSIBILITIES
Schedule of worksthree plans, one schedule, one right margin
Free to start — the E-23 inventory template and the map, one seat.Partners — consultancies and AI vendors, $99 a seat a month.Every price is an assumption until the first pilots close.
Exhibit VII Engagement
Visualize the system.Own the infrastructure.Control the ops.Maximize AI. Minimize cost.Prove the outcomes.