Skip to content

Model & AI risk governance for regulated institutions

The Company Brain

  • Who approved this change?
  • Prove it was not changed.
  • How is the AI’s work checked?
  • Show six months of it.
  • Who is responsible?
“Figma was built to draw what we can see. MINERVA is built to draw what we govern.”
  • SOC 2 · CC8.1
  • ISO/IEC 27001 · audit trail
  • ISO/IEC 42001 · oversight
  • SOC 2 Type II
  • ISO/IEC 42001 · roles

One permissioned blueprint of your AI model registry and operations.

Now onboarding — enterprise pilots

ITHE PROBLEMCAN YOU PROVE IT?K1 · SOLSTITIAL COLURE · 0.668IITHE INSTRUMENTFIVE DIMENSIONSH1 · HORIZON RING · 0.407IIITHE ENGINEZERO SWITCHING COSTE1 · THE ECLIPTIC · 0.704IVTHE OUTCOMESFIVE READINGSM1 · THE MERIDIAN · 0.835VCOSTWHAT A SHEET COSTSQ1 · THE EQUATOR · 0.549VISTARTTHE FIRST SHEETK2 · EQUINOCT. COLURE · 0.502SHEET DATAPROJECTIONORTHOGRAPHICOBLIQUITY24°POLE ALT52°LEGENDGREAT CIRCLEHIDDEN — BEHINDSTATIONNODENSA1POLAR AXISP1PLUMB52°POLE ALTØ 336MINERVAARMILLARY 00SHEET 00 OF 06REV 001SCALE 1:1

Exhibit I The Problem

“Can you prove it?”

1 May 2027. OSFI asks every bank in Canada. Most will answer with:

  1. 01Hundreds of models
    • They decide credit, fraud, pricing and AML for millions of customers.
    • Most inventories are incomplete or out of date.
    • Proof of governance is assembled after the fact, every time.
  2. 02One spreadsheet
    • That is the model inventory at most institutions.
    • Nobody can prove who changed what, or when.
    • One analyst leaves, and the knowledge leaves with them.
  3. 03Six weeks
    • That is how long one answer takes.
    • Teams stop their work to reconstruct what was never written down.
    • Every model keeps deciding while the search goes on.

Exhibit II The Instrument

The 5D operational architecture.

Every model on the same picture.
Every decision on one append-only record.

1D The Atom

Every model is one card with one named owner.

MINERVA breaks the inventory into its atoms: one card per model, carrying its owner, its rating, its validation and the tests it must pass. Nothing is governed in bulk.

Core
Who owns what
Unit
One model
1D · THE ATOMONE MODEL, EXPLODED INTO WHAT IT OWESMODEL MNB-014EXPLOSION AXISDATUMMODELMNB-014A1FOUR DUTIES · FOUR HANDSU1RATINGP. RAMANPRU2VALIDATIONM. CHENMCU3APPROVALJ. KIMJKU4MONITORINGD. OKAFORDO1234ASEE DETAIL AADETAIL AMNB-014 · APPROVALAPPROVE MNB-014LIFECYCLE MOVEAPPROVERJ. KIMSTATEAWAITING GATEAT GATEAPPROVEDX1EVIDENCEVALIDATION REPORT · SHA-256REVIEW DUE14 MAR 2027DECIDED BYJ. KIM · 14 MARDETAIL A · SCALE 4:1WHAT IT OWESS1NODUTYOWNERGATE1RATINGP. RAMANAPPROVED2VALIDATIONM. CHENAT GATE3APPROVALJ. KIMAPPROVED4MONITORINGD. OKAFORAWAITING GATE1 · BROKEN DOWNONE MODEL, LIFTED INTO ITS DUTIES2 · ATTRIBUTABLEA NAMED PERSON HOLDS EACH DUTYNOTES1 EXPLODED VIEW · DO NOT SCALE2 STATE CHANGES ARE GATED3 EVIDENCE IS HASH-CHAINED4 THE RECORD IS APPEND-ONLYMINERVAMODEL MNB-014SHEET 1 OF 5SCALE AS NOTEDREV 041

2D The Map

Every model located, and strung to everyone who touches it.

MINERVA draws the register on one plane: each model tied to who built it, who validated it, who approved it, the vendor it depends on and the policy that governs it. Independence is a drawing, not a claim.

Core
Hands and rules
Unit
One string
2D · THE MAPEVERY MODEL, LOCATED ON ONE ENDLESS PLANEPLANE P-02ABCDEFGHIJ1234DOT PITCH 16N-01B1DEV · P. RAMANN-02F1MODEL · MNB-014N-03F3BOOK · MORTGAGEN-04A3CODE · MNB-014N-05I2VENDOR · EQUIFAXBUILTSCORESOWNSDEPENDS ONPRIYAMINIMAP1LOCATEDBY ADDRESSON THE PIECE2WORDEDTHE STRING SAYSWHAT IT MEANS3UNBOUNDEDTHE PLANE CONTINUESPAST THE SHEET EDGENOTES1 DOT PITCH 16 · NO RULED EDGES2 A STRING IS A RECORDED RELATION3 THE SHEET CROPS · THE PLANE DOES NOTSHEET SCHEDULEN-01DEV · P. RAMANB1N-02MODEL · MNB-014F1N-03BOOK · MORTGAGEF3N-04CODE · MNB-014A3N-05VENDOR · EQUIFAXI2MINERVAPLANE P-02SHEET 2 OF 5SCALE · ZOOMREV 005

3D The Model

The whole institution, live — every model as it runs.

MINERVA keeps the map moving with the work: a model in production wears its watch, a figure past its line raises a breach, and a state changes only through a door. What the examiner sees is what is running.

Core
Standing and watch
Unit
The live register
3D · THE MODELONE LIVING REGISTER · RE-DRAWN AS IT RUNSTWIN A-03APPEND-ONLYWATCHZ2MODELSZ1PEOPLE & ROLESZ3THE RECORDP1P2P3MNB-014MNB-021LEDGERPACKETONE GRID, EVERY ZONE1ONE FABRICHANDS, MODELS, RECORDON ONE GRID2RUNNINGEACH DECISIONLANDS ON THE RECORD3GATEDA STATE CHANGES ONLYTHROUGH A DOORLEGENDCONVEYOR EDGEGATED · A DOORISO GUIDE · 30 DEGZXYNOTES1 ISOMETRIC · 30 DEG · AS BUILT2 A DIAMOND MARKS A DOOR3 A WATCH READS BY TICK, NOT NUMBERMINERVATWIN A-03SHEET 3 OF 5REV 004SCALE 1:1

4D The Timeline

An append-only record anyone can recompute.

MINERVA keeps each change as a hash-chained row, time-stamped by an outside authority. Verify it offline, without us.

Core
Evidence
Unit
One row
4D · THE TIMELINEAPPEND-ONLY KEPT STATES ON ONE RAILCHANGELOG C-041EVERY STATE KEPTREPLAY · VERIFY · COMPARE2SIGNEDWHO STRUCK EACH STATET1TIMEAPPEND-ONLYAPPENDSA1ARCHIVE · HASH-CHAINED · TIME-STAMPED · RECOMPUTABLE+1 RATING+1 REPORT+1 FINDING+1 DECISION +1 SEALW1W2PROPOSEDB1R129f31c07IMPORTED17 APR 2026E. OKAFORR1R134b2a9c1RATED08 MAY 2026J. KIMR2R14d27e5b3VALIDATED12 JUN 2026M. SATOR3R1571c0e4aFINDING30 JUL 2026R. HALER4R16e58a2f9APPROVED21 AUG 2026A. IDRISR5HEADLEGENDHEAD · LATEST STATEKEPT STATEPROPOSED LANEARCHIVENOTES1 APPEND-ONLY · THE RAIL EXTENDS2 EVERY HASH RECOMPUTABLE3 A PROPOSAL MERGES BY DECISIONMINERVACHANGELOG C-04SHEET 4 OF 5SCALE 1:1REV 016

5D The Multiverse

Every automated decision proposed, gated and kept.

An agent may propose and may not decide. Each move passes one door a person holds — the gate refuses its own author — and the one future chosen lands on the record. Many futures, one gate, one record.

Core
Governance
Unit
The gate
5D · THE MULTIVERSEMANY FUTURES, ONE GATE, ONE RECORDAXIS X-05LEGENDWEIGHED · PENDINGDECIDED · CONTINUESA PERSON DECIDESAGENT · PROPOSES, NEVER DECIDESNOTES1 DASHED IS PENDING, FOREVER2 THE GATE REFUSES ITS OWN AUTHOR3 A GAP READS UNSPECIFIEDMINERVAAXIS X-05SHEET 5 OF 5SCALE 1:1REV 004PROPOSEDAGENTMAY NOT DECIDEP-117SCENARIO AF-01HOLDSCENARIO BF-02APPROVESCENARIO CF-03RETIRESCENARIO DF-04RE-RATEFOUR FUTURESGATE G-01ONE DECISIONON THE RECORDREV 042 · J. KIMHASHa41f7c2APPROVE · SCENARIO BPREV9f31c07SEALEDTHE LEDGEREVENTS · IN ORDERPROPOSEDWEIGHEDDECIDEDRECORDEDGSEE DETAIL GKEYWAYDETAIL G · SCALE 4:1DECIDED BYJ. KIMTHE GATE REFUSESITS OWN AUTHOR1FUTURES IN PARALLELPROPOSED · NONE DECIDES ITSELF2NOTHING APPLIES ITSELFONE GOVERNED DOOR3THE ONE FUTURE, KEPTAPPEND-ONLY · RECOMPUTABLE

Exhibit III The Engine

Zero switching cost.
Full interoperability.
Nothing leaves your data centre.

E1 MIGRATION ENGINE
Drop the spreadsheet. Every row lands drawn. Nothing re-keyed.
E2 CONNECTORS
MLflow, a file drop, any export. A drift becomes a proposal.
E3 OPEN API
Scoped tokens. One OpenAPI spec. Signed webhooks.
E4 INTEROPERABILITY
SSO over OpenID Connect. One container, in your racks.
THE GOVERNED LOOPHOW THE OUTSIDE GETS IN · HOW THE RECORD GETS OUTLOOP L-06LOOP NN+1P1THE ANALYST PROPOSESDECIDED BYX19F31C07M1CAPTURED · WITH PROVENANCEINOUTT1DELIVERED · API · WEBHOOKSYOUR REGISTERE1CONNECTORSMLFLOW REGISTRYFILE DROP · CSVSCOPED TOKENE2MIGRATION ENGINECSVXLSXJSONFORMATTERIN, AS DRAWN3 FORMATS1 SHEET1OBSERVED, HASH-CHAINEDA DRIFT BECOMES A PROPOSAL2YOUR SPREADSHEET, IMPORTEDNOTHING RE-KEYED3THE LOOP DOES NOT CLOSEUNTIL A PERSON DECIDESOUT THROUGH THE OPEN APISIGNED WEBHOOKS · ONE SPEC4LEGENDSTATIONDECISIONGATE HELDINTAKE PORTNOTES1 NOTHING APPLIES ITSELF · A PERSON DECIDES2 EVERY DECISION KEPT · WHO, WHICH REV3 A CONNECTOR OBSERVES · NEVER WRITES A FACT4 THE RECORD IS APPEND-ONLY · HASH-CHAINEDMINERVALOOP L-06DETAIL L-06 · SHEET 1 OF 1SCALE 1:1REV 008

Exhibit IV The Standard

What an auditor actually asks.

A certification is a report about your controls. This is the record those controls are supposed to leave behind. It is written while the work happens, not put together in the six weeks before an audit.

CONFORMANCE REGISTERFIVE QUESTIONS AN AUDITOR ASKSN1DISCLAIMERMINERVA IS NOT A CERTIFICATION AND DOES NOT REPLACE AN AUDIT.IT PRODUCES THE EVIDENCE AN AUDIT ASKS FOR.MINERVACONF C-06SHEET 1 OF 1REV 001SCALE 1:1REFTHE QUESTION ASKEDWHERE THE ANSWER LIVESSTANDARDQ1Who approved this change?A named person, and the version they approvedSOC 2CC8.1 CHANGE MGMTQ2Prove nobody changed it afterwards.A fingerprint on every entry you can check yourself, offlineISO/IEC 27001LOGGING & AUDIT TRAILQ3Who checks what the AI does?A person has to approve every proposalISO/IEC 42001HUMAN OVERSIGHTQ4Show six months of it.The record made at the time, not rebuilt laterSOC 2 TYPE IIOPERATING EFFECTIVENESSQ5Who is responsible for this decision?Every decision names the person who made itISO/IEC 42001ROLES & RESPONSIBILITIES1ANSWERED BY THE RECORDMADE AS THE WORK HAPPENS
Q1Who approved this change?
A named person, and the version they approvedSOC 2 · CC8.1 CHANGE MGMT
Q2Prove nobody changed it afterwards.
A fingerprint on every entry you can check yourself, offlineISO/IEC 27001 · LOGGING & AUDIT TRAIL
Q3Who checks what the AI does?
A person has to approve every proposalISO/IEC 42001 · HUMAN OVERSIGHT
Q4Show six months of it.
The record made at the time, not rebuilt laterSOC 2 TYPE II · OPERATING EFFECTIVENESS
Q5Who is responsible for this decision?
Every decision names the person who made itISO/IEC 42001 · ROLES & RESPONSIBILITIES

Exhibit V The Outcomes

What this is for.

Five measurements, one shared record.

MEASURED CHANGEFIVE NUMBERS, EACH TAKEN TWICEREFMEASUREWITHOUT MINERVAWITH MINERVACHANGEG1TIME TO FINISH WORK14.0 DAYS8.3 DAYS-41%BECAUSE WORK RESUMES WHERE IT WAS APPROVEDG2EVIDENCE FOR COMPLIANCE6 WEEKS6 MINUTES-99.99%BECAUSE THE EVIDENCE IS THE RECORD ITSELFG3CHANGES NOBODY APPROVED1 IN EVERY 34, EACH OWNEDΔ 4BECAUSE A PERSON HAS TO APPROVE IT FIRSTG4AI COST PER TASK$57.90$27.80-52%BECAUSE THE MODEL IS GIVEN ONLY THE MAPG5EXPERT METHODS, REUSED12 / YEAR48 / YEAR×4BECAUSE A METHOD SAVED ONCE IS FOUND AGAINMINERVAINSTR I-07SHEET 1 OF 1REV 0061:1

Exhibit VI Cost

Plans.

Sched S-07 · Schedule of worksRev 006 · 1:1
Item
Pilot$15K30 days · credited to year one
Institution$36Kto $150K a year
Packs+$12Ka year, each
Runs for
30 days
A year
A year, each
Models
Your real inventory
To 50 · 250 · unlimited
Every one the pack governs
Seats
Examiner login · evidence packet
Schedule of worksthree plans, one schedule, one right margin

Free to start — the E-23 inventory template and the map, one seat.Partners — consultancies and AI vendors, $99 a seat a month.Every price is an assumption until the first pilots close.

Exhibit VII Engagement

Visualize the system.Own the infrastructure.Control the ops.Maximize AI. Minimize cost.Prove the outcomes.

So — who is your brain?

Contact us

Sign up now for a special deal.

FormRegister of interest
Purpose

No credit card · reply within one working day