Governance portfolio

Decisions, controls, and evidence

Three cases showing how I turn an AI risk into an owner, a release condition, a monitoring signal, and a decision another reviewer can reconstruct.

Each experience label appears beside the claim. Proposed methods stay proposed; transferable experience does not become healthcare employment.

Case decisions

What changed, who owns it, and what reopens it

Verified experience

Stillwell

The policy had to reach the running system

Consent, identity, retention, and escalation rules became release conditions instead of advisory text.

Decision: I traced adopted requirements to the control and test that enforced each one. Missing or partial links became named findings, and policy violations became release-blocking.
Evidence: A rule-to-control-to-test matrix, an 84-attack adversarial corpus, and a 3,831-test release gate across 253 files.
Authority: I owned the product standard and implementation. Independent clinical, legal, privacy, security, and compliance authority would remain separate in a health system.
Reopen trigger: A changed rule, spoken line, consent state, or retention behavior reopens the implementation evidence before release.

Run the consent and escalation demo

Verified experience

Plate Check

The medical feature stayed off

A product boundary and a missed evaluation threshold both changed what the system was allowed to do.

Decision: I separated the software functions, removed four dose-shaped features, constrained the output schema, and kept a vision feature off when its labelled-data result missed the release threshold.
Evidence: A dated scoping record, output screening, a schema with no dose field, and an evaluation against labelled data.
Authority: I owned the product decision. In an enterprise setting, legal and regulatory owners make the final applicability determination with clinical and product leaders.
Reopen trigger: A feature, intended-use, user, autonomy, performance, or data change reopens the boundary and release decision.

Read the Plate Check decision

Verified experience

agent-gate

Unsafe or unproven agent actions stop the run

An agent cannot turn an unsupported claim or unrecognized high-risk action into a successful result.

Decision: I built a reusable action fence, audited its own proof claims, closed three findings, and expanded the suite from 54 tests to 79.
Evidence: Stdlib-only rules, a hash-chained evidence ledger, secret scanning, lease expiry, and tests for halt and proof behavior.
Authority: Security owns access and incident authority. Product and operations own permitted actions. Governance makes the evidence and residual risk visible to both.
Reopen trigger: A new tool, permission, model, data source, autonomy level, or silent-completion pattern triggers review.

Read the agent-gate case

Runnable evidence in this repository

Deployed-model and agent monitoring

The monitoring record ends in a release decision

The control room instruments a live model canary, checks output quality, measures evaluator agreement and false accepts, traces agent tools and approvals, and exports the joined evidence record.

Run the observability control room

Transferable experience

Cross-functional facilitation

One decision record for competing obligations

I led multidisciplinary regulated programs across legal, licensing, environmental, engineering, contractor, and operating constraints. I converted competing requirements into a shared view of evidence, owner, dependency, cost, schedule effect, and approval authority, then used that record to sequence work and move specialist decisions to the people who owned them. The programs included 10-plus-person crews and one remediation project delivered on budget. The transferable method is direct: one decision record, explicit authority, visible open questions, and no requirement disappearing between meetings.

Proposed operating model

Analyst quality and coaching

Calibration improves judgment without rewarding fast approval

The lead stays in difficult reviews, balances the queue, samples decision quality, and treats repeated findings as a possible system or rubric problem before treating them as an individual failure.

Queue huddle

Balance urgent work, aging reviews, missing evidence, and reviewer load.

Difficult-case conference

Keep the lead operating alongside the team and turn hard cases into reusable precedent.

Paired review

Develop judgment without taking ownership away from the analyst.

Calibration sample

Find rubric, evidence, precedent, and coaching gaps through independent review of the same cases.

Quality and capacity review

Inspect record completeness, rework, escalation quality, skill mix, and high-complexity concentration.

Quality measures include inter-reviewer agreement, rework reason, decision-record completeness, appropriate escalation, workload, and partner clarity. None should reward silent risk acceptance or punish a well-supported stop decision.

Dated source map

Current frameworks and authority types

Last reviewed 21 August 2026. Detailed applicability analysis remains private; the public map shows the operating question and source.

Voluntary risk-management framework

NIST AI RMF 1.0 + GenAI Profile

Govern, Map, Measure, and Manage evidence, with generative and agentic risk practices. Mapping reviewed while NIST revises the RMF in 2026.

Open the primary source

Healthcare governance guidance

CHAI governance playbooks

Policy, structures, resources, lifecycle use, risk and impact, data, third parties, and education, training, and feedback.

Open the primary source

Management-system and impact-assessment standards

ISO/IEC 42001 and 42005

Organization-wide responsibility, objectives, operation, evaluation, continual improvement, and AI system impact assessment. No certification claim is made.

Open the primary source

Voluntary organization-level certification reference

Joint Commission responsible AI

A health-organization operating reference for responsible AI use, not a product badge or a personal credential.

Open the primary source

Authority-specific applicability review

Healthcare legal triggers

HIPAA, FDA software-function boundaries, ONC HTI-1, and current state law are scoped by use, actor, workflow, data, geography, and effective date, then routed to the proper authority owner.

Open the primary source

Continue

Search the full evidence index or read the career behind it.

Read the resume Search the evidence index Start a conversation