AI Trust OS -- A Continuous Governance Framework for Autonomous AI Observability and Zero-Trust Compliance in Enterprise Environments
Authors: Eranga Bandara, Asanga Gunaratna, Ross Gore, Abdul Rahman, Ravi Mukkamala, Sachin Shetty, Sachini Rajapakse, Isurunima Kularathna, Peter Foytik, Safdar H. Bouk, Xueping Liang, Amin Hass, Ng Wee Keong, Kasun De Zoysa
Organizations: Old Dominion University, Norfolk, VA, USA · AI Motion Labs, Melbourne, Australia · Deloitte & Touche LLP, USA · Florida International University, USA · Accenture Technology Labs, Arlington, VA, USA · Nanyang Technological University, Singapore · University of Colombo, Sri Lanka
The accelerating adoption of large language models, retrieval-augmented generation pipelines, and multi-agent AI workflows has created a structural governance crisis. Organizations cannot govern what they cannot see, and existing compliance methodologies built for deterministic web applications provide no mechanism for discovering or continuously validating AI systems that emerge across engineering teams without formal oversight. The result is a widening trust gap between what regulators demand as proof of AI governance maturity and what organizations can demonstrate. This paper proposes AI Trust OS, a governance architecture for continuous, autonomous AI observability and zero-trust compliance. AI Trust OS reconceptualizes compliance as an always-on, telemetry-driven operating layer in which AI systems are discovered through observability signals, control assertions are collected by automated probes, and trust artifacts are synthesized continuously. The framework rests on four principles: proactive discovery, telemetry evidence over manual attestation, continuous posture over point-in-time audit, and architecture-backed proof over policy-document trust. The framework operates through a zero-trust telemetry boundary in which ephemeral read-only probes validate structural metadata without ingressing source code or payload-level PII. An AI Observability Extractor Agent scans LangSmith and Datadog LLM telemetry, automatically registering undocumented AI systems and shifting governance from organizational self-report to empirical machine observation. Evaluated across ISO 42001, the EU AI Act, SOC 2, GDPR, and HIPAA, the paper argues that telemetry-first AI governance represents a categorical architectural shift in how enterprise trust is produced and demonstrated.
Figures & tables
Figure 1: AI Trust OS four-layer conceptual governance architecture. Layer 1 enforces a zero-trust telemetry boundary through ephemeral read-only probes against external AI infrastructure. Layer 2 houses the core governance modules, including Shadow AI discovery, the AI System Registry, red teaming, and privacy mapping. Layer 3 synthesises machine-collected evidence into predictive intelligence and LLM-generated compliance documentation. Layer 4 exposes continuously maintained governance outputs to regulatory frameworks, auditors, and enterprise buyers. The dashed boundary denotes external AI infrastructure that is observed but never ingested.
Figure 2: AI Trust OS deployment and implementation topology. The user layer communicates with the Vercel edge runtime through HTTPS, where Clerk handles authentication and API routes manage governance workflows. An encrypted credential vault supplies ephemeral credentials to BullMQ-orchestrated probe workers hosted on Render, which execute read-only metadata checks against external AI infrastructure, including LangSmith, Datadog LLM, AWS, and model provider APIs [ 54 , 34 ] . Probe results are persisted as control assertions in a Neon PostgreSQL evidence ledger via Prisma ORM, with all queries partitioned by workspace identifier to enforce tenant isolation. The LLM synthesis pipeline consumes passed assertions from the evidence ledger — never raw payloads or PII — and generates board-grade compliance documentation through a stateless GPT-4o-mini pipeline.
Field
Value
Assertion ID
ea_7f3a91c
Workspace ID
ws_acme_fin_8821
Control
SOC2 CC6.1 · CC6.2
Status
PARTIAL_PASS
Integration
AWS IAM
Executed at
2026-04-06T00:14:32Z
Table 2: Representative evidence assertion record — AWS IAM MFA probe (ea_7f3a91c)
Artificial intelligence governance studies how laws, institutions, and technical controls shape AI development, deployment, accountability, and social effects.
Institute of Biomedical Ethics and History of Medicine, University of Zürich, Zürich, Switzerland · SUPSI, Dalle Molle Institute for Artificial Intelligence (IDSIA), Lugano, Switzerland · ETH Zürich, Zürich, Switzerland