Loading invitation…
Sign in or create an organization
Optional — every Workbench tool works with no account at all. Sign up if your team wants a shared organization, member roles, and an audit trail.
Your organization workspace
Manage your team, AI inventory, saved evidence, and governance activity.
Publish your trust page
A few steps to a page your customers can trust. Each step opens the trust page editor below.
Organization & team
Manage your active organization and member access.
Members
Pending invitations
AI systems & inventory
Register systems, track assets, and connect their relationships.
Your organization's AI Registry
Systems your organization has registered — private to your members, separate from the public Workbench registry.
Register a system in Workbench → AI Registry ↗ · Discovery & integrations ↗
AI Inventory — Assets
Models, agents, prompts, tools, MCP servers, datasets, vendors, business processes, and deployments your systems depend on.
Agents and MCP servers can be activated below for real Control Plane authentication — an issued key can then call POST /api/control-plane/evaluate as a verified identity instead of an unverified free-text name, and can be suspended or revoked at any time. See the Governance API docs for the request/response contract and free Node.js/Python snippets.
AI Inventory — Relationships
Link a system to the assets it uses, or link two assets directly (e.g. one agent that delegates to another), so you can trace dependencies through the graph.
The dropdowns below only list things you've already registered. You have none yet — register one in AI Inventory — Assets above, or add a system from the Workbench's AI Registry tool, then come back here.
AI Inventory — Import / Export
Download your organization's full inventory (systems, assets, relationships) as a file, or import one — owners and admins only.
Vendors
Suppliers in your register linked to the vendor's public AutoGovern trust page, followed for changes.
Link a supplier from Workbench → AI Registry: open a system, then under Suppliers use Vendor trust page on the supplier to connect by address, create an invite link to send the vendor yourself, or import facts. What you see here is only what the vendor's published trust page shows anyone. Imported facts are the vendor's own public statements, verified by AutoGovern or not, and do not replace your own review. Owners, admins and members can refresh and revoke; viewers read only. Links are checked again every 24 hours.
Saved work & insights
Find your assessments and review governance intelligence.
Your organization's saved work
Assessments, compliance crosswalks, and vendor answer packs saved while signed in.
Assessments
Compliance crosswalks
Vendor answer packs
Governance Intelligence
AI/ML-relevant exploited and predicted-exploitation CVEs, sourced from ThreatClaw — visible to signed-in organization members only, never part of the public Workbench. Items flagged ⚠ Affects your registered <asset> matched an asset name or vendor you've registered in AI Inventory — a name/vendor match, not a confirmed exploit, so treat it as a lead to verify.
Reports & effectiveness
Measure governance and prepare board or regulator reports.
Governance Effectiveness Score
The same eight factors as the public calculator at /effectiveness-score, but measured from this organization's own records instead of estimated with sliders. Choose granular guidance or micro granular records when you want to investigate. A factor with no data reports Not measured and is dropped from the weighting — never defaulted to a flattering value.
Start with the score and broad priorities. Explore deeper guidance when you need it; changing the view does not change your score.
Factor improvement playbooks
Choose a factor to explore. Suggested actions are planning aids: assign an owner, agree a due date, verify results, then reassess. Completing a checklist does not earn score points.
Board & regulator reports
A rolled-up snapshot of your organization's real AI governance activity — registered systems & upcoming obligations, agent/key hygiene, Control Plane guardrail activity, and Remediation Center actions (autonomous vs. human-approved), drafted automatically once a month. Nothing here is ever sent anywhere — "reviewed" just marks that a human looked at it; export or share it yourself.
Public trust page
Publish a page at autogovern.io/trust/<your-address> that shows customers how you govern your AI systems, read live from this organization's own records.
Page details
Nothing is public until an owner or admin publishes the page, and each section stays off until you switch it on. Only the systems you tick appear, with the suppliers they depend on and their passports issued as publicly listed. Text that looks like an email address or a phone, card or ID number is refused here and withheld from the page, but names of people cannot be detected: keep them out of this text and of system and supplier names.
Loading…
3 to 40 lowercase letters, digits and hyphens.
How you use data
Confirm your domain
Show that you control your website's domain: add this TXT record at your DNS provider, then choose Check now. It helps AutoGovern verify your page. It does not verify the page on its own. If you change the website, confirm the new domain again.
Private documents
Documents buyers can request from your trust page: PDFs you upload (a SOC 2 report, a pen test summary) and records you already have here. Only titles are public, and only while the page is published with the Private documents section switched on. A buyer signs in with an AutoGovern account to ask; you see their name, email address and organization, and decide. Every download is logged below. Up to 25 documents and 150 MB of uploads; each PDF up to 10 MB.
Upload a PDF
The file's own name is not kept. Titles are public: no names, emails or phone numbers.
Offer a record you already have
Offered documents
NDA
Buyers accept this text before asking for a document that needs it. Saving a change makes it a new version; requests record the version and a fingerprint of the exact text accepted. Save the trust page before writing the NDA.
Access requests
Approve for 1 to 90 days, deny with an optional note, or revoke access you gave. Requesters are not emailed (their address is not verified); they see your decision, and any note, on the request page. Nobody can decide a request they made.
Access log
Every download, newest first (last 500), including checks by your own owners and admins.
Questionnaires
Upload a buyer's security questionnaire (.xlsx or .csv). AutoGovern finds the question and answer columns and suggests an answer for each question from your answer library, with the records behind it. A person approves every answer; only approved answers are written into the buyer's file. CSA material: if the file holds CSA-style question IDs or names CSA, CAIQ, AICM, CCM or STAR anywhere, only question IDs are kept, never question text or the file, so you select the same file again to export. Shared Assessments SIG questionnaires are not accepted (licence). A buyer's own questionnaire is kept, with its file, in this organization's private workspace until you archive it (archiving deletes the file and the question wording). Up to 20 questionnaires; files up to 5 MB, 25 MB stored in all.
No names of people, emails or phone numbers.
Your questionnaires
Answer library
Your reusable answers, in your own words, each citing records as evidence. Draft from records writes drafts from what you already keep here (answer packs, the trust page's data-use statement, publicly listed passports, AI-BOMs, evidence packages, controls, suppliers, incidents, impact assessments). It never changes an answer you approved or edited. A Yes or Partly answer needs evidence before it is approved; No or Not applicable needs a short explanation. Buyers see signed AI-BOMs and evidence packages by name only, never by id. Up to 300 answers.
Columns used
Changing columns finds the questions again. Approved answers to the same questions are kept.
Model, system and agent cards
Cards in the shape US federal buyers ask for (OMB M-26-04, Appendix A): what a model, system or agent does, how it was trained and evaluated, its risks and how they are reduced, your acceptable use policy, end-user resources and how to give feedback. A card is your organization's own statement. Draft from records fills empty fields from what you already keep here (AI Registry, AI inventory, control test runs, Red Team run counts, the approved impact assessment, the generative AI profile, incident counts, the trust page's data-use statement) and says where each value came from; it never changes a field that already has a value. AutoGovern does not certify cards. A card is public only when you publish it, the trust page is published and Model, system and agent cards is switched on under What the page shows. Buyers can download it as Markdown (Hugging Face model card layout), as a CycloneDX 1.7 ML-BOM and, for agents, as an A2A agent card. AutoGovern signs agent cards only while your trust page is verified by AutoGovern; on an unverified page they are published unsigned. Up to 100 cards.
Required for a system card. For a model or agent card it lets Draft from records use that system's test runs, impact assessment, generative AI profile and incident counts.
A model for a model card; an agent or MCP server for an agent card.
Your cards
Open a card to edit it, draft it from your records, publish, unpublish or archive it. The counts show how many of the 4 minimum and 12 enhanced OMB M-26-04 transparency items each card says something about; they are not a judgement that the answers are enough. Publishing an edited card replaces the public copy; until then the public sees the last published version.
Cards are public: no names of people, email addresses or phone numbers (text that looks like them is refused, but names cannot be detected). Lists take one entry per line. Results, links and skills have a row per entry with a box for each part: use Add and Remove.
Buyers following your trust page
Customers that invited your organization to connect its trust page to their supplier register, where an owner or admin of yours accepted. They see what your published trust page shows anyone, and are told when it changes; nothing private. Customers who follow your page by its address alone are not listed (it is public).
Standards readiness
How far the controls you register and test already go toward the CSA AI Controls Matrix (AICM) and AIUC-1, through AutoGovern's mapping. Read only, for every member.
How it is worked out. Each AICM or AIUC-1 id is mapped to AutoGovern's anchor controls (NIST AI RMF, ISO/IEC 42001, EU AI Act). An anchor counts as met when a control registered against it (its framework and control id) on an active system last passed inside its evidence freshness window, and no control for it is failing (a failure is never hidden by a pass on another system). Ready: every mapped anchor is met and the mapping is full. Partly ready: some are met, or all are met but the mapping is partial. Gap: none are met. Not covered means our AI-governance anchors do not address that id (most cloud-infrastructure controls), not that your organization fails it. Pick the framework control a control satisfies under Satisfies framework control when you add it in the Workbench Controls Register (the Governance Autopilot's "create missing control" action and the API set it too). Missing anchors link to Workbench → AI Registry, where each system's Controls Register is.
The mapping is AutoGovern's own conservative analysis (two independent analysts; the lower strength was kept where they disagreed, marked "disputed"), not an official CSA or AIUC crosswalk. Full lists: AICM · AIUC-1.
Control and requirement IDs belong to the Cloud Security Alliance (AICM) and the Artificial Intelligence Underwriting Company (AIUC-1). Descriptions and mappings are AutoGovern's own; read the official standard for the requirement text. Official pages: AICM v1.1 · AIUC-1 · AIUC-1 standard.
Governance automation
Decide what the platform's agents may do on their own for your systems, review what they recommend, and set the policies your agents run under.
Automation level
Autopilot finds governance gaps on your registered systems; the Remediation Center finds risky agent and deployment patterns. At level 1 they only recommend. At level 2 or 3 they may apply a small set of reversible fixes on their own, after checking your active policies, and every one can be rolled back below. AutoGovern's platform switch caps your level.
Your governance brief
An email to you, from the agents, about this organization: reassessment alerts, what was recommended or applied automatically, regulatory changes that may affect your systems, deadlines, incidents and score changes. Off unless you turn it on, and it only arrives when something changed or is urgent. A short summary at the top may be drafted by a language model from the listed facts; any summary whose numbers don't match them is dropped.
Recommendations and actions
What the agents raised about your systems, assets and agents. Owners and admins approve, reject or roll back; every decision is recorded in your audit log.
Your Control Plane policies
Rules your registered agents are checked against before they act, and that the automation above must respect. Describe a rule in plain English, review the compiled version, and save it as a draft. A different owner or admin must approve it before it can be activated.
API access & audit
Manage workspace API keys and review account activity.
Governance API keys
Keys for the Governance API v1 — the external, product-agnostic contract your own agents/systems (or a platform like AgentRent) call to evaluate an action, seal it to the ledger, and mint a Trust Passport. Different from the AI Inventory agent keys above, which authenticate individual agents to this platform's Control Plane; a Governance API key authenticates your whole workspace to the versioned /api/v1 contract.
Audit log
Every sign-in and account action in your organization, most recent first.