Reference Architecture

BCOM Adaptive Governance Framework (AGF)

A vendor-neutral AI governance framework for Australian organisations — the operational governance model that turns ISO/IEC 42001 implementation, AI risk management and day-to-day AI oversight into repeatable behaviour, with or without enterprise tooling.

Explore the architecture Operational patterns

Specification v1.0 · Framework v2.2.0 · Last updated July 2026

Why AGF

Governance outlasts technology

Standards define what a management system must achieve. Vendors define how to configure their products. Neither defines how organisations translate governance principles into repeatable operational behaviour — regardless of which intelligent technology they adopt. The AGF is that bridge.

Technology enforces policy — it does not define policy

Whether your organisation runs Microsoft Purview, Google Workspace, or no DLP tooling at all, the governance rules remain identical. Technical controls strengthen governance; they never replace organisational accountability.

Only the technology layer changes

Microsoft Copilot governance today. Google, Anthropic or OpenAI enterprise controls tomorrow. Agentic and quantum-era systems after that. The governance and operational layers above them endure unchanged.

Built for Australian assurance

Aligned to ISO/IEC 42001, ISO 31000 and the NIST AI RMF, and mapped to the Australian Government's AI assurance expectations — including accountable officials and AI use-case registers.

The Architecture

The Five Bones

Five layers ordered by stability — enduring governance at the top, replaceable technology below. Select each bone to expand it.

AGF architecture diagram: five bones from enduring Governance to volatile Technology Controls, with the Evidence layer and the Bone 5 continual-improvement loop
Bone 1 Governance — the organisation decides
Why intelligent systems are used, who owns them, risk appetite, accountability and policy.
  • Maps to ISO/IEC 42001 clauses 4–6, ISO/IEC 38507 and the NIST AI RMF Govern function
  • In government settings, this is where accountable officials are designated
Bone 2 Operational Governance — how people actually work THE DIFFERENTIATOR
The eight vendor-neutral operational patterns (OP-01 to OP-08) that translate principle into repeatable behaviour: approvals, registers, tiered human review, escalation, data boundaries, drift review, controlled overrides and named decision authority.
  • This is the layer no standard fully specifies and no vendor provides
  • Maps to ISO/IEC 42001 clauses 7–8, ISO 31000 and NIST AI RMF Map/Manage
Bone 3 Technology Controls — replaceable by design
The current instantiation of control objectives in specific products: Microsoft Purview, DLP and sensitivity labels today; Google, Anthropic, OpenAI enterprise controls, agentic and quantum-era systems tomorrow.
  • Technology changes; control objectives remain
  • Maps to ISO/IEC 27001 Annex A, the Essential Eight and ISO/IEC 23894
Bone 4 Evidence — governance you can prove
Logs, monitoring, audit records, management review and assurance evidence — the material that satisfies ISO audits and government AI Impact Assessments.
  • Maps to ISO/IEC 42001 clause 9 and Australian Government assurance evidence requirements
Bone 5 Governance Intelligence — the framework learns
The continual-improvement lifecycle: Observe → Validate → Map → Decide → Version → Publish. New standards, policies and technologies are ranked by authority and mapped to the framework; every change passes a human-signed decision gate and is published with rationale and provenance.
  • Maps to ISO/IEC 42001 clause 10 (PDCA) — the framework applies continual improvement to itself
Bone 2 in Detail

The Eight Operational Patterns

Each pattern is a normative statement of required behaviour — instantiable with any vendor's tooling, or none.

OP-01

Use-Case Intake & Approval

No intelligent system enters operational use without a documented, risk-rated, approved use case. Prevents shadow AI.

OP-02

AI Register

One authoritative inventory of every AI use case — owner, risk rating, data boundary, review date. The spine everything attaches to.

OP-03

Tiered Human Review

AI proposes; a human disposes. Tier A: mandatory review before use. Tier B: sampled quality assurance. Tier C: logging and monitoring only.

OP-04

Escalation & Kill-Switch

A named Escalation Handler may suspend AI capability immediately where unacceptable risk is identified. Operational, not political — management reviews after, not before.

OP-05

Data Boundary Control

Only approved data classes reach each system. The rule survives the absence of tooling — enforced behaviourally where technical controls don't exist.

OP-06

Change & Drift Review

Model updates, vendor changes and scope creep re-enter governance instead of accumulating silently. Every register entry has a maximum review interval.

OP-07

Exception & Override

Not "no exceptions" — no undocumented exceptions. Every override is documented, named, justified, time-limited, reviewed and closed.

OP-08

Authority Matrix

Every gate names a role with the power to decide, up to an accountable executive. The cure for governance theatre.

Core Principles

Three principles anchor every implementation

P1 — Govern capabilities, not vendors

Control objectives are enduring; the technologies satisfying them are volatile. Only the technology layer changes as vendors come and go.

P2 — Governance effective regardless of tooling

Operational governance shall remain effective regardless of the technical controls available. Technology enforces policy; it does not define policy.

P3 — Governance proportionate to risk

Review, approval and monitoring effort scale with impact and autonomy. Uniform controls do not scale — and collapse in practice.

Architecture

Where the AGF sits

Five things are easy to blur, and they are kept apart on purpose: what may apply, Bcom's methodology, the platform, the service provider, and who decides.

LayerWhat it is
Sources of authorityThe standards, Australian law, regulator guidance, frameworks, contracts and the organisation's own policies that may apply. Held in the BcomOne Source of Authority Library. Which of them apply is decided organisation by organisation, never assumed
BCOM AGFBcom's own methodology, described on this page: the control objectives and evidence expectations an assessment is analysed against, and the method for any separate implementation engagement. It is not a standard, a law or a certification scheme
BcomOneThe platform that runs the investigation, holds the evidence and records the decisions
Bcom Services Pty LtdThe service provider. A BcomOne Assessment investigates and assesses, and its evidence-backed findings go into the Assessment Report. Implementation or remediation is a separate engagement, if you want it
Your organisationThe decision-maker. Findings are evidence-backed; the governance decisions are yours
Standards Alignment

Anchored to recognised standards

The AGF does not compete with standards or policy — it operationalises them. The table shows where each part of the methodology draws from. It is the AGF's design alignment, not the list an organisation is assessed against: that is the Source of Authority Library, applied only where each source applies (see how applicability works). If you are working out where to start, our guides cover how ISO/IEC 42001 differs from ISO/IEC 27001, ISO 42001 certification — process, timeline and cost, what an AI use policy should contain, and the AI impact assessment requirement facing Australian Government agencies and their suppliers.

AGF elementAligns to
Bone 1 · GovernanceISO/IEC 42001 (cl. 4–6) · ISO/IEC 38507 · NIST AI RMF (Govern)
Bone 2 · Operational GovernanceISO/IEC 42001 (cl. 7–8) · ISO 31000 · NIST AI RMF (Map / Manage)
Bone 3 · Technology ControlsISO/IEC 27001 Annex A · Essential Eight · ISO/IEC 23894
Bone 4 · EvidenceISO/IEC 42001 (cl. 9) · Australian Government AI assurance evidence
Bone 5 · Governance IntelligenceISO/IEC 42001 (cl. 10, PDCA) · NIST AI RMF (continuous Govern)
Whole frameworkPolicy for the Responsible Use of AI in Government v2.0 · Australia's 8 AI Ethics Principles
Implementation Journey

From first assessment to living management system

Every engagement follows the same governance-first sequence — the technology comes last, because it is the most replaceable part.

Governance
→
Operational governance
→
Technology controls
→
Evidence
→
Continual improvement
Version History

A framework under version control

The AGF is maintained as a controlled, versioned specification. Every change is published with rationale, provenance and a named approver.

v2.2.0 — July 2026

AGF Specification v1.0 published — the canonical definition all implementations follow. Official architecture diagram released.

v2.1.0 — July 2026

Bone 2 Operational Pattern Library (OP-01 to OP-08) ratified. Core principles P1–P3 elevated to the canonical framework.

v2.0.0 — July 2026

Framework established as a living, versioned governance system: five-bone architecture, six-tier evidence hierarchy, governance lifecycle.

Implement the framework

The AGF is delivered by Bcom — Australia's dedicated ISO/IEC 42001 AI governance specialist, with a BSI-certified Lead Implementer. From a first AI risk assessment to a full AI Management System.

Call 07 3041 8993 support@bcomservices.com