Governance
The AI IR Overlay is open, vendor-neutral, and Apache 2.0 licensed. This document defines how decisions get made today and how governance will change as the project matures.
Project status
This is a pre-1.0 project with governance maturation in progress. Current scale:
- Lead Maintainer: Jacob Ideji (founder, original author, primary decision-maker)
- Steering Committee: founding cohort formation in progress. Two external members seated: Chukwunenye Amadi (joined at v0.34.0) and Dr. Willy Takang (joined at v0.35.0). Target: 5 members total (Founding Maintainer + 4 external). See
CONTRIBUTORS.mdfor full bios and personal-capacity disclosures. - External contributors: first external contributions in preparation. Both Chukwunenye Amadi and Dr. Willy Takang have contribution artifacts in review for upcoming v0.34.x / v0.35.x / v0.36.x releases, including a new playbook, a new reference implementation, and the framework’s first documented production-incident anonymized case study.
- Working Group Leads, certification program: not yet established. These multi-party governance structures described below under “Future governance (v1.0.0 and beyond)” will be convened as v1.0.0 readiness criteria are met and community adoption justifies the structure.
The framework’s roadmap to v1.0.0 is documented in CHANGELOG.md [Unreleased] and CONTENT_MAP.md.
Current governance (v0.x)
Roles
- Lead Maintainer (Jacob Ideji): founder, original author, primary decision-maker during v0.x. Owns the trademark and certification mark (see LICENSE). Holds final authority during the
v0.xseries. -
Steering Committee: guides the v1.0.0 arc, reviews major release proposals, and shapes external contribution acceptance. The founding cohort is currently being seated; the framework’s target is 5 members (Founding Maintainer + 4 external members). Sustained membership above 7 is not anticipated during the v1.x series. Current Steering Committee members (as of v0.34.0):
- Chukwunenye Amadi (joined at v0.34.0). See
CONTRIBUTORS.mdfor full bio and personal-capacity disclosure. - Dr. Willy Takang (joined at v0.35.0). See
CONTRIBUTORS.mdfor full bio and personal-capacity disclosure.
- Chukwunenye Amadi (joined at v0.34.0). See
- Contributors: anyone, via Pull Request. Substantive contributors are credited in release notes and in
CONTRIBUTORS.md(introduced in v0.32.0). External contributors are listed under “External Contributors” on first merged PR per the recognition discipline.
Decision-making
- During v0.x with founding cohort forming: Lead Maintainer decides on all matters and retains final authority per the trademark ownership described elsewhere in this document. Steering Committee members provide advisory input on major release proposals and external contribution acceptance via asynchronous review. The 3-member threshold (Lead Maintainer + 2 or more external Steering Committee members) was reached at v0.35.0 with the seating of Dr. Willy Takang; the Steering Committee may hold structured advisory votes on matters the Lead Maintainer refers going forward. Formal voting discipline binding the Lead Maintainer activates only at v1.0.0 per the Future governance section below.
- Changes to the
framework/directory or the six-question card get a 5-day public comment window. - Everything else (playbooks, crosswalks, templates, schemas) runs on lazy consensus: silence after 5 days of public visibility counts as approval.
Release cadence
| Cadence | Type | Approver |
|---|---|---|
| Per content drop (v0.x) | MINOR (0.x.0) |
Lead Maintainer |
| As warranted | PATCH (0.x.y) |
Lead Maintainer |
Amendments to this document
During v0.x: Lead Maintainer decides after a 14-day public comment window.
Future governance (v1.0.0 and beyond)
The following structures will be convened only if the project reaches v1.0.0 with sustained external community engagement. None of these structures exist today.
Planned: Steering Committee (target: 5 seats)
- Would be convened at
v1.0.0. - Composition target:
- 2 sitting CISOs (one Fortune 500, one mid-market or public sector)
- 1 academic or research representative
- 1 regulator-adjacent voice (former NIST, former CISA, or equivalent abroad)
- 1 international representative (EU, UK, APAC, or Africa)
- 2-year staggered terms. Reappointment by Committee vote.
- A public conflict-of-interest register would be published quarterly. Members would disclose vendor employment and material stock holdings, and recuse from votes that materially benefit their employer.
Planned: Working Group Leads
- Would be appointed one per crosswalk (NIST AI RMF, NIST CSF 2.0, EU AI Act, ISO/IEC 42001, OWASP Top 10 Agentic) once contributors emerge to lead each.
- Would be authorized to merge PRs within scope.
Planned: Decision-making at v1.0.0 and beyond
- Steering Committee would operate by lazy consensus with a 5-day comment window.
- Breaking changes (anything that invalidates a conformance claim) would require:
- A written RFC in
rfcs/ - A 30-day public comment window
- Two-thirds Committee approval
- A major version bump
- A written RFC in
Planned: Release cadence at v1.0.0 and beyond
| Cadence | Type | Approver |
|---|---|---|
| Quarterly | MINOR (1.x.0) |
Lead Maintainer |
| As warranted | PATCH (1.x.y) |
Working Group Lead |
| Roughly annual | MAJOR (x.0.0) |
Steering Committee |
Major versions would only be justified by external-ecosystem shifts. Examples: a future NIST AI Agent Interoperability Profile, an EU AI Act Article 26 update, an OWASP Agentic Top 10 revision.
Planned: Certification program
The AI IR Overlay Certified™ mark exists as a defensive registration to reserve the framework’s brand. The certification program itself does not yet exist. When the program is built (target: with v1.0.0), it will be documented in a separate charter at certification/charter.md and will cover:
- Conformant Implementations
- Certified Practitioner
Until then, the mark is reserved for the maintainer’s future use; no third party is currently authorized to claim certification under it.
Planned: Amendments at v1.0.0 and beyond
From v1.0 onward: Steering Committee two-thirds vote after a 30-day public comment window.
Trademark
- AI IR Overlay™: unregistered word mark held by the Lead Maintainer.
- AI IR Overlay Certified™: unregistered word mark held by the Lead Maintainer, reserved for the future certification program.
- Free use covers education, advocacy, academic citation, and conformant non-commercial implementations.
- Commercial use requires contact via jacobideji.com.
Code of Conduct
This project adopts the Contributor Covenant v2.1. See CODE_OF_CONDUCT.md.
Security disclosures
For vulnerabilities, follow the private reporting path in SECURITY.md.