AURA 3.0: AI Use, Risk & Assurance

Complete Core Guide and Companion Bundle

Move from AI policy to operational proof.

Most organisations now have AI principles, policies or responsible-use statements. Far fewer can show how those expectations become accountable decisions, working controls, retained evidence, runtime intervention and assurance.

AURA 3.0 is a practical enterprise operating model for governing AI across its full lifecycle; from strategy and use-case discovery through delivery, release, live operation, incident response and external assurance.

The bundle combines the complete AURA operating model with three focused companion guides for executive communication, role-based implementation and enterprise-tool integration.

Policy is not proof. AURA defines the path to proof.

What is included

1. AURA 3.0 AI Op Model Guide

The core guide presents the complete AURA method through six connected operating layers:

• Strategy, Culture and Capability
• Governance
• Operationalisation
• Agentic Design and Boundaries
• Runtime Operations and Intervention
• External Assurance and Regulatory Engagement

One Nine-Step Operating Spine connects the layers:

Inventory → Risk Tiering → Accountability → Control Design → Delivery Governance → Release Gates → Runtime Monitoring → Incident Pathways → Assurance Reporting

The guide also includes:

• the Tier 0–5 AI risk model;
• the Assist–Augment–Automate–Agentic authority progression;
• seven evidence-based release gates;
• controls for agentic systems and non-human identities;
• testing, red-teaming and independent-verification principles;
• vendor, SaaS and shared-responsibility controls;
• runtime monitoring, intervention and recovery models;
• a first-90-days implementation pathway;
• a twelve-month roadmap;
• a Level 0–5 organisational maturity model;
• fourteen implementation epics and seventy-nine stories;
• working templates, checklists and reference material.
• 
  

2. Companion A: The Boardroom Q&A

A concise executive briefing built around the twelve questions most commonly asked by boards, CEOs, CFOs, CIOs and risk leaders.

It addresses:

• what implementation may cost;
• how long it may take;
• the consequences of doing nothing;
• how success should be measured;
• who owns the framework and individual use cases;
• capacity and headcount implications;
• how to build an honest value case;
• whether governance will slow delivery;
• how AURA works with existing standards and methods;
• how to govern procured and embedded AI;
• when an organisation should say no;
• what should be reported to the board.

Use it as executive pre-reading, a board-session leave-behind or a practical briefing aid when making the case for operational AI governance.

3. Companion B: Heavily Augmented Roles in AURA

A detailed role-based guide explaining how AI changes executive and practitioner work without automating people out of accountability.

It provides dedicated operating lenses for eleven principal roles:

• CEO
• COO
• CTO
• CIO
• CISO
• Head of AI
• Agile Lead
• Project Manager
• SecDevOps practitioner
• Tester
• Organisational Change Manager

Each role is mapped to the six AURA layers, the Nine-Step Spine, release gates, evidence responsibilities, runtime intervention, decision rights, first-90-days actions and maturity progression.

The companion helps organisations distinguish among:

• work performed by AI;
• human professional judgement;
• domain sign-off;
• hold and stop authority;
• residual-risk acceptance;
• independent assurance.
• 
  

4. Companion C: The Tools Layer

A practical guide to integrating AURA into the enterprise systems teams already use.

It shows how AURA can ripple into:

• portfolio and strategy platforms;
• delivery and backlog tools;
• IT service management and change systems;
• source control and CI/CD pipelines;
• testing and AI-evaluation platforms;
• GRC and integrated risk systems;
• monitoring and observability;
• identity and privileged-access systems;
• data-governance platforms;
• procurement and vendor-risk systems;
• collaboration and knowledge platforms;
• business-intelligence and executive-reporting tools.

The companion explains how to use a shared use-case identifier, authoritative information sources, workflow gates, evidence-event feeds and federated dashboards to create a traceable evidence chain without immediately purchasing another governance platform.

What this bundle helps you do

AURA gives organisations a structured way to:

• discover AI that is built, bought, embedded or used informally;
• classify use cases consistently and identify prohibited uses;
• assign named business, risk, control, operational and incident owners;
• convert policy and standards into executable controls;
• make governance part of normal delivery rather than a parallel bureaucracy;
• produce evidence during delivery and operation instead of reconstructing it before an audit;
• govern AI-generated code, models, prompts, agents, tools and non-human identities;
• define meaningful human oversight rather than ceremonial approval;
• test systems for behaviour, security, resilience, misuse and operational failure;
• constrain autonomous and agentic actions through explicit operating boundaries;
• monitor live systems and connect alerts to named intervention authority;
• manage incidents, rollback, containment and decommissioning;
• provide boards, customers, auditors and regulators with traceable assurance evidence;
• measure value after control, verification, change and operating costs are considered.
• 
  

Designed to work with what you already have

AURA is not intended to replace enterprise risk management, project delivery, Agile, SAFe, DevSecOps, business analysis, organisational change, architecture, cybersecurity, privacy, procurement, IT service management, GRC or internal audit.

It connects those disciplines through a common operating sequence, shared accountability and a traceable evidence chain.

It can be introduced initially through controlled documents and workbooks, then progressively integrated into existing delivery, ITSM, GRC, CI/CD, observability and reporting systems as operating practices mature.

Who this bundle is for

This bundle is designed for:

• board members and senior executives;
• AI governance and responsible-AI leaders;
• CIOs, CTOs, CISOs, COOs and Heads of AI;
• enterprise risk, compliance, privacy and legal teams;
• programme, project, product and Agile delivery leaders;
• enterprise and solution architects;
• developers, DevSecOps teams and platform engineers;
• testers, quality leaders and red-team practitioners;
• procurement and vendor-risk professionals;
• organisational change, workforce and capability leaders;
• internal auditors and assurance professionals;
• consultants helping organisations establish or assess AI governance.
• 
  

Practical rather than principles-only

AURA does not stop at statements such as “AI must be safe, transparent, fair and accountable.”

It asks the operational questions that follow:

• Which use cases exist?
• Who owns each one?
• What authority has been delegated to AI?
• Which controls are mandatory?
• Where are those controls implemented?
• What evidence do they generate?
• Who verifies that evidence?
• Who can approve, hold, stop or withdraw approval?
• How is the system monitored after release?
• What happens when the model, vendor, data, prompt or operating context changes?
• Can an independent reviewer trace the decision without relying on verbal explanation?

That is the difference between having an AI policy and operating a governable AI capability.