{ "name": "Santiago Santa María Morales — EUREKA", "description": "Ideas, talks and analysis on applied AI, agentic AI, robotics, business and technology to improve organizations and lives.", "url": "https://santismm.com", "updated": "2026-08-01T23:51:28.919Z", "languages": [ "en", "es", "pt" ], "author": { "name": "Santiago Santa María Morales", "jobTitle": "Head of AI Forward Deployed Engineers, LATAM", "sameAs": [ "https://www.linkedin.com/in/santismm", "https://github.com/santismm", "https://medium.com/@santismm", "https://www.youtube.com/@santismorales", "https://x.com/santismorales" ] }, "topics": [ "Agentic AI", "Enterprise AI", "Harness Engineering", "AI Governance", "AI Architecture", "AI Evaluation" ], "discovery": { "llms_txt": "https://santismm.com/llms.txt", "llms_full_txt": "https://santismm.com/llms-full.txt", "sitemap": "https://santismm.com/sitemap.xml", "rss": "https://santismm.com/feed.xml", "json_feed": "https://santismm.com/feed.json" }, "api": { "handbook": "https://santismm.com/api/handbook", "handbook_unit": "https://santismm.com/api/handbook/{id}", "knowledge": "https://santismm.com/api/knowledge", "knowledge_entry": "https://santismm.com/api/knowledge/{slug}", "patterns": "https://santismm.com/api/patterns", "pattern_entry": "https://santismm.com/api/patterns/{slug}", "architectures": "https://santismm.com/api/architectures", "architecture_entry": "https://santismm.com/api/architectures/{slug}", "governance": "https://santismm.com/api/governance", "governance_entry": "https://santismm.com/api/governance/{slug}", "graph": "https://santismm.com/api/graph.json", "agent_taxonomy": "https://santismm.com/api/agent-taxonomy.json" }, "mcp": { "name": "santismm-knowledge", "version": "0.2.0", "description": "Model Context Protocol server for native agent access to the knowledge base, patterns, reference architectures and governance. Reads the same content as this site.", "endpoint": "https://santismm.com/mcp", "transport": "streamable-http", "docs": "https://santismm.com/en/mcp", "manifest": "https://santismm.com/.well-known/mcp/server.json", "tools": [ { "name": "get_overview", "description": "Get the corpus map — start here. Returns every domain (knowledge, patterns, architectures, governance and the Harness Engineering Handbook) with what it holds, the categories inside it, which tool retrieves a unit and what identifier that tool expects, plus the languages, licence and bulk-ingest URLs. One call is enough to know exactly where to go next." }, { "name": "list_knowledge", "description": "List all knowledge units (concepts on agentic & enterprise AI) with slug, category, title, summary and Evidence-First provenance." }, { "name": "get_knowledge", "description": "Get one knowledge unit by slug. Returns the full entry, or a single-locale body if locale is given." }, { "name": "list_patterns", "description": "List all Enterprise AI patterns (reusable agentic design patterns) with slug, category, name, summary and provenance." }, { "name": "get_pattern", "description": "Get one Enterprise AI pattern by slug (includes problem, solution, KPIs, failure modes, lessons)." }, { "name": "list_architectures", "description": "List all reference architectures (end-to-end enterprise agentic blueprints) with id, slug, category, name, summary and provenance." }, { "name": "get_architecture", "description": "Get one reference architecture by slug (includes the request flow, reference scenario, KPIs, cost & scaling, and the patterns/knowledge it composes)." }, { "name": "list_governance", "description": "List all AI governance units (regulations, standards, frameworks, playbooks — EU AI Act, ISO 42001, NIST AI RMF, agentic checklist) with id, slug, category, name and summary." }, { "name": "get_governance", "description": "Get one AI governance unit by slug (includes scope, key requirements, implementable controls, a checklist and common pitfalls)." }, { "name": "list_handbook", "description": "List the Harness Engineering Handbook chapters (HRN-001…): the canonical long-form corpus on harness engineering — definition, history, taxonomy, principles, memory, observability, evaluation, governance, planning, orchestration, security, case studies, glossary and bibliography." }, { "name": "get_handbook", "description": "Get one Harness Engineering Handbook chapter, by id (e.g. 'HRN-001') or slug. Returns the full Markdown body plus its provenance and related ids." }, { "name": "search", "description": "Ranked keyword search across the whole corpus (knowledge, patterns, architectures, governance and the handbook). Matches every language and ignores accents, so query in the user's own words. Each hit carries a relevance score and the fields it matched; follow up with the matching get_* tool for full detail." }, { "name": "get_related", "description": "Traverse the knowledge graph: given a unit, return its neighbours — the units it links to (outgoing) and the units that reference it (incoming), each with the relationship type." } ] }, "agent_skill": { "name": "design-agentic-systems-with-santismm", "description": "Portable Agent Skill (Anthropic format): the procedure for querying this corpus over MCP and turning it into grounded, citable deliverables — architectures, design reviews, governance checklists, comparisons.", "manifest": "https://santismm.com/skill.json", "files": { "skill": "https://santismm.com/skill/skill.md", "reference": "https://santismm.com/skill/reference.md" } }, "harness_handbook": { "url": "https://santismm.com/en/handbook", "count": 14, "entries": [ { "id": "HRN-001", "slug": "definition-and-overview", "title": "Harness Engineering: Definition and Overview", "summary": "Harness Engineering is the discipline of building reliable agentic systems for enterprise environments — the engineered scaffolding of memory, tools, orchestration, observability, evaluation, governance, and security that surrounds the model.", "category": "Foundations", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "HRN-002", "HRN-003", "HRN-004" ], "url": "https://santismm.com/en/handbook/definition-and-overview", "api": "https://santismm.com/api/handbook/HRN-001" }, { "id": "HRN-002", "slug": "a-brief-history-of-harness-engineering", "title": "A Brief History of Harness Engineering", "summary": "How the field moved from prompt engineering to tool use to agents to harnesses, and why the engineered scaffolding around the model became its own discipline.", "category": "Foundations", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "HRN-001", "HRN-003" ], "url": "https://santismm.com/en/handbook/a-brief-history-of-harness-engineering", "api": "https://santismm.com/api/handbook/HRN-002" }, { "id": "HRN-003", "slug": "the-harness-taxonomy", "title": "The Harness Taxonomy", "summary": "A structured taxonomy of the harness — memory, tools, planning, orchestration, observability, evaluation, governance, and security — naming each component, its responsibility, and how the parts compose into a reliable agentic system.", "category": "Foundations", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "HRN-001", "HRN-005", "HRN-006", "HRN-009", "HRN-010" ], "url": "https://santismm.com/en/handbook/the-harness-taxonomy", "api": "https://santismm.com/api/handbook/HRN-003" }, { "id": "HRN-004", "slug": "harness-engineering-principles", "title": "Harness Engineering Principles", "summary": "The core engineering principles of the harness — reliability over capability, determinism boundaries, observability-first, evidence-first, defense in depth, least authority, graceful degradation, and idempotent actuation — that hold across every component.", "category": "Foundations", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "HRN-001", "HRN-003" ], "url": "https://santismm.com/en/handbook/harness-engineering-principles", "api": "https://santismm.com/api/handbook/HRN-004" }, { "id": "HRN-005", "slug": "memory-in-agentic-systems", "title": "Memory in Agentic Systems", "summary": "How the harness governs what the model sees and remembers — working, short-term, and long-term memory; the context window as a budget; retrieval, compression, and deliberate forgetting.", "category": "Memory", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "HRN-003", "PAT-004", "PAT-006" ], "url": "https://santismm.com/en/handbook/memory-in-agentic-systems", "api": "https://santismm.com/api/handbook/HRN-005" }, { "id": "HRN-006", "slug": "observability-for-agentic-systems", "title": "Observability for Agentic Systems", "summary": "How to make a non-deterministic, multi-step agent inspectable — traces and spans, token and cost accounting, evaluation hooks, and deterministic replay — so the system can be debugged, measured, and trusted.", "category": "Observability", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "HRN-003", "HRN-007" ], "url": "https://santismm.com/en/handbook/observability-for-agentic-systems", "api": "https://santismm.com/api/handbook/HRN-006" }, { "id": "HRN-007", "slug": "evaluation-of-agentic-systems", "title": "Evaluation of Agentic Systems", "summary": "How to measure whether an agent is actually good and getting better — offline and online evaluation, golden sets, LLM-as-judge, regression suites, and task-completion metrics — turning agent development from craft into engineering.", "category": "Evaluation", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "HRN-006", "PAT-009", "PAT-015" ], "url": "https://santismm.com/en/handbook/evaluation-of-agentic-systems", "api": "https://santismm.com/api/handbook/HRN-007" }, { "id": "HRN-008", "slug": "governance-within-the-harness", "title": "Governance within the Harness", "summary": "Governance is an engineered harness layer that enforces policy, approvals, and guardrails at runtime, turning enterprise AI obligations into executable controls that gate every agent action.", "category": "Governance", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "HRN-003", "GOV-001", "PAT-001" ], "url": "https://santismm.com/en/handbook/governance-within-the-harness", "api": "https://santismm.com/api/handbook/HRN-008" }, { "id": "HRN-009", "slug": "planning-and-goal-management", "title": "Planning and Goal Management", "summary": "Planning and goal management is the harness layer that decomposes goals into executable plans, represents and tracks plan state, and replans under failure, making agent autonomy directed rather than reactive.", "category": "Planning", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "HRN-003", "HRN-010", "PAT-010" ], "url": "https://santismm.com/en/handbook/planning-and-goal-management", "api": "https://santismm.com/api/handbook/HRN-009" }, { "id": "HRN-010", "slug": "orchestration", "title": "Orchestration", "summary": "Orchestration is the harness layer that drives execution—single vs multi-agent topologies, supervisor/worker delegation, routing, state machines, and durable workflows—turning a plan into reliable, resumable action.", "category": "Orchestration", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "HRN-003", "HRN-009", "PAT-002", "PAT-005" ], "url": "https://santismm.com/en/handbook/orchestration", "api": "https://santismm.com/api/handbook/HRN-010" }, { "id": "HRN-011", "slug": "security-for-agentic-systems", "title": "Security for Agentic Systems", "summary": "Security for agentic systems is the harness layer that defends against prompt injection, sandboxes tools and permissions, prevents data exfiltration, and enforces agent identity and least privilege across every action.", "category": "Security", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "HRN-003", "GOV-001", "PAT-007" ], "url": "https://santismm.com/en/handbook/security-for-agentic-systems", "api": "https://santismm.com/api/handbook/HRN-011" }, { "id": "HRN-012", "slug": "case-studies-in-harness-engineering", "title": "Case Studies in Harness Engineering", "summary": "Three representative, anonymized composite case studies showing how harness layers—memory, planning, orchestration, governance, security, observability—combine end-to-end to make enterprise agents reliable.", "category": "Case Studies", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "related": [ "ARCH-001", "ARCH-002", "HRN-001" ], "url": "https://santismm.com/en/handbook/case-studies-in-harness-engineering", "api": "https://santismm.com/api/handbook/HRN-012" }, { "id": "HRN-013", "slug": "glossary", "title": "Glossary", "summary": "A canonical glossary of Harness Engineering and agentic-systems terminology—harness, agent, tool, orchestration, evaluation, span, RAG, MCP, guardrail, and more—with crisp, citable definitions.", "category": "Reference", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "high", "sourceType": [ "industry_observation" ] }, "related": [ "HRN-001" ], "url": "https://santismm.com/en/handbook/glossary", "api": "https://santismm.com/api/handbook/HRN-013" }, { "id": "HRN-014", "slug": "bibliography", "title": "Bibliography", "summary": "A curated, themed reading list for Harness Engineering—agents and orchestration, evaluation, security, governance and standards, and protocols—covering foundational papers, industry writeups, and regulatory frameworks.", "category": "Reference", "status": "Draft", "updated": "2026-06-21", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "related": [ "HRN-001", "GOV-001" ], "url": "https://santismm.com/en/handbook/bibliography", "api": "https://santismm.com/api/handbook/HRN-014" } ] }, "knowledge_base": { "url": "https://santismm.com/en/knowledge", "count": 20, "entries": [ { "slug": "agent-memory", "title": "What are Agent Memory Systems?", "definition": "Agent memory is the set of mechanisms an AI agent uses to store, organize and retrieve information beyond its immediate context window, spanning short-term working memory and long-term persistent memory.", "summary": "Agent memory is how an AI agent retains and recalls information beyond a single context window — across steps, sessions and tasks. It typically separates short-term working memory (the current context) from long-term memory (durable stores the agent reads from and writes to). Memory is what lets an agent carry state through a long task, remember a user over time, and avoid repeating work. It is a core layer of harness engineering.", "category": "harness", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/knowledge/agent-memory", "api": "https://santismm.com/api/knowledge/agent-memory" }, { "slug": "agentic-ai", "title": "What is Agentic AI?", "definition": "Agentic AI is the class of AI systems that autonomously plan and execute multi-step tasks by combining a model with memory, tools and a control loop.", "summary": "Agentic AI refers to systems that pursue goals over multiple steps — planning, calling tools, acting on an environment and reacting to feedback — instead of producing a single response. It turns a language model from a text generator into an actor that can complete tasks. The shift it represents is from do-it-yourself software, where the human drives every step, to do-it-for-me software, where the system carries out the work and reports back.", "category": "concept", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/knowledge/agentic-ai", "api": "https://santismm.com/api/knowledge/agentic-ai" }, { "slug": "agentic-evaluation", "title": "What is Agentic AI Evaluation?", "definition": "Agentic evaluation is the measurement of an AI agent's end-to-end task performance — success rate, reliability, cost and safety — on realistic, multi-step tasks in an environment.", "summary": "Agentic AI evaluation is the practice of measuring how well an agent completes multi-step, tool-using tasks in an environment — not just the quality of a single answer. As models saturate static knowledge benchmarks, evaluation is shifting from measuring capability (what a model knows) to measuring agency (what a system can actually get done). Good evals are the feedback loop that makes harness engineering possible.", "category": "concept", "updated": "2026-06-24", "version": "1.1", "evidence": { "evidenceLevel": "production", "confidenceLevel": "medium", "sourceType": [ "production_system", "personal_experience", "industry_observation", "paper" ] }, "url": "https://santismm.com/en/knowledge/agentic-evaluation", "api": "https://santismm.com/api/knowledge/agentic-evaluation" }, { "slug": "ai-agent", "title": "What is an AI Agent?", "definition": "An AI agent is a system that pairs a reasoning model with tools, memory and an orchestration loop so it can plan and act over multiple steps to achieve a goal.", "summary": "An AI agent is a system that combines a model with tools, memory and a control loop to take actions toward a goal, rather than just answering a single prompt. It perceives a situation, decides what to do, acts through tools, observes the result and repeats until done. Autonomy ranges from a single tool call to long-horizon execution of complex tasks.", "category": "concept", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/knowledge/ai-agent", "api": "https://santismm.com/api/knowledge/ai-agent" }, { "slug": "ai-governance", "title": "What is AI Governance?", "definition": "AI governance is the framework of policies, processes, roles and controls an organization uses to manage AI risk and ensure AI systems are responsible, compliant, secure and accountable across their lifecycle.", "summary": "AI governance is the set of policies, processes, roles and controls that ensure AI is built and used responsibly, legally and safely. It spans risk management, accountability, transparency, security and compliance across the AI lifecycle. In practice it operationalizes recognized frameworks — the EU AI Act, the NIST AI Risk Management Framework and ISO/IEC 42001 — into concrete controls an organization can implement, evidence and audit.", "category": "governance", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "paper", "industry_observation" ] }, "url": "https://santismm.com/en/knowledge/ai-governance", "api": "https://santismm.com/api/knowledge/ai-governance" }, { "slug": "ai-observability", "title": "What is AI Agent Observability?", "definition": "AI observability is the practice of capturing traces, metrics and logs of an AI system's behavior — every prompt, tool call, retrieval, output, token, latency and cost — so its decisions can be understood, debugged and improved.", "summary": "AI observability is the practice of instrumenting AI systems — especially agents — so you can see what they did and why. It captures traces of each step: prompts, tool calls, retrieved context, model outputs, tokens, latency and cost. Because agents are non-deterministic and multi-step, observability is what makes failures diagnosable and improvement systematic. It is the layer that feeds evaluation and closes the harness-engineering loop.", "category": "harness", "updated": "2026-06-24", "version": "1.1", "evidence": { "evidenceLevel": "production", "confidenceLevel": "medium", "sourceType": [ "production_system", "personal_experience", "industry_observation" ] }, "url": "https://santismm.com/en/knowledge/ai-observability", "api": "https://santismm.com/api/knowledge/ai-observability" }, { "slug": "context-engineering", "title": "What is Context Engineering?", "definition": "Context engineering is the practice of curating, compressing and sequencing the information placed in a model's context window so it has the most relevant signal — and the least noise — at each step.", "summary": "Context engineering is the discipline of deciding what information enters a model's limited context window at each step — and what stays out. As agents run over many steps, naively stuffing everything into context degrades quality and cost. Context engineering curates the right instructions, retrieved knowledge, tool results and memory so the model has exactly what it needs, when it needs it. It is a core part of harness engineering.", "category": "harness", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/knowledge/context-engineering", "api": "https://santismm.com/api/knowledge/context-engineering" }, { "slug": "embeddings", "title": "What are Embeddings & Vector Search?", "definition": "An embedding is a dense numeric vector that encodes the meaning of a piece of data, positioned so that similar items are close in vector space; vector search retrieves the nearest embeddings to a query.", "summary": "An embedding is a numeric vector that represents the meaning of text (or images, audio, code) so that semantically similar items sit close together in vector space. Vector search finds the nearest embeddings to a query, enabling search by meaning rather than keywords. Embeddings are the backbone of retrieval-augmented generation, semantic search, clustering and recommendation.", "category": "concept", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "benchmark", "confidenceLevel": "high", "sourceType": [ "benchmark", "paper" ] }, "url": "https://santismm.com/en/knowledge/embeddings", "api": "https://santismm.com/api/knowledge/embeddings" }, { "slug": "enterprise-rag", "title": "What is Enterprise RAG?", "definition": "Enterprise RAG is a pattern that retrieves relevant passages from an organization's governed knowledge sources and supplies them to a model as context, so answers are grounded, current and citable.", "summary": "Enterprise RAG (retrieval-augmented generation) is the pattern of grounding a model's answers in an organization's own documents, retrieved at query time, instead of relying on the model's parametric memory. It lets a company use private, current and governed knowledge — policies, manuals, tickets, contracts — without retraining a model, while keeping access control, citations and auditability that enterprises require.", "category": "pattern", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "benchmark", "confidenceLevel": "high", "sourceType": [ "benchmark", "paper", "industry_observation" ] }, "url": "https://santismm.com/en/knowledge/enterprise-rag", "api": "https://santismm.com/api/knowledge/enterprise-rag" }, { "slug": "fine-tuning", "title": "What is Fine-tuning?", "definition": "Fine-tuning is the process of further training a pretrained model on a focused dataset to adapt its weights toward a specific behavior, style, format or domain.", "summary": "Fine-tuning continues training a pretrained model on a smaller, targeted dataset to specialize its behavior, style or domain knowledge. It is far cheaper than pretraining and changes the model's weights — unlike prompting or retrieval, which leave the model unchanged. Use it to lock in a consistent format, tone or skill; use retrieval instead when you need fresh or private facts.", "category": "concept", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "benchmark", "confidenceLevel": "high", "sourceType": [ "benchmark", "paper" ] }, "url": "https://santismm.com/en/knowledge/fine-tuning", "api": "https://santismm.com/api/knowledge/fine-tuning" }, { "slug": "foundation-models", "title": "What are Foundation Models?", "definition": "A foundation model is a large, general-purpose model pretrained on broad data that serves as a base which can be adapted — via prompting, retrieval or fine-tuning — to many downstream tasks.", "summary": "A foundation model is a large model pretrained on broad data at scale that can be adapted to a wide range of downstream tasks. Large language models (LLMs) and large multimodal models are the canonical examples. The term, coined at Stanford in 2021, captures a shift: instead of training a bespoke model per task, organizations build on a shared, general-purpose base — then specialize it through prompting, retrieval or fine-tuning.", "category": "concept", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "benchmark", "confidenceLevel": "high", "sourceType": [ "benchmark", "paper" ] }, "url": "https://santismm.com/en/knowledge/foundation-models", "api": "https://santismm.com/api/knowledge/foundation-models" }, { "slug": "guardrails", "title": "What are AI Guardrails?", "definition": "AI guardrails are runtime safeguards that validate, filter or constrain a model's inputs, outputs and actions to keep its behavior safe, compliant and within defined policy.", "summary": "Guardrails are runtime controls that constrain what goes into and comes out of an AI system, keeping its behavior safe, on-policy and compliant. They check and filter inputs and outputs, validate tool actions, block disallowed content and enforce limits — sitting around the model as a safety layer. Guardrails are a primary, operational control in AI governance and a key defense against misuse and prompt injection.", "category": "governance", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/knowledge/guardrails", "api": "https://santismm.com/api/knowledge/guardrails" }, { "slug": "harness-engineering", "title": "What is Harness Engineering?", "definition": "Harness engineering is the practice of designing, building and optimizing the scaffolding (tools, memory, prompts, environment and control loop) that turns a model's raw capability into reliable, goal-directed action.", "summary": "Harness engineering is the discipline of designing and optimizing the scaffolding around an AI model — the prompts, tools, memory, environment, control loop and guardrails — so the model performs reliably on real tasks. Its core premise: as base models converge in raw capability, competitive advantage shifts from the model itself to the harness built around it. The same model can pass or fail a task depending almost entirely on its harness.", "category": "harness", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "theoretical", "confidenceLevel": "medium", "sourceType": [ "personal_experience", "industry_observation" ] }, "url": "https://santismm.com/en/knowledge/harness-engineering", "api": "https://santismm.com/api/knowledge/harness-engineering" }, { "slug": "human-in-the-loop", "title": "What is the Human-in-the-Loop Pattern?", "definition": "Human-in-the-loop is a pattern in which a human reviews, approves, edits or rejects an AI system's proposed output or action before it is executed, inserting human judgment at defined decision points.", "summary": "Human-in-the-loop (HITL) is a design pattern where a person reviews, approves or corrects an AI system's output before it takes effect — especially for high-impact actions. Instead of full autonomy, the agent proposes and a human disposes. It is a primary control for managing risk in agentic systems and a recurring requirement in AI governance frameworks like the EU AI Act and NIST AI RMF.", "category": "pattern", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/knowledge/human-in-the-loop", "api": "https://santismm.com/api/knowledge/human-in-the-loop" }, { "slug": "model-context-protocol", "title": "What is the Model Context Protocol (MCP)?", "definition": "MCP is an open protocol that standardizes how AI applications provide tools, resources and context to models through a common client–server interface.", "summary": "The Model Context Protocol (MCP) is an open standard for connecting AI models and agents to external tools, data sources and systems through a single, uniform interface. Introduced by Anthropic in late 2024, it standardizes how an application exposes context and capabilities to a model — acting like a universal adapter so any compliant client can talk to any compliant server.", "category": "concept", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation" ] }, "url": "https://santismm.com/en/knowledge/model-context-protocol", "api": "https://santismm.com/api/knowledge/model-context-protocol" }, { "slug": "multi-agent-architecture", "title": "What is a Multi-Agent Architecture?", "definition": "A multi-agent architecture is a system design in which multiple specialized AI agents coordinate — through an orchestrator, a pipeline or peer interaction — to accomplish a task that is decomposed across them.", "summary": "A multi-agent architecture divides a task among several specialized agents that collaborate, delegate or compete to reach a goal, instead of relying on one general agent. Common shapes include an orchestrator that delegates to workers, pipelines where each agent owns a stage, and debate or critic patterns. It can improve modularity and reliability for complex tasks, but adds coordination overhead and should be adopted only when a single agent demonstrably falls short.", "category": "architecture", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/knowledge/multi-agent-architecture", "api": "https://santismm.com/api/knowledge/multi-agent-architecture" }, { "slug": "prompt-engineering", "title": "What is Prompt Engineering?", "definition": "Prompt engineering is the practice of designing and refining the instructions, context and examples given to a language model to reliably elicit a desired output.", "summary": "Prompt engineering is the practice of designing the inputs given to a language model so it produces the desired output reliably. A good prompt specifies the role, the task, the constraints, the output format and, when useful, examples. It is the most accessible lever for steering model behavior — and one layer of the broader harness around a model — but on its own it does not make a system reliable at scale.", "category": "concept", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "benchmark", "confidenceLevel": "high", "sourceType": [ "benchmark", "paper", "industry_observation" ] }, "url": "https://santismm.com/en/knowledge/prompt-engineering", "api": "https://santismm.com/api/knowledge/prompt-engineering" }, { "slug": "prompt-injection", "title": "What is Prompt Injection?", "definition": "Prompt injection is a security attack where adversarial instructions embedded in untrusted input cause a language model to deviate from its intended behavior, bypass safeguards, or perform unintended actions.", "summary": "Prompt injection is an attack in which malicious instructions hidden in the input to a language model hijack its behavior — making it ignore its rules, leak data or misuse tools. It tops the OWASP Top 10 for LLM applications. The root cause is that models cannot reliably separate trusted instructions from untrusted content, so any text an agent reads — a web page, a document, a tool result — can carry an attack.", "category": "governance", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/knowledge/prompt-injection", "api": "https://santismm.com/api/knowledge/prompt-injection" }, { "slug": "reasoning-models", "title": "What are Reasoning Models?", "definition": "Reasoning models are language models optimized to perform extended step-by-step reasoning at inference time — using additional test-time compute — to improve accuracy on complex, multi-step problems.", "summary": "Reasoning models are language models trained to spend extra computation 'thinking' before they answer — generating internal reasoning steps to solve harder problems in math, code and logic. They trade latency and cost for accuracy on complex, multi-step tasks. The key idea is test-time compute: letting a model reason longer at inference, rather than only making the model bigger, can substantially improve results.", "category": "concept", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "benchmark", "confidenceLevel": "high", "sourceType": [ "benchmark", "paper" ] }, "url": "https://santismm.com/en/knowledge/reasoning-models", "api": "https://santismm.com/api/knowledge/reasoning-models" }, { "slug": "tool-use", "title": "What is Tool Use (Function Calling)?", "definition": "Tool use (function calling) is the capability that lets a language model call predefined external functions or APIs, with arguments it generates, and incorporate the results into its response or next step.", "summary": "Tool use, also called function calling, lets a language model invoke external functions, APIs or code to fetch information or take actions in the real world. The model decides which tool to call and with what arguments; the application runs the tool and returns the result, which the model uses to continue. Tool use is the bridge that turns a text generator into an agent that can actually do things.", "category": "concept", "updated": "2026-06-24", "version": "1.1", "evidence": { "evidenceLevel": "production", "confidenceLevel": "medium", "sourceType": [ "production_system", "personal_experience", "industry_observation", "paper" ] }, "url": "https://santismm.com/en/knowledge/tool-use", "api": "https://santismm.com/api/knowledge/tool-use" } ] }, "patterns_library": { "url": "https://santismm.com/en/patterns", "count": 15, "entries": [ { "slug": "context-compression", "name": "Context Compression", "summary": "Context compression reduces the tokens fed to a model on each call while preserving the information it actually needs to act. Use it on long-running agents and long conversations to cut cost and latency and to stay inside the context window. The three levers are summarizing history, pruning irrelevant context, and compressing prompts. The central risk is lossy: dropping the one detail that mattered. Measure information retained, not just tokens saved.", "category": "cost", "updated": "2026-06-24", "version": "1.1", "evidence": { "evidenceLevel": "production", "confidenceLevel": "low", "sourceType": [ "production_system", "personal_experience", "industry_observation" ] }, "url": "https://santismm.com/en/patterns/context-compression", "api": "https://santismm.com/api/patterns/context-compression" }, { "slug": "evaluator-optimizer", "name": "Evaluator-Optimizer", "summary": "One LLM generates a response while a second LLM evaluates it against criteria and returns feedback; the generator revises and the loop repeats until the evaluation passes. It raises quality on tasks with clear evaluation criteria, at the cost of extra calls.", "category": "reliability", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/patterns/evaluator-optimizer", "api": "https://santismm.com/api/patterns/evaluator-optimizer" }, { "slug": "goal-decomposition", "name": "Goal Decomposition", "summary": "Goal decomposition has an agent break a high-level goal into an ordered set of smaller, tractable sub-tasks — a plan — before acting, then execute and monitor that plan, re-planning when steps fail. The explicit plan becomes an inspectable artifact you can review, gate, and debug. Use it when a goal needs several dependent steps and reactive, step-at-a-time agents drift or stall; skip it for simple, single-shot tasks.", "category": "orchestration", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/patterns/goal-decomposition", "api": "https://santismm.com/api/patterns/goal-decomposition" }, { "slug": "human-approval-gate", "name": "Human Approval Gate", "summary": "A human approval gate pauses an automated workflow at a defined checkpoint so a person can review, edit or reject a proposed action before it executes — especially for high-impact, irreversible or regulated operations. It is the operational form of human-in-the-loop oversight.", "category": "safety", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/patterns/human-approval-gate", "api": "https://santismm.com/api/patterns/human-approval-gate" }, { "slug": "human-escalation", "name": "Human Escalation", "summary": "Hand the whole task to a human when the agent detects it is out of its depth — low confidence, repeated failure, ambiguity, or sensitive situations — and pass full context so the person can take over without re-investigating. Unlike an approval gate, which pauses one action for sign-off, escalation transfers ownership so the agent stops driving. The hard part is calibrating triggers to avoid both over- and under-escalation.", "category": "safety", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/patterns/human-escalation", "api": "https://santismm.com/api/patterns/human-escalation" }, { "slug": "long-term-memory", "name": "Long-Term Memory", "summary": "Give an agent persistent memory across sessions so it remembers facts, user preferences, and prior outcomes beyond a single context window. A write path decides what to store, summarizes it, and deduplicates it; a read path retrieves only the relevant memories into context when needed. Unlike semantic caching, which caches whole answers to skip recomputation, long-term memory stores durable facts and state and recomposes them into fresh reasoning each time.", "category": "retrieval", "updated": "2026-06-24", "version": "1.1", "evidence": { "evidenceLevel": "production", "confidenceLevel": "low", "sourceType": [ "production_system", "personal_experience", "industry_observation" ] }, "url": "https://santismm.com/en/patterns/long-term-memory", "api": "https://santismm.com/api/patterns/long-term-memory" }, { "slug": "orchestrator-workers", "name": "Orchestrator-Workers", "summary": "An orchestrator LLM dynamically breaks a task into subtasks, delegates each to a worker LLM, and synthesizes the results. Unlike fixed parallelization, the orchestrator decides the subtasks at runtime — making it suited to complex tasks whose decomposition is not known in advance.", "category": "orchestration", "updated": "2026-06-24", "version": "1.1", "evidence": { "evidenceLevel": "production", "confidenceLevel": "low", "sourceType": [ "production_system", "personal_experience", "industry_observation" ] }, "url": "https://santismm.com/en/patterns/orchestrator-workers", "api": "https://santismm.com/api/patterns/orchestrator-workers" }, { "slug": "parallelization", "name": "Parallelization", "summary": "Parallelization runs multiple LLM calls at the same time and aggregates the results. Two flavors: sectioning (split a task into independent subtasks run in parallel) and voting (run the same task several times to improve reliability or coverage). It cuts latency and can raise quality.", "category": "orchestration", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation" ] }, "url": "https://santismm.com/en/patterns/parallelization", "api": "https://santismm.com/api/patterns/parallelization" }, { "slug": "prompt-chaining", "name": "Prompt Chaining", "summary": "Prompt chaining decomposes a task into a fixed sequence of LLM calls, where each step works on the output of the previous one. It trades a little latency for much higher accuracy and control, and is the simplest workflow pattern: use it whenever a task cleanly splits into ordered subtasks.", "category": "orchestration", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/patterns/prompt-chaining", "api": "https://santismm.com/api/patterns/prompt-chaining" }, { "slug": "recovery-strategy", "name": "Recovery Strategy", "summary": "Give the agent an explicit plan for when things break. Detect failures by validating outputs and catching tool errors; then retry with adjustment, fall back to an alternative path, roll back partial actions, or escalate. Bound retries to avoid runaway loops and cost, make actions idempotent, and distinguish transient from permanent failures. The goal is graceful degradation instead of crashes or silently wrong results.", "category": "reliability", "updated": "2026-06-24", "version": "1.1", "evidence": { "evidenceLevel": "production", "confidenceLevel": "low", "sourceType": [ "production_system", "personal_experience", "industry_observation" ] }, "url": "https://santismm.com/en/patterns/recovery-strategy", "api": "https://santismm.com/api/patterns/recovery-strategy" }, { "slug": "reflection", "name": "Reflection", "summary": "Reflection has a model critique its own output and then revise it, using the critique as feedback. It is a lightweight, single-model way to catch mistakes and improve quality on reasoning, coding and writing tasks — at the cost of extra calls.", "category": "reliability", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/patterns/reflection", "api": "https://santismm.com/api/patterns/reflection" }, { "slug": "routing", "name": "Routing", "summary": "Routing classifies an input and directs it to the most appropriate specialized handler, prompt or model. It improves quality by letting each path be optimized for its case, and controls cost by sending easy requests to cheap models and hard ones to capable models.", "category": "orchestration", "updated": "2026-06-24", "version": "1.1", "evidence": { "evidenceLevel": "production", "confidenceLevel": "low", "sourceType": [ "production_system", "personal_experience", "industry_observation" ] }, "url": "https://santismm.com/en/patterns/routing", "api": "https://santismm.com/api/patterns/routing" }, { "slug": "semantic-caching", "name": "Semantic Caching", "summary": "Semantic caching stores past model responses and reuses them when a new request is semantically similar to a previous one — matching by meaning via embeddings, not exact text. It cuts cost and latency for repetitive or near-duplicate queries common in production.", "category": "cost", "updated": "2026-06-24", "version": "1.1", "evidence": { "evidenceLevel": "production", "confidenceLevel": "low", "sourceType": [ "production_system", "personal_experience", "industry_observation" ] }, "url": "https://santismm.com/en/patterns/semantic-caching", "api": "https://santismm.com/api/patterns/semantic-caching" }, { "slug": "supervisor-agent", "name": "Supervisor Agent", "summary": "A supervisor agent is a persistent coordinator that manages a team of specialized sub-agents. It reads the conversation state, decides which specialist should act next, routes messages to it, and integrates returned results toward the goal. Unlike a one-shot decomposer, the supervisor stays in the loop across many turns, delegating by capability and re-planning until the task is done or handed back to the user.", "category": "orchestration", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "url": "https://santismm.com/en/patterns/supervisor-agent", "api": "https://santismm.com/api/patterns/supervisor-agent" }, { "slug": "task-prioritization", "name": "Task Prioritization", "summary": "Order an agent's candidate tasks by value, urgency, dependencies, and cost instead of processing them first-in-first-out. A scoring function and a priority queue decide what runs next, so limited compute, budget, and time go to the work that matters most. Re-score as state changes, and bound the queue so it cannot grow without limit.", "category": "orchestration", "updated": "2026-06-24", "version": "1.1", "evidence": { "evidenceLevel": "production", "confidenceLevel": "low", "sourceType": [ "production_system", "personal_experience", "industry_observation" ] }, "url": "https://santismm.com/en/patterns/task-prioritization", "api": "https://santismm.com/api/patterns/task-prioritization" } ] }, "architectures_library": { "url": "https://santismm.com/en/architectures", "count": 5, "entries": [ { "id": "ARCH-001", "slug": "customer-service-agent", "name": "Customer Service Agent", "summary": "A reference architecture for an enterprise customer-service agent that resolves common requests end to end — answering from a grounded knowledge base, acting in the CRM and ticketing systems through tools, and escalating to a human when confidence is low or the action is high-impact. It pairs retrieval for grounding with risk-based human approval for safety, and is observable so every conversation can be evaluated and improved.", "category": "customer-experience", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "paper" ] }, "patterns": [ "routing", "human-approval-gate", "semantic-caching", "reflection" ], "knowledge": [ "ai-agent", "tool-use", "enterprise-rag", "guardrails", "human-in-the-loop", "ai-observability" ], "url": "https://santismm.com/en/architectures/customer-service-agent", "api": "https://santismm.com/api/architectures/customer-service-agent" }, { "id": "ARCH-002", "slug": "enterprise-knowledge-assistant", "name": "Enterprise Knowledge Assistant", "summary": "A reference architecture for an internal knowledge assistant that answers employee questions from the company's own documents — wikis, policies, tickets, code — with citations and respecting each user's access permissions. It combines hybrid retrieval and reranking for grounding, permission-aware filtering for security, and an evaluation harness so answer quality is measured rather than assumed. The hard parts are not the model; they are retrieval quality, access control and evaluation.", "category": "knowledge", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "patterns": [ "routing", "semantic-caching", "evaluator-optimizer", "prompt-chaining" ], "knowledge": [ "enterprise-rag", "embeddings", "context-engineering", "guardrails", "agentic-evaluation", "ai-governance" ], "url": "https://santismm.com/en/architectures/enterprise-knowledge-assistant", "api": "https://santismm.com/api/architectures/enterprise-knowledge-assistant" }, { "id": "ARCH-003", "slug": "sales-copilot", "name": "Sales Copilot", "summary": "A sales copilot is an agent that assists reps end to end: it researches accounts from CRM and product data, drafts personalized outreach and follow-ups, logs activity, surfaces next-best-actions, and prepares meeting briefs. Everything is grounded in the company's CRM, deal, and product knowledge to avoid hallucinated claims about features or pricing. The rep stays in control: a human-approval gate sits in front of any outbound action, so the agent drafts but never sends to a customer on its own. Success is measured honestly through rep productivity and pipeline impact, not vanity activity counts.", "category": "sales", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "paper" ] }, "patterns": [ "routing", "human-approval-gate", "reflection", "semantic-caching" ], "knowledge": [ "ai-agent", "tool-use", "enterprise-rag", "context-engineering", "guardrails", "ai-observability" ], "url": "https://santismm.com/en/architectures/sales-copilot", "api": "https://santismm.com/api/architectures/sales-copilot" }, { "id": "ARCH-004", "slug": "ai-workforce", "name": "AI Workforce", "summary": "An AI workforce is an orchestrated team of specialized agents that collaborate on multi-step business processes under a supervisor. The supervisor decomposes a goal, prioritizes and delegates subtasks to specialist agents (research, drafting, QA), and they share state through a common store. Agents escalate to humans when out of depth, and every step is observable and governed. Treat it as managing digital workers: success depends less on any single agent and more on coordination, clear ownership via an agent registry, human oversight, and evaluating the whole team rather than parts.", "category": "workforce", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "paper" ] }, "patterns": [ "supervisor-agent", "orchestrator-workers", "goal-decomposition", "human-escalation", "task-prioritization" ], "knowledge": [ "multi-agent-architecture", "ai-agent", "agentic-evaluation", "ai-observability", "ai-governance" ], "url": "https://santismm.com/en/architectures/ai-workforce", "api": "https://santismm.com/api/architectures/ai-workforce" }, { "id": "ARCH-005", "slug": "operations-center", "name": "Operations Center", "summary": "An operations center is an agentic AIOps system that watches monitoring signals and alerts, correlates and triages them, diagnoses likely root cause, and executes only vetted runbook remediations — keeping destructive or novel actions behind human approval. It cuts alert fatigue and shortens mean time to resolution by automating safe, read-mostly diagnostics while escalating risky writes to on-call engineers. Every action is audited and reversible. Success is measured honestly with MTTR, false-action rate, and escalation precision, not by automation volume.", "category": "operations", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "medium", "sourceType": [ "industry_observation" ] }, "patterns": [ "routing", "recovery-strategy", "human-escalation", "evaluator-optimizer", "human-approval-gate" ], "knowledge": [ "ai-agent", "tool-use", "ai-observability", "guardrails", "agentic-evaluation" ], "url": "https://santismm.com/en/architectures/operations-center", "api": "https://santismm.com/api/architectures/operations-center" } ] }, "governance_library": { "url": "https://santismm.com/en/governance", "count": 7, "entries": [ { "id": "GOV-001", "slug": "eu-ai-act", "name": "EU AI Act", "summary": "The EU AI Act is the European Union's comprehensive, risk-based law for artificial intelligence. It sorts AI systems into risk tiers — unacceptable (banned), high-risk (strict obligations), limited-risk (transparency duties) and minimal-risk — and adds specific obligations for general-purpose AI models. It applies extraterritorially to anyone placing AI on the EU market and phases in over several years, with penalties reaching up to 7% of global annual turnover for the most serious breaches.", "category": "regulation", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "paper", "industry_observation" ] }, "frameworks": [ "EU AI Act" ], "url": "https://santismm.com/en/governance/eu-ai-act", "api": "https://santismm.com/api/governance/eu-ai-act" }, { "id": "GOV-002", "slug": "iso-42001", "name": "ISO/IEC 42001", "summary": "ISO/IEC 42001:2023 is the first international, certifiable standard for an AI management system (AIMS). Like ISO 27001 for information security, it defines how an organization should establish, implement, maintain and continually improve the way it governs AI — through a policy, defined roles, risk and impact assessments, a set of controls, and a Plan-Do-Check-Act improvement cycle. It is voluntary and certifiable, giving organizations a recognized way to demonstrate responsible AI management.", "category": "standard", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "paper", "industry_observation" ] }, "frameworks": [ "ISO/IEC 42001" ], "url": "https://santismm.com/en/governance/iso-42001", "api": "https://santismm.com/api/governance/iso-42001" }, { "id": "GOV-003", "slug": "nist-ai-rmf", "name": "NIST AI Risk Management Framework", "summary": "The NIST AI RMF 1.0 is a voluntary, widely-adopted framework for managing AI risk across the lifecycle. It is organized around four functions — Govern, Map, Measure and Manage — and a set of characteristics of trustworthy AI (valid and reliable, safe, secure and resilient, accountable and transparent, explainable, privacy-enhanced, and fair with harmful bias managed). A companion Generative AI Profile adapts it to GenAI risks. Unlike the EU AI Act it is not law, but it is a common backbone for operational AI governance.", "category": "framework", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "paper", "industry_observation" ] }, "frameworks": [ "NIST AI RMF" ], "url": "https://santismm.com/en/governance/nist-ai-rmf", "api": "https://santismm.com/api/governance/nist-ai-rmf" }, { "id": "GOV-004", "slug": "agentic-ai-governance-checklist", "name": "Agentic AI Governance Checklist", "summary": "A practical, vendor-neutral checklist for governing agentic AI in the enterprise — translating the principles of the EU AI Act, ISO/IEC 42001 and NIST AI RMF into concrete controls you can implement in a harness. It covers human oversight, guardrails, audit logging, evaluation, access control, prompt-injection defence and incident response, and maps each control to the patterns and knowledge units that operationalize it. Use it as a readiness gate before letting an agent act in production.", "category": "playbook", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "personal_experience" ] }, "frameworks": [ "EU AI Act", "ISO/IEC 42001", "NIST AI RMF" ], "url": "https://santismm.com/en/governance/agentic-ai-governance-checklist", "api": "https://santismm.com/api/governance/agentic-ai-governance-checklist" }, { "id": "GOV-005", "slug": "enterprise-ai-governance-framework", "name": "Enterprise AI Governance Framework", "summary": "An umbrella operating model for governing AI across an organization. It defines the principles, accountability (RACI), AI risk taxonomy, lifecycle gates and policy hierarchy that keep AI use lawful, safe and aligned with risk appetite. It harmonizes the EU AI Act, ISO/IEC 42001 and NIST AI RMF into one internal program — comply once, reuse everywhere — and composes the agentic governance checklist as its concrete control set. Use it to give every production AI system a named owner, a risk tier and a gate that can actually block a non-compliant deployment.", "category": "framework", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "frameworks": [ "EU AI Act", "ISO/IEC 42001", "NIST AI RMF" ], "url": "https://santismm.com/en/governance/enterprise-ai-governance-framework", "api": "https://santismm.com/api/governance/enterprise-ai-governance-framework" }, { "id": "GOV-006", "slug": "audit-framework-for-agentic-systems", "name": "Audit Framework for Agentic Systems", "summary": "A practical, vendor-neutral framework for making an agent auditable and for auditing it. It defines the evidence an independent reviewer needs — immutable, correlated traces of every decision and tool call, model and version provenance, evaluation reports, approval and incident records — and how to test controls and sample high-volume runs. Each evidence type maps to ISO/IEC 42001 and NIST AI RMF so an auditor can verify the agent stayed within its governed bounds. Use it to design auditability in from the start, not as an afterthought.", "category": "framework", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "medium", "sourceType": [ "industry_observation", "paper" ] }, "frameworks": [ "ISO/IEC 42001", "NIST AI RMF" ], "url": "https://santismm.com/en/governance/audit-framework-for-agentic-systems", "api": "https://santismm.com/api/governance/audit-framework-for-agentic-systems" }, { "id": "GOV-007", "slug": "human-oversight-and-accountability-policy", "name": "Human Oversight and Accountability Policy", "summary": "An operational policy that turns EU AI Act Article 14 human oversight into practice for agentic AI. It assigns a named accountable owner per agent, sets the oversight level (in-the-loop, on-the-loop, out-of-the-loop) by risk, and defines intervention, override and stop authority plus escalation paths. It requires overseers to be competent and have time to act, and it guards against rubber-stamping and automation bias. It exists to prevent two failures: the absent human and the token human who cannot actually understand, override, or answer for what the agent does.", "category": "playbook", "updated": "2026-06-21", "version": "1.0", "evidence": { "evidenceLevel": "industry_observation", "confidenceLevel": "high", "sourceType": [ "industry_observation", "paper" ] }, "frameworks": [ "EU AI Act" ], "url": "https://santismm.com/en/governance/human-oversight-and-accountability-policy", "api": "https://santismm.com/api/governance/human-oversight-and-accountability-policy" } ] } }