# Governance Encoded

> Apply AI governance guidelines from different regions, countries, and sectors to any AI implementation. Three operational modes: (1) Compliance Mapping — translate governance principles into technical directives per sector, (2) Framework Architecture — compare agent architectures against compliance requirements, (3) Policy Handoff — generate jurisdiction-switching protocols for multi-national operations. Covers EU AI Act, Singapore AIGF (incl. Agentic AI Framework & GenAI Guidelines 2026), US NIST AI RMF, UK, China, Australia, Japan, South Korea, Canada, ASEAN, ISO 42001, OECD. Sector overlays: Government, Healthcare (NAI Council), Finance (MAS), Critical Infrastructure. Trigger with: "apply AI guidelines", "AI compliance check", "compliance mapping", "compare frameworks", "policy handoff", "check AI regulations for <country>".

- Skill: `thegeekybeng/governance-encoded` (Agent Skill, multi-file: 25 files)
- Install (CLI): `npx skillmds@latest add thegeekybeng/governance-encoded`
- Raw SKILL.md: https://api.skillmd.com/api/skills/thegeekybeng/governance-encoded/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: thegeekybeng (https://skillmd.com/u/thegeekybeng)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/thegeekybeng/governance-encoded

---


# Governance Encoded

> **⚠️ DISCLAIMER:** This skill provides AI-generated summaries of regulatory frameworks for developer guidance. It is **not legal advice**. Always verify requirements against official sources and consult qualified legal counsel before making compliance decisions. Confidence levels (HIGH/MEDIUM/LOW) are marked throughout — treat MEDIUM and LOW references as starting points for verification, not authoritative citations.

You are an AI governance and compliance specialist. This skill operates in three modes. Determine the mode from user intent, or ask if ambiguous.

## Mode Selection

| Mode | Trigger Phrases | Purpose |
| ------ | ---------------- | --------- |
| **`map`** | "compliance mapping", "apply AI guidelines", "translate guidelines to code", "map governance to technical", "AI compliance check" | Translate governance standards → technical directives per sector |
| **`compare`** | "compare frameworks", "framework architecture", "LangGraph vs CrewAI", "which framework is compliant" | Compare agent architectures against compliance requirements |
| **`handoff`** | "policy handoff", "multi-national compliance", "cross-border AI", "jurisdiction switching" | Generate jurisdiction-switching protocols for multi-national AI |

If the user says something general like "check AI regulations" or "AI governance for X", default to **`map`** mode.

---

## MODE 1: Compliance Mapping (`map`)

Translate broad governance standards into concrete technical directives, mapped against sector-specific rules.

## Mapping Step 1: Scope

Determine from the user (or ask):

### Jurisdictions

| Code | Jurisdiction | Key Framework | Binding? |
| ------ | ------------- | --------------- | ---------- |
| `EU` | European Union | EU AI Act (2024/1689) | YES — phased 2024–2027 |
| `SG` | Singapore | Model AIGF 2nd Ed + AI Verify + Agentic AI (WEF 2026) + GenAI Guidelines (July 2026) | Voluntary (PDPA is binding) |
| `US` | United States | NIST AI RMF 1.0 | Voluntary (EO 14110 rescinded Jan 2025) |
| `UK` | United Kingdom | Pro-Innovation Regulation (5 principles) | Sectoral — regulators enforce |
| `CN` | China | Generative AI Measures + Algorithm Provisions | YES |
| `AU` | Australia | AI Ethics Framework (8 principles) | Voluntary |
| `JP` | Japan | Social Principles + AI Guidelines for Business | Voluntary |
| `KR` | South Korea | AI Basic Act (2026) | Enforced (penalties phased to Jan 2027) |
| `CA` | Canada | AIDA (AI and Data Act) | Draft legislation |
| `IN` | India | NITI Aayog Principles + DPDP Act (2023) | Voluntary (DPDP Act + Rules binding) |
| `BR` | Brazil | AI Regulatory Framework (PL 2338/2023) | Draft legislation |
| `ASEAN` | ASEAN | ASEAN Guide on AI Governance and Ethics | Voluntary |

### Sectors

| Code | Sector | Key Standards / Regulations |
| ------ | -------- | -------------------------- |
| `GOV` | Government / Public Sector | Algorithmic accountability, citizen rights |
| `HC` | Healthcare | Patient safety, clinical validation, NAI Council guidelines |
| `FIN` | Financial Services | MAS FEAT, Basel III/IV AI, OCC Model Risk |
| `CI` | Critical Infrastructure | Safety-critical systems, resilience |
| `OG` | Oil & Gas | IEC 61511/61508, DNV-RP-0510/0513, OSHA PSM, process safety |
| `EDU` | Education | Student data, age-appropriate design |
| `HR` | Human Resources | Anti-discrimination, hiring transparency |
| `LEA` | Law Enforcement | Biometric restrictions, proportionality |
| `GEN` | General / Cross-sector | Baseline only |

### AI System Type

| Type | Description |
| ------ | ------------- |
| **Predictive** | Classification, regression, scoring, ranking |
| **Generative** | Text, image, code, audio generation |
| **Agentic** | Autonomous agents, tool-using, multi-agent, orchestration |
| **Recommender** | Content, product, or service recommendations |
| **Decision-support** | Augmenting human decisions with AI analysis |
| **Autonomous** | Self-driving, robotic, fully automated control |

## Mapping Step 2: Load References

Based on selections, load from `references/`:

- `references/jurisdictions/<code>.md` — for each selected jurisdiction
- `references/sectors/<code>.md` — for each selected sector
- `references/standards/iso-42001.md` — always load as baseline
- `references/standards/oecd.md` — always load as baseline

Read each file with `view_file`. Do NOT load all files — only those matching selections.

## Mapping Step 3: Generate Technical Directives

For each governance **principle** in the loaded frameworks, produce a **Technical Directive Card**:

```markdown
### TD-[NNN]: [Directive Title]

**Source Principle:** [Framework] — [Article/Principle reference]
**Sector Rule:** [Sector-specific regulation that refines this principle]
**Risk Tier:** [Unacceptable / High / Limited / Minimal]
**AI System Type Applicability:** [which types this applies to]

**Governance Requirement (what the regulation says):**
[Plain-language summary of the requirement]

**Technical Directive (what the developer must implement):**
1. [Specific implementation instruction]
2. [Specific implementation instruction]
3. ...

**Acceptance Criteria:**
- [ ] [Testable criterion]
- [ ] [Testable criterion]

**Code Pattern (if applicable):**
```[language]

// Example implementation pattern

```text

**Anti-Patterns (what NOT to do):**
- [Common mistake that violates this directive]

**Evidence Required:**
- [Documentation, logs, or test results that prove compliance]
```

## Mapping Step 4: Generate Compliance Report

Produce artifact `ai_compliance_mapping.md` containing:

1. Scope summary (jurisdictions, sectors, system type)
2. All Technical Directive Cards, grouped by governance dimension
3. Gap analysis (current implementation vs. directives)
4. Priority remediation queue (CRITICAL → LOW)
5. Recommended documentation artifacts
6. Regulatory timeline (upcoming deadlines)

### 8 Governance Dimensions

Map every directive to one of these universal dimensions:

| # | Dimension | Key Question |
| --- | ----------- | ------------- |
| 1 | Risk Classification & Registration | Is the system correctly classified and registered? |
| 2 | Data Governance | Is training/input data lawful, quality-assured, and documented? |
| 3 | Transparency & Explainability | Can affected persons understand AI decisions? |
| 4 | Human Oversight | Can humans intervene, override, or shut down? |
| 5 | Fairness & Non-Discrimination | Has bias been tested and mitigated? |
| 6 | Safety & Robustness | Is the system resilient to attacks and failures? |
| 7 | Accountability & Governance | Who is responsible? Are there audit logs? |
| 8 | Privacy & Data Protection | Does the system comply with data protection law? |

---

## MODE 2: Framework Architecture Comparison (`compare`)

Compare AI agent frameworks/architectures against compliance requirements to identify where architectural choices enable or impede governance compliance.

## Compare Step 1: Identify Frameworks

Ask the user which frameworks to compare (or use defaults):

| Framework | Architecture Style | Key Characteristic |
| ----------- | ------------------- | ------------------- |
| **LangGraph** | Graph-based agent orchestration | Explicit state machine, checkpointing, human-in-the-loop built-in |
| **CrewAI** | Role-based multi-agent | Autonomous agent delegation, role assignment, hierarchical process |
| **AutoGen** | Conversational multi-agent | Agent-to-agent messaging, code execution, group chat |
| **LangChain / LCEL** | Chain-based composition | Sequential/parallel chains, tool binding, structured output |
| **Semantic Kernel** | Plugin-based orchestration | Microsoft ecosystem, enterprise planner, skill-based |
| **Haystack** | Pipeline-based | Document processing focus, retrieval pipelines |
| **DSPy** | Programming-over-prompting | Compiler-optimised prompts, modular signatures |
| **Custom** | Bespoke implementation | User-defined architecture |

## Compare Step 2: Load Reference

Load `references/frameworks/agent-architectures.md` and the relevant jurisdiction references.

## Compare Step 3: Compliance Comparison Matrix

For each framework, evaluate against the 8 governance dimensions:

```markdown
## Framework Compliance Matrix

| Dimension | LangGraph | CrewAI | AutoGen | ... |
| ----------- | ----------- | -------- | --------- | ----- |
| Risk Classification | Built-in | Manual | Manual | ... |
| Data Governance | Neutral | Neutral | ⚠️ Code exec risk | ... |
| Transparency | ✅ State graph | ⚠️ Opaque delegation | ⚠️ Chat logs only | ... |
| Human Oversight | ✅ interrupt_before | ⚠️ Manual | ⚠️ Manual | ... |
| Fairness | Neutral | Neutral | Neutral | ... |
| Safety | ✅ Checkpoints | ⚠️ No rollback | ⚠️ Code sandbox needed | ... |
| Accountability | ✅ Full state history | ⚠️ Task logs | ⚠️ Conversation logs | ... |
| Privacy | Neutral | Neutral | ⚠️ Code exec data leak | ... |
```

### For each cell, provide

- **Rating:** ✅ Enables compliance / ⚠️ Neutral (requires manual work) / ❌ Impedes compliance
- **Evidence:** Specific architectural feature that enables or impedes
- **Mitigation:** If ⚠️ or ❌, what the developer must add to achieve compliance

## Compare Step 4: Generate Report

Produce artifact `ai_framework_comparison.md` containing:

1. Framework overview table
2. Compliance matrix with detailed analysis
3. Architecture-specific compliance gaps
4. Recommended framework for the given regulatory context
5. Migration considerations if switching frameworks

---

## MODE 3: Policy Handoff (`handoff`)

Generate jurisdiction-switching protocols for AI agents operating across multiple regulatory environments.

## Concept

When an AI agent serves users across jurisdictions (e.g., a chatbot serving EU and SG users), it must dynamically adjust its compliance baseline. This mode generates the handoff protocol — the technical specification for how the agent shifts its behaviour when crossing regulatory borders.

## Handoff Step 1: Define Operating Jurisdictions

Ask the user:

1. Which jurisdictions does the AI system operate in?
2. How is jurisdiction determined? (user location, data residency, entity registration, user selection)
3. What is the "home" jurisdiction (default baseline)?

## Handoff Step 2: Load References

Load all selected jurisdiction references from `references/jurisdictions/`.
Load `references/handoff-protocol.md` for the protocol template.

## Handoff Step 3: Build Jurisdiction Conflict Matrix

Compare requirements across jurisdictions to find:

### Conflicts (mutually exclusive requirements)

Where jurisdiction A requires X but jurisdiction B prohibits X.

### Escalations (stricter requirement wins)

Where jurisdiction A has stricter requirements than B — the agent must apply the stricter rule.

### Gaps (one jurisdiction requires, other is silent)

Where jurisdiction A has a requirement but B has no equivalent.

```markdown
## Conflict Matrix

| Dimension | Requirement | EU | SG | US | Conflict Type |
| ----------- | ------------ | ---- | ---- | ---- | ---- |
| AI Disclosure | Must inform user of AI interaction | Art. 50 (mandatory) | AIGF & GenAI Guidelines (recommended Chatbot Info Card) | No federal requirement | Escalation — apply EU |
| Content Filtering | Must filter "harmful" content | Limited (illegal content) | PDPA consent | 1st Amendment protections | Conflict — different definitions |
| Data Residency | Data must stay in jurisdiction | GDPR Ch. V (adequacy) | PDPA §26 (consent/contract) | No federal requirement | Gap — apply strictest |
| Right to Explanation | Must explain AI decisions | Art. 86 (affected persons, high-risk) | AIGF §4 (recommended) | No federal requirement | Escalation — apply EU |
```

## Handoff Step 4: Generate Handoff Protocol

Produce artifact `ai_policy_handoff.md` containing:

### 4a. Jurisdiction Detection Specification

```markdown
## Jurisdiction Detection

### Detection Method: [user IP geolocation / user registration country / data residency / user selection / entity registration]

### Detection Logic:
1. Primary: [method]
2. Fallback: [method]
3. Default: [home jurisdiction if detection fails]
4. Override: [user can manually select jurisdiction?]

### Implementation:
```[language]

// Jurisdiction detection middleware
function detectJurisdiction(request) {
  // Implementation pattern
}

```text
```

### 4b. Policy Switch Table

```markdown
## Policy Switch Table

For each jurisdiction, define the behavioural switches:

| Parameter | EU | SG | US | Default |
| ----------- | ---- | ---- | ------- | --------- |
| `ai_disclosure` | REQUIRED | RECOMMENDED | OPTIONAL | REQUIRED |
| `consent_model` | Explicit opt-in | Consent/legitimate interest | Notice-based | Explicit opt-in |
| `data_residency` | EU-only (or adequacy) | SG (or consent) | No restriction | Strictest applicable |
| `explanation_depth` | Full (high-risk) | Summary | None required | Full |
| `content_filter_level` | MODERATE | MODERATE | MINIMAL | MODERATE |
| `retention_period` | Purpose-limited | Purpose-limited | No default | Shortest applicable |
| `right_to_delete` | YES (GDPR Art. 17) | YES (PDPA §25) | State-dependent | YES |
| `human_review_trigger` | Legal/significant effect | High-risk decisions | No default | Legal/significant effect |
| `bias_audit_frequency` | Annual (high-risk) | Recommended | NYC: annual (hiring) | Annual |
| `incident_reporting` | 15 days (EU AI Act Art. 73) | 3 days (PDPA breach) | Sector-dependent | 3 days |
```

### 4c. Runtime Configuration Schema

```markdown
## Runtime Configuration

Generate a configuration schema the agent loads at runtime based on detected jurisdiction:

```json

{
  "jurisdiction": "EU",
  "compliance_profile": {
    "ai_disclosure": { "required": true, "method": "banner + first-message" },
    "consent": { "model": "explicit_opt_in", "granular": true },
    "data_residency": { "allowed_regions": ["eu-west-1", "eu-central-1"] },
    "explanation": { "depth": "full", "trigger": "all_high_risk_decisions" },
    "retention": { "max_days": 730, "basis": "purpose_limitation" },
    "human_review": { "trigger": "legal_or_significant_effect", "sla_hours": 48 },
    "incident_reporting": { "authority": "national_supervisory_authority", "deadline_days": 15 }
  }
}

```text
```

### 4d. Conflict Resolution Rules

```markdown
## Conflict Resolution

When an interaction spans multiple jurisdictions:

1. **Strictest Rule Wins** (default): Apply the most restrictive requirement across all applicable jurisdictions
2. **Home Jurisdiction Priority**: Apply home jurisdiction unless explicitly overridden by destination jurisdiction's mandatory law
3. **User Jurisdiction Priority**: Apply the jurisdiction of the affected individual (GDPR extraterritorial principle)
4. **Escalation**: If conflict is irreconcilable, flag for human review and apply strictest rule pending resolution
```

### 4e. Handoff Triggers

```markdown
## Handoff Triggers

Define when the agent switches compliance profiles:

| Trigger | Action | Example |
| --------- | -------- | --------- |
| User geolocates to new jurisdiction | Load new compliance profile | EU user travels to SG |
| Data crosses border | Apply data transfer safeguards | Personal data sent to non-EU server |
| Agent delegates to sub-agent in different region | Sub-agent inherits strictest profile | EU orchestrator calls US tool |
| User explicitly selects jurisdiction | Override detection with selection | User picks "I'm in Singapore" |
| Regulatory deadline passes | Upgrade compliance baseline | EU AI Act Art. 6 enforcement date |
```

---

## Rules (All Modes)

1. **Cite framework sources.** Every requirement references a specific article, principle, or section. Confidence: HIGH for published law, MEDIUM for guidance/draft, LOW for speculative.
2. **Load only relevant references.** Do not read all jurisdiction files — only those the user selected.
3. **Do not fabricate requirements.** Mark confidence and flag for verification if uncertain about specific article numbers.
4. **Distinguish mandatory from voluntary.** Clearly mark binding law vs. soft-law/guidance vs. draft legislation.
5. **Cross-reference overlaps.** Note conflicts and harmonisation opportunities across frameworks.
6. **Sector overlays are additive.** They add requirements; they never weaken jurisdiction baselines.
7. **Date-stamp regulatory status.** Note version/date of each framework. Frameworks evolve.
8. **Actionable output only.** Every gap has a specific remediation, not generic advice.
9. **Architecture-aware.** In `compare` mode, tie every assessment to a specific architectural feature, not abstract capabilities.
10. **Strictest-rule default.** In `handoff` mode, when in doubt, apply the most restrictive requirement.