Most agent architectures work on an imposition model — do this task, follow these rules. In the human model, it lives in the system of record. One place, one version, one truth. In the agentic model, that's no longer sufficient.

There are many reasons why this is the case, that include the nature of how knowledge models work, the

I knew that information about Lean Compliance used in current foundation models was not up-to-date and

as bold claims such as: “LLMs are sufficiently creative that they can beat humans at coming up with models

And why is the problem so hard to fix by adding more rules to the access model? When the agent doesn't fit an existing role, the permissions model has nothing to anchor to, because Principal Engineer at Lean Compliance Consulting, Inc., where he develops the Operational Compliance Model

While it recognizes "systemic risks" from advanced AI models, it primarily identifies these risks through Most notably, the Act treats powerful general-purpose AI models like GPT-4 as requiring transparency This potentially under-regulates foundation models that could be readily configured for autonomous operation emphasizes understanding how parts interact to create emergent system behaviors, identifying failure modes

Operational Compliance Model

Lean Compliance Operational Model - Provides concept of operation to meet obligations and keep promises

Every model trained, every query answered, draws down resources that are already scarce — and not available

Hazards, threats, and failure modes? They're all manifestations of uncertainty. In cybersecurity, threat modelling does the same thing—identifying uncertainties in system behaviour

This includes deploying large language models for simple text tasks that simpler algorithms could handle , running complex AI models when rule-based systems would suffice, or using resource-intensive processing

process, assets, and the plant: The following chart is an example of a process review using the 5M+E model