A:O:R:A helps companies understand and control what their AI systems are actually doing.
Open-source. Self-hosted. Every AI decision passes through your rules — not the model's instincts. Built for teams in regulated environments.
Companies are deploying AI that books appointments, answers medical questions, makes financial recommendations — and takes the blame when it gets things wrong. Courts, regulators, and insurers all agree: if your AI says it, you said it.
OLG Hamm ruled 12 May 2026: a chatbot is not an independent third party. Its statements are the company's statements — regardless of whether the AI hallucinated or processed correct data incorrectly. The operator bears full responsibility.
High-risk AI systems now face mandatory transparency, logging, and human oversight requirements. Most existing AI stacks have no answer for this.
LangChain, AutoGPT, CrewAI — powerful tools, but none enforce policy. They route. They chain. They do not govern. A:O:R:A fills exactly that gap.
Think of A:O:R:A as a control room: every AI request goes in, every response comes out — and your rules decide what is allowed in between.
Every request passes through a policy enforcement layer before it reaches a model. If a rule is violated, A:O:R:A blocks. It does not guess. It does not pass through.
It is model-agnostic: works with Claude, GPT-4o, Gemini. Switch providers without rewriting your policies.
Policies are defined in plain YAML — readable by anyone. Every decision is written to an immutable audit log. Nothing deleted. Nothing edited.
Designed with EU AI Act and NIST AI RMF principles in mind — built for regulated environments.
Your rules run first. Always.
No AI model determines what is allowed. A:O:R:A enforces your YAML policies before and after every model call.
When in doubt, block.
If a decision cannot be made with certainty, A:O:R:A blocks. It never defaults to open.
Every decision recorded. Nothing disappears.
Every action is logged — append-only. Compliance reviewers see exactly what happened, when, and why.
High-risk decisions need a human yes.
Where the stakes are high, A:O:R:A pauses and requires human approval before proceeding.
Change AI provider. Keep your policies.
Claude, GPT-4o, Gemini — the governance layer stays the same regardless of which model runs underneath.
Your data stays with you. Full stop.
No telemetry. No cloud dependency. No vendor lock-in.
Every AI call follows a fixed, auditable path.
Input Gate → Policy Evaluation → Model → Output Verification. No shortcut. No bypass. No exception.
A:O:R:A understands the purpose of a request before acting.
Research, agentic tasks, simple queries — each follows a different governed path with matching risk controls.
Continuous monitoring. Anomalies trigger escalation.
Three configurable safety profiles (light / controlled / full) monitor agent behaviour in real time.
A:O:R:A identifies itself correctly. Jailbreaks rejected.
The underlying AI provider's identity never surfaces to end users. Manipulation attempts blocked.
Contested decisions go through structured review.
Multi-layer verdict system with escalation logic for high-stakes situations.
Multi-step research — governed end-to-end.
Research loops with evidence aggregation, deduplication, and confidence labelling — under policy control.
A:O:R:A checks local evidence before trusting generated answers.
LFKE makes internal documents, verified knowledge sources, and evidence status visible — including confidence, source usage, and block reasons when evidence is missing or weak.
Not just answering. Showing why.
A:O:R:A shows whether a decision was allowed, blocked, or unavailable — with reason and a human-readable explanation. Don’t trust us. Verify us.
A walkthrough showing A:O:R:A blocking a real policy violation in real time will appear here.
Every request is governed. The overhead is real but controlled — and we publish the numbers honestly.
Independent benchmarking in collaboration with academic partners. Results published here.
Every AI request follows the same fixed, auditable path through A:O:R:A.
Request arrives and is cleaned.
Sanitised and classified for intent and risk before anything else happens.
Your rules run. ALLOW, BLOCK, or ESCALATE.
YAML policies evaluated. A CRITICAL verdict is a hard stop — no override.
High risk? A human must say yes.
High-risk decisions wait for human approval before the model is called.
Allowed requests reach the AI provider.
Only policy-cleared requests reach Claude, GPT-4o, or Gemini.
Response checked before delivery.
Model response validated against policy. Audit log written — immutably.
Planned: Enterprise AI teams, regulated industries (finance, healthcare, legal), compliance officers, and researchers who need auditable AI workflows.
A:O:R:A was built by a solo founder who believes the current wave of AI deployment is moving faster than the governance infrastructure that needs to support it. Designed from day one around one principle: policy decides, not the model.
Courts, regulators, and industry bodies are independently arriving at the same conclusion: AI governance is not optional. It is a legal and operational necessity.
The court ruled that a company's AI chatbot is not a "third party". Every output is attributed to the operator, regardless of whether the AI hallucinated or processed data incorrectly.
The EU AI Act requires high-risk AI to maintain logs, support auditability, and ensure human oversight. A:O:R:A is designed with these principles as a structural foundation.
The NIST AI Risk Management Framework establishes governance, mapping, measurement, and management as core pillars. A:O:R:A operationalises these at the infrastructure level.
Coverage, research citations, and university benchmark collaborations will be listed here as they are confirmed.
The full governance layer — policy engine, audit system, SWR, CRP, intent router — is publicly available. Fork it. Audit it. Deploy it. No black boxes.
AGPL-3.0Open source core (AGPL-3.0). Details on commercial support and enterprise licensing will be published here.
A:O:R:A is free, open source, and ready to deploy.
Policy decides. Not the model.