Model Governance Registry

An auditor asks for the list of models in production. The honest answer is often a spreadsheet that stopped being true in March. Somebody then rebuilds it from memory and from vendor pages. This starter puts controls around that rebuilding work so the next answer holds up.

A registry answers three questions on demand. Which models are in use, who owns each one, and what evidence supports the entry. Keeping those answers current is clerical work that drifts as soon as nobody is accountable for it.

This is the declared side of your inventory. The discovery starter handles the other side, where a tool is found instead of registered. Entries here are authored on purpose, so the controls protect a record that people edit every week.

Registry text is usually assembled from vendor pages, internal wikis and old tickets. Grounding checks compare the citations in a drafted entry against the material supplied with it. Output scoring rejects an entry that falls below a combined 0.85, or one that arrives shorter than 120 characters.

On the way in, an identity check refuses an edit request that carries no verified user. Masking hides national identifier patterns that creep into free text notes. A blocked term list rejects any request containing the word secret, a private key or an access token.

The schema itself is yours to define. Decide the fields, the owner of each record, the review cadence and the rule for retirement. Audit marking shows that a request passed the configured checks and nothing further. It does not hold the registry, keep it for a period or make it tamper evident.