SecurePath Specification

Home / SecurePath / SecurePath Specification

SecurePath

Where AI Safety Meets Regulatory Assurance

Project Specification

SecurePath is an open-source AI safety, evaluation, compliance, and governance framework designed to provide continuous, auditable oversight of artificial intelligence systems throughout their lifecycle.

SecurePath provides controlled evaluation environments, adversarial testing, compliance assessment, risk analysis, multi-agent evaluation, historical monitoring, governance workflows, and audit evidence management. The system is designed to help organizations identify risks, measure changes in AI behavior, document compliance, and maintain human oversight.

Core Principles

AI safety through continuous evaluation
Regulatory assurance through traceable compliance assessment
Human oversight for consequential decisions
Evidence-based governance
Reproducible evaluation
Model lifecycle accountability
Privacy and data protection
Modular extensibility
Vendor-independent operation
Transparent risk assessment
Historical traceability
Controlled and isolated evaluation

Core Modules

Model Intake and Metadata Module

The Model Intake and Metadata Module manages the registration and identification of AI systems entering SecurePath.

Features include:

Model registration
Model version tracking
Configuration tracking
Model provenance
Deployment metadata
Evaluation metadata
Model lifecycle identification
Model ownership information
Environment association
Intake validation
Change tracking
Model retirement tracking

The module establishes the identity and provenance of each model before evaluation begins.

Red Team Evaluation Module

The Red Team Evaluation Module performs structured adversarial evaluation of AI systems within controlled environments.

Features include:

Adversarial testing
Safety testing
Security testing
Policy testing
Compliance-oriented testing
Edge-case evaluation
Behavioral testing
Failure-mode identification
Reproducible evaluation scenarios
Configurable evaluation criteria
Evaluation evidence collection

The module is designed to identify weaknesses without turning evaluation capabilities into uncontrolled production attacks.

Sandbox and Isolation Module

The Sandbox and Isolation Module provides controlled environments for evaluating AI systems.

Features include:

Isolated evaluation environments
Controlled model execution
Resource boundaries
Evaluation containment
Execution monitoring
Evaluation session tracking
Secure artifact handling
Isolation between evaluation workloads
Controlled access to evaluation resources

The module prevents evaluation activities from unnecessarily affecting production systems or unrelated workloads.

Scenario Simulation Module

The Scenario Simulation Module creates controlled simulations for evaluating AI behavior under realistic and unusual conditions.

Features include:

Real-world scenario simulation
Adversarial scenarios
Edge-case scenarios
High-risk scenarios
Stress conditions
Policy-specific scenarios
Custom scenarios
Repeatable scenarios
Scenario versioning
Scenario outcome tracking

Scenarios can be combined with other SecurePath modules to create repeatable evaluation programs.

Scenario Stress Testing Module

The Scenario Stress Testing Module evaluates model resilience under increasingly difficult or abnormal conditions.

Features include:

Extreme input testing
Unexpected input testing
Malformed input testing
High-volume evaluation
Boundary condition testing
Behavioral stability testing
Failure threshold detection
Resilience scoring
Stress-test history

The module helps determine how model behavior changes when operating outside expected conditions.

Policy and Compliance Benchmark Module

The Policy and Compliance Benchmark Module evaluates AI systems against defined policies, controls, standards, and regulatory requirements.

Features include:

Policy-based evaluation
Compliance controls
Regulatory requirements
Internal organizational policies
Control mapping
Compliance scoring
Compliance gap analysis
Evidence requirements
Control status tracking
Jurisdiction-aware assessment
Requirement applicability analysis

The module separates evaluation criteria from implementation so that new policies and requirements can be added without redesigning the evaluation engine.

Regulatory Template Library Module

The Regulatory Template Library Module provides reusable assessment templates for regulatory and governance frameworks.

Features include:

Regulatory templates
Compliance control templates
Industry-specific templates
Organizational policy templates
Jurisdiction-specific templates
Custom templates
Template versioning
Template applicability rules
Template change tracking

Templates are treated as versioned evaluation resources so that historical assessments remain associated with the requirements applicable at the time of evaluation.

Regulatory Change Tracking Module

The Regulatory Change Tracking Module monitors changes to requirements that may affect existing AI systems.

Features include:

Regulatory requirement versioning
Requirement change detection
Affected-model identification
Affected-policy identification
Re-evaluation recommendations
Compliance impact tracking
Historical requirement records
Change notifications

The module helps organizations determine when existing evaluations may need to be repeated because requirements have changed.

Jurisdiction and Compliance Context Module

The Jurisdiction and Compliance Context Module determines which compliance requirements may apply to an AI system based on its operational context.

Features include:

Jurisdiction identification
Deployment location tracking
Organizational context
Industry context
Applicable requirement identification
Regulatory applicability analysis
Compliance scope definition
Context-aware evaluation

Metrics and Scoring Module

The Metrics and Scoring Module converts evaluation results into measurable safety, risk, and compliance indicators.

Features include:

Safety scoring
Risk scoring
Compliance scoring
Security measurements
Custom metrics
Weighted scoring
Severity classification
Threshold configuration
Comparative scoring
Historical scoring
Evaluation confidence indicators

Scoring methodologies must remain configurable and transparent so organizations can understand how conclusions were produced.

Risk Classification Module

The Risk Classification Module organizes findings according to configurable levels of severity, impact, likelihood, and urgency.

Features include:

Risk severity
Impact classification
Likelihood classification
Risk prioritization
Risk categories
Risk ownership
Risk status
Risk acceptance tracking
Escalation criteria
Risk history

Risk Mitigation Module

The Risk Mitigation Module provides structured remediation recommendations based on identified findings.

Features include:

Mitigation recommendations
Risk prioritization
Remediation tracking
Mitigation status
Pre-remediation measurements
Post-remediation measurements
Residual risk tracking
Remediation effectiveness analysis
Follow-up evaluation recommendations

Threat Intelligence Module

The Threat Intelligence Module incorporates relevant external threat information into SecurePath evaluation workflows.

Features include:

Threat intelligence ingestion
Threat classification
Threat relevance assessment
Threat-to-model mapping
Threat-to-scenario mapping
Threat history
Evaluation recommendations
Threat-driven testing

Anomaly Detection Module

The Anomaly Detection Module identifies unusual changes in model behavior, evaluation results, or compliance measurements.

Features include:

Behavioral anomaly detection
Risk anomalies
Compliance anomalies
Evaluation anomalies
Statistical deviation detection
Baseline comparison
Anomaly classification
Alert generation
Anomaly history

Historical Compliance Dashboard Module

The Historical Compliance Dashboard Module provides long-term visibility into model evaluation performance, compliance trends, and risk evolution.

Features include:

Historical evaluation tracking
Model version comparisons
Compliance trend analysis
Risk trend visualization
Improvement tracking
Regression detection
Historical baselines
Audit timelines
Evaluation history
Remediation history
Compliance posture history
Long-term model lifecycle tracking

The module maintains a historical record connecting models, versions, evaluations, findings, remediation actions, policies, and evidence.

Multi-Agent Historical Analysis

The Historical Compliance Dashboard may use specialized agents to analyze historical information.

The Compliance History Collection Agent gathers and organizes historical evaluation records.

The Trend Analysis Agent identifies long-term patterns and changes.

The Regression Detection Agent identifies declines in safety, compliance, or model performance.

The Improvement Tracking Agent measures remediation effectiveness.

The Audit Evidence Management Agent organizes evidence supporting historical assessments.

The Executive Insight Agent converts historical findings into decision-ready governance summaries.

Continuous Learning Evaluation Module

The Continuous Learning Evaluation Module reassesses AI systems after changes to model behavior or training.

Features include:

Retraining evaluation
Fine-tuning evaluation
Model update evaluation
Behavioral comparison
Pre-change baselines
Post-change analysis
Regression testing
Continuous evaluation
Change-triggered evaluation

Multi-Language Evaluation Module

The Multi-Language Evaluation Module evaluates model behavior across supported languages.

Features include:

Language-specific testing
Cross-language comparison
Safety comparison
Compliance comparison
Language-specific risk detection
Translation consistency testing
Language regression tracking

Multi-Modal Evaluation Module

The Multi-Modal Evaluation Module evaluates AI systems operating across multiple modalities.

Supported evaluation categories may include:

Text
Vision
Audio
Other supported input or output modalities
Cross-modal interactions
Modal-specific safety
Modal-specific compliance
Cross-modal consistency

Cross-Model Interaction Module

The Cross-Model Interaction Module evaluates systems in which multiple AI models interact.

Features include:

Multi-model scenarios
Model-to-model interaction testing
Cascading behavior analysis
Cross-model risk analysis
Interaction failures
Conflicting model behavior
Multi-model compliance analysis
Interaction history

Training Data Sensitivity Analysis Module

The Training Data Sensitivity Analysis Module evaluates datasets for information that may introduce privacy, confidentiality, intellectual property, or governance concerns.

Features include:

Personally identifiable information detection
Sensitive information detection
Confidential information detection
Proprietary information detection
Data classification
Dataset provenance
Privacy risk identification
Data governance analysis
Sensitivity reporting
Data remediation recommendations

Data Provenance and Governance Module

The Data Provenance and Governance Module maintains information about datasets and their use within AI systems.

Features include:

Dataset origin tracking
Dataset versioning
Data processing history
Data ownership information
Data classification
Data usage tracking
Governance controls
Provenance relationships
Dataset evaluation history

Explainability and Transparency Module

The Explainability and Transparency Module provides traceable explanations of evaluation findings and governance outcomes.

Features include:

Finding explanations
Risk explanations
Compliance explanations
Evidence relationships
Evaluation traceability
Decision traceability
Model version relationships
Policy relationships
Human-readable summaries

Evidence and Audit Management Module

The Evidence and Audit Management Module maintains the evidence required to support evaluation and compliance conclusions.

Features include:

Audit evidence collection
Evidence classification
Evidence provenance
Evidence versioning
Evidence relationships
Evaluation records
Compliance records
Remediation records
Approval records
Audit timelines
Evidence package generation

Reporting Module

The Reporting Module generates structured reports from SecurePath evaluation and governance data.

Features include:

Audit reports
Compliance reports
Risk reports
Safety reports
Model evaluation reports
Historical reports
Executive reports
Remediation reports
Custom reports
Evidence packages

Governance Dashboard Module

The Governance Dashboard Module provides centralized visibility into the organization’s AI safety and compliance posture.

Features include:

Model risk overview
Compliance status
Safety status
Evaluation status
Open findings
Remediation status
Regulatory changes
Historical trends
Governance alerts
Executive summaries

Monitoring and Alerting Module

The Monitoring and Alerting Module provides continuous observation of AI systems and evaluation outcomes.

Features include:

Continuous monitoring
Evaluation monitoring
Risk monitoring
Compliance monitoring
Behavioral monitoring
Regression alerts
Anomaly alerts
Policy violation alerts
High-risk alerts
Configurable notification thresholds

Automated Scheduling Module

The Automated Scheduling Module manages recurring evaluation and monitoring workflows.

Features include:

Scheduled evaluations
Recurring compliance checks
Scheduled red-team assessments
Scheduled data analysis
Continuous evaluation cycles
Evaluation frequency controls
Evaluation history
Failure notifications

Multi-Tenant Module

The Multi-Tenant Module supports separation of organizations, departments, projects, and evaluation environments.

Features include:

Tenant isolation
Organization separation
Department separation
Project separation
Tenant-specific policies
Tenant-specific compliance requirements
Tenant-specific dashboards
Tenant-specific audit records

Role-Based Access Control Module

The Role-Based Access Control Module manages authorization across SecurePath.

Features include:

User roles
Permission management
Resource permissions
Administrative permissions
Evaluation permissions
Audit permissions
Governance permissions
Data access controls
Role-specific dashboards

Governance Controls Module

The Governance Controls Module establishes human oversight and approval workflows.

Features include:

Human review
Approval workflows
Risk acceptance
Escalation workflows
Compliance sign-off
Remediation approval
Evaluation approval
Governance decisions
Decision history

Audit Logging Module

The Audit Logging Module records security, evaluation, compliance, and governance activity.

Features include:

User activity logging
Evaluation activity
Model changes
Policy changes
Configuration changes
Governance actions
Approval records
Access events
Administrative activity
Audit history

Model Lifecycle Management Module

The Model Lifecycle Management Module tracks AI systems from initial intake through retirement.

Lifecycle stages may include:

Intake
Evaluation
Approval
Deployment
Monitoring
Re-evaluation
Remediation
Version transition
Retirement

Plugin and Extension Module

The Plugin and Extension Module allows SecurePath to be extended without changing its core evaluation architecture.

Plugins may provide:

New evaluation methods
New compliance frameworks
New regulatory templates
New threat intelligence sources
New scoring methodologies
New data analysis methods
New reporting formats
New dashboard components
New monitoring capabilities
New model integrations
New scenario libraries

Plugins must operate within defined SecurePath security, governance, and interoperability boundaries.

Optional Plugin Modules

Optional Regulatory Plugin

Provides additional regulatory frameworks and jurisdiction-specific compliance resources.

Optional Threat Intelligence Plugin

Connects SecurePath to external threat intelligence sources.

Optional Model Provider Plugin

Provides controlled integration with supported external or locally operated AI systems.

Optional Dataset Analysis Plugin

Adds specialized dataset classification, privacy, provenance, or sensitivity analysis capabilities.

Optional Reporting Plugin

Adds additional reporting formats, document generation capabilities, and organizational reporting templates.

Optional Notification Plugin

Connects SecurePath alerts to supported notification and communication systems.

Optional Governance Integration Plugin

Connects SecurePath governance workflows with external organizational governance systems.

Optional Compliance Framework Plugin

Allows organizations to install additional compliance frameworks independently of the SecurePath core.

Optional Scenario Library Plugin

Provides additional evaluation scenarios for specialized industries, risks, or operational environments.

Optional Visualization Plugin

Adds additional visualization and analytical dashboard capabilities.

Multi-Agent Evaluation Architecture

SecurePath may use multiple specialized agents rather than relying on a single agent for all evaluation functions.

Agents may independently perform:

Safety analysis
Compliance analysis
Risk analysis
Historical analysis
Regression analysis
Threat analysis
Data sensitivity analysis
Evidence analysis
Explainability analysis
Governance analysis

Agent results may be compared, reconciled, scored, and presented as a consolidated assessment.

Human review may be required for designated high-impact findings, regulatory conclusions, risk acceptance, or governance decisions.

Evaluation Integrity

SecurePath must maintain traceability between:

Model
Model version
Configuration
Evaluation
Scenario
Policy
Requirement
Finding
Risk classification
Evidence
Remediation
Approval
Governance decision

Historical records must remain associated with the model and requirements applicable when the evaluation occurred.

Specification Branding License (SBL)

Standard

Fully AGPL-3.0+ compliant system
Copyleft enforced for network deployments
Required attribution:
- Roxanne Ardary
- https://www.roxanneardary.com/

Optional

Specification Branding License (SBL)
Attribution-free commercial deployment
Pricing based on scale, usage, and deployment scope
https://roxanneardary.com/securepath/

License & Notice Requirements

SecurePath is released under the GNU Affero General Public License v3.0 or later (AGPL-3.0+). By contributing to any Open Arsenal project, you agree that your contributions will also be released under this license.

Please note the following:

All contributions must comply with the AGPL-3.0+ terms.
Under Section 7 of the license, all redistributions, forks, and derivative works must preserve attribution to: Roxanne Ardary and roxanneardary.com.
SecurePath specifications are free to use with attribution. A Specification Branding License can be negotiated upon request.
The project’s notice.md file tracks attribution requirements and contributor acknowledgments. Any update that adds new contributors or modifies attribution should also update notice.md.
When submitting a pull request, ensure that any new files maintain the attribution headers where applicable.
Network-deployed versions of this software must also remain fully AGPL-3.0+ compliant, including exposure of source code modifications when applicable under the license.

For full legal details, please refer to the AGPL-3.0+ license and the project’s notice.md file.

Notice – SecurePath

Attribution Requirement: Under Section 7 of the AGPL 3.0+ license, all redistributions, forks, and derivative works, including network-deployed versions of this project, must provide attribution to Roxanne Ardary and roxanneardary.com.

Contributors

This file tracks contributors and their specific contributions to the project.

Roxanne Ardary, roxanneardary.com – March 31, 2026
Created the SecurePath repository and defined the initial enterprise-grade AI evaluation, red-teaming, and regulatory compliance framework architecture, including the full 23-module system design.
[Add other contributors here] – [Date]
[Describe contribution in one sentence]

License – SecurePath

This repository is licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).

Key Points

You are free to use, modify, and distribute the code.
All redistributions, forks, and derivative works or network-deployed versions must also be licensed under AGPL-3.0+ and provide attribution to Roxanne Ardary and roxanneardary.com as required under Section 7 of the license.
The software is provided “as is,” without warranty of any kind.

For the full license text, see GNU AGPL-3.0 License.