Why IOA Exists
Most AI governance tools are either checkbox compliance (audit after the fact) or vendor-locked (tied to one LLM provider). IOA takes a different approach:
Governance by Design
Seven System Laws are enforced at runtime, not audited later. You can't turn them off.
Vendor Neutral
Works with OpenAI, Anthropic, Google, DeepSeek, XAI, Ollama. Switch providers without code changes.
Cryptographically Verifiable
Evidence bundles provide tamper-proof proof of compliance for auditors and regulators.
Open Source Core
Apache 2.0 licensed. Inspect the code. Understand how decisions are made.
The IOA Capability Stack
IOA is more than pattern matching. Here's the complete architecture:
What Makes IOA Exceptional
1. Evidence Bundles
Every IOA operation generates a verifiable evidence bundle containing:
- Provenance: Who requested what, when, and why
- Consensus records: How each model voted and confidence scores
- Fairness metrics: Bias scores and demographic analysis
- Audit chain: SHA-256 hash chain for tamper detection
- Compliance tags: GDPR, HIPAA, SOX, EU AI Act markers
Why it matters: When regulators ask "how did your AI make this decision?", you have cryptographic proof, not just logs.
2. Memory Fabric
Persistent, intelligent memory that survives across sessions:
- Episode-based organization: Automatic session boundaries
- Token-aware context: 60% recent, 35% memory, 5% pinned
- AES-GCM encryption: Military-grade encryption at rest
- ABAC permissions: Attribute-based access control
- Multiple backends: Local, SQLite, or S3
3. QIX Domain Frameworks
Pre-built governance cartridges for regulated industries:
4. Round Table Consensus
Instead of trusting one model, IOA can require agreement from multiple LLMs before proceeding. This provides:
- Higher confidence: Multiple independent models agreeing reduces hallucination risk
- Vendor diversity: Same-provider models weighted lower (0.6x) to encourage true diversity
- Graceful fallback: If one provider fails, others continue
- Cost optimization: Use cheaper models with stronger verification
# Round Table with quorum voting
quorum:
min_agents: 2
strong_quorum:
min_agents: 3
min_providers: 2 # Must include 2+ different providers
consensus_threshold: 0.67
sibling_weight: 0.6 # Same-provider models count lessTested at Scale
IOA's governance has been validated through extensive automated testing:
Current Detection: An Honest Assessment
What Works Today
IOA's Law 5 (Fairness & Non-Discrimination) currently uses pattern matching to detect explicit discriminatory language. This catches:
- Explicit racial discrimination: "whites only", "blacks only", etc.
- Gender discrimination: "only men", "only women", "hire only men"
- Disability discrimination: "no disabled", "no handicapped"
Pros: Fast (sub-millisecond), deterministic, no external API calls, explainable.
Known Limitations
Pattern matching has well-understood constraints:
False Positives (Legitimate uses blocked)
| Prompt | Context | IOA Result |
|---|---|---|
| "This dress is designed for men only" | E-commerce product | BLOCKED |
| "Signs said 'whites only' in the 1960s" | Historical education | BLOCKED |
| "This medication is for men only" | Medical information | BLOCKED |
Bypasses (Discrimination not caught)
| Prompt | Why Not Caught |
|---|---|
| "Prefer white candidates" | Different phrasing |
| "Looking for candidates who fit our culture" | Coded language |
| "solo blancos" (Spanish for "whites only") | Non-English |
| "only w ppl" (abbreviation) | Typos/abbreviations |
Why This Is Acceptable (For Now)
Pattern matching is the first layer in a defense-in-depth strategy:
- Layer 1 (Today): Pattern matching catches obvious violations instantly
- Layer 2 (LLM safety): Underlying models (GPT-4, Claude) have their own safety training
- Layer 3 (Coming): Semantic similarity will catch variations
- Layer 4 (Coming): LLM-assisted intent detection for edge cases
The combination of IOA's pattern matching + LLM safety training provides reasonable coverage while we build the enhanced layers.
The Roadmap: What's Coming
Semantic Similarity (In Development)
Using embedding models to detect meaning, not just patterns. "white person" and "whites only" become semantically comparable.
- Leverages existing QiXCite semantic scorer
- Configurable similarity thresholds
- Handles typos, abbreviations, variations
Multilingual Detection
Language detection + translation of discriminatory patterns.
- Detects: English, Spanish, French, German, Chinese, Arabic, and more
- Leverages existing language detection from IOA Core Internal
Context-Aware Detection
Understanding that "dress for men only" is product metadata, not discrimination.
- Entity extraction (product vs. job posting vs. policy)
- Intent classification
- Domain-specific rules (e-commerce, HR, healthcare)
LLM-Assisted Intent Detection
For edge cases, use an LLM to classify discriminatory intent.
- Handles coded language ("culture fit")
- Context-aware reasoning
- Confidence scoring with human review for uncertain cases
Why IOA Is The Right Approach
vs. LLM Safety Training Alone
- Black box - can't explain decisions
- No audit trail
- Changes with model updates
- Vendor-specific
- Explainable rules + LLM judgment
- Cryptographic evidence bundles
- Consistent across model versions
- Works with any provider
vs. Post-Hoc Compliance Tools
- Violations already occurred
- Reactive, not preventive
- Manual review bottleneck
- Blocks violations before they happen
- Preventive by design
- Automatic with HITL escalation
vs. Vendor-Specific Governance
- Stuck with one provider
- No consensus verification
- Price/feature captive
- Switch providers anytime
- Multi-model consensus
- Best-of-breed selection
The Bottom Line
IOA's current pattern-based detection is one layer in a comprehensive governance stack. It's fast, deterministic, and catches obvious violations. But we're honest about its limits.
What makes IOA exceptional isn't any single feature - it's the architecture:
- Seven Laws that can't be bypassed
- Evidence bundles that prove compliance cryptographically
- Memory Fabric that maintains context securely
- QIX frameworks that bring domain expertise
- Round Table consensus that reduces single-model risk
- Open source core that you can inspect and trust
The detection layer will improve. The architecture is built to support those improvements without breaking existing deployments. That's why IOA is the right foundation for AI governance.