I started Prism in March. It began with a body of knowledge and no product.
I had spent nearly eight years inside one of the four largest U.S. banks, and for the last four of them I owned enterprise configuration management as a control discipline — approved baselines, drift, the evidence that proves both. When I left in March, that knowledge was the only asset I was certain of. So in the spring I did the obvious thing with it: I wrote it down and published it. CM-AI, an open framework for applying configuration management to AI agents, released under CC-BY-4.0.
I want to be straight about why. It was not a product launch. I published it to find out whether it was an opportunity or just something I happened to know. Building on it since has answered that, and the answer is not the one I went looking for.
The part I was wrong about
I assumed the gap was control. That AI agents were running loose in businesses, that nobody had a mechanism to hold them to an approved configuration, and that a framework could be that mechanism.
That gap is going to close, and it will not close because of me.
I should say who I mean, because "the platforms" is the kind of phrase that sounds like an argument and isn’t one. I mean the companies that own the place your agent actually runs. Anthropic, OpenAI and Google, who build the models. Microsoft, Amazon and Google again, who rent you the environment you deploy into — Azure, Bedrock, Vertex. The agent frameworks your engineers wire the thing together with.
They share a structural advantage no independent framework can match: they are inside the execution. They see a tool call before it happens and they can refuse it. Anything I build sits outside that boundary and arrives afterward. Some of this will end up in the model itself, and I expect that within a couple of years "the platform handles that" will be a true answer to a great deal of what people mean today by agent governance.
If the question is can the system be made to govern itself, the answer is increasingly yes, and it is being answered by people better placed to answer it than me.
That is not a concession I make reluctantly. It is the thing that showed me where the actual gap is.
The part nobody is solving
None of that produces a single artifact a human being can act on.
Here is the situation I kept running into, in my own operations and in every conversation about someone else’s. A customer sends a security questionnaire asking how you govern the AI in your product. An insurer asks what controls exist before they will write the policy. An auditor asks which configuration was approved, who approved it, when it changed, and what the agent was permitted to do at the moment it acted. A procurement team will not move without an answer.
You cannot hand any of those people the runtime.
"The platform handles it" is not an answer to a human who carries an obligation. Neither is a dashboard they cannot read, a vendor attestation about the vendor’s own system, or a screenshot. What they need is evidence: a record that a specific configuration was approved by a specific person, that drift away from it was detected rather than discovered later, and that what the system did was inside what it was authorized to do. Evidence that still holds the second time somebody asks, which is the time that counts.
Governing and proving are two different jobs. The industry is pouring itself into the first one. The second one is where the obligation actually lands, and it lands on a person.
Why this is the part I can see
This is not an insight I had. It is a thing I could not avoid noticing, because it is the job I did for nearly a decade.
At the bank, the controls worked. That was never the hard part. Baseline coverage, drift detection, remediation — the mechanics were solvable at enterprise scale, and over four years we solved them.
The hard part was the other thing. It was producing evidence that survived an external audit team asking the same question twice, in a different order, eighteen months apart. It was the documentation discipline that meant a control we had asserted in March could still be demonstrated in October. External control audits and SOC 2 deep dives do not test whether your system works. They test whether you can show that it worked, on a date, to someone who was not there.
Almost nobody arriving in AI governance comes from that. The practitioners I meet come out of privacy law, audit and ML engineering, and each of them is good at a piece of it. Configuration management is the discipline that sits underneath all three, and it is the one that treats evidence as a deliverable rather than a byproduct.
So what CM-AI actually is
Not a competitor to the platforms. A layer above them.
Prism makes AI agents provable: approved baselines, detected drift, and evidence that an agent was authorized to do what it did.
That is the whole claim, and it is deliberately narrow. It does not require you to run your agents on anything in particular. It assumes the platform is doing its job. It answers the question the platform was never built to answer, which is what you put in front of the human who has to decide whether to believe any of it.
I should note what happened in between, because the record is public and the dates do not line up in a straight line. I pulled CM-AI back in July. I had run a ninety-day window watching for anyone to come looking for the methodology by name, nobody did, and I took that as the market’s answer. What I had actually measured was a small-business audience, which was who Prism was selling to at the time. Small businesses do not buy methodologies, and they are right not to — they want the report to be correct on Monday. The organizations that buy a methodology are the ones required to produce evidence against one. That is a different room, and it is the room Prism is now in. The measurement was sound. It was taken in the wrong place.
CM-AI is back at the front of the firm. It is one piece of Prism, not the whole of it — the analytics and data-engineering work is the other half, and most organizations carrying an AI obligation are running copilots and vendor features rather than autonomous agents.
What Prism is for
Prism makes AI governance provable: approved baselines, detected drift, and evidence that holds up.
The firm is built for organizations carrying a regulated or contractual AI obligation — the ones facing a customer security review, a vendor risk questionnaire, a procurement gate or a sector requirement, who need to demonstrate AI governance and not merely practise it. That is horizontal by design. The question is the same in financial services, in manufacturing, in logistics and in health: can you show it?
Where ISO/IEC 42001 is the standard a buyer is being held to, Prism prepares the management system and the evidence measured against it. Prism does not certify anyone and cannot — certification is issued by an accredited certification body, and a consultant may not audit a management system they implemented. What Prism does is make sure that when the certification body, or the customer, or the insurer arrives, there is something to show them.
The sentence the work produced
A control that works and a control you can prove are not the same asset. The first one keeps your system running. The second one is the only one worth anything on the day somebody asks.
Every governance system eventually meets a person who has to decide whether to believe it. Build for that person.
Sources cited
- ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system. iso.org/standard/81230.html
- ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems. The basis for the statement that a certification body must be accredited and impartial, and may not certify a management system it consulted on. iso.org/standard/61651.html
- Prism AI Analytics, CM-AI: Configuration Management for AI Agents, published CC-BY-4.0. prismaianalytics.com/blog/configuration-management-for-ai-agents/
- The ninety-day demand window is Prism’s own internal test, recorded in the firm’s decision log at the time. Its result and its limitations are described above.
Michele Fisher is the founder of Prism AI Analytics. Prism makes AI governance provable and publishes its own operating record as it goes.
