Pharns Genece¶

AI Governance Architect | NIST OLIR Trifecta Cataloged | Patent Holder & Patent-Pending

I govern AI agents so yours don't go rogue.

Runtime AI governance and governed autonomous execution — built, operating, and now cataloged in the NIST OLIR catalog with three Draft Informative References.

I build the governance systems that make AI agents trusted to operate. My runtime AI governance framework, SDOS, is cataloged in the NIST OLIR catalog as a Trifecta of Draft Informative References against AI RMF 1.0 (Reference ID 212), Cybersecurity Framework 2.0 (Reference ID 215), and SP 800-53 Rev 5.2.0 (Reference ID 217) — the first dispatch-time enforcement framework cataloged at the runtime layer across all three federal references. From patent-filed autonomous execution architecture to detection engineering, compliance automation, and RF threat detection, every project here demonstrates one principle: AI without governance isn't safe to ship.

Best fit for teams that need governed AI execution, not just policy decks.

USAF Veteran (service-disabled) · Security Clearance Eligible · Security+/CySA+/PenTest+/SSCP · B.S. Cybersecurity (completed March 2026)

Hire Me → Engage AAM Cyber →

Results at a glance¶

Why I'm different¶

• I implement controls, not just map them. Framework requirements become working configurations, monitoring logic, and documented evidence — not recommendations in a report.
• I connect governance to operations. My work spans control design, technical implementation, telemetry pipelines, and audit-ready outputs. The documentation reflects what actually runs.
• I bring edge-domain depth most candidates don't have. RF/UAS security (USPTO patents, TraceLock™), governed automation systems, and real operator experience across USAF, a prior unmanned systems startup, and active consulting engagements.

Production experience¶

USOG: Internal infrastructure I built and maintained as CEO/Sysadmin (company winding down post-exit). Client engagements via AAM Cyber.

Why hire me for GRC engineering¶

Most GRC professionals write policies and manage spreadsheets. I architect and deploy the technical systems that satisfy those controls — then document them with audit-ready evidence.

Bottom line: I design the framework, build the architecture, and deliver audit-ready evidence.

Featured GRC projects¶

Detection engineering & offensive security¶

AI-augmented security engineering¶

Credentials & frameworks¶

Framework experience: NIST CSF (PR.AC, PR.DS, DE.CM, RS.AN) · CIS Controls v8 · PCI-DSS v4.0 · SOC 2 · ISO 27001 (foundational)

Licenses: FAA Part 107 · HAM/GMRS · Veteran: USAF, service-disabled

View Full GRC Skill Matrix

What clients say¶

"Pharns delivered a complete compliance package with documentation quality that rivals consultants with twice his experience. His ability to implement technical controls while maintaining audit-ready evidence is rare."

— Compliance stakeholder, Healthcare MSP engagement, 2024 (via AAM Cyber, LLC)

Additional references available upon request.

Let's Talk

AAM cybersecurity specialization¶

I don't just secure drones — I've designed, built, and fielded UAV systems.

Advanced Air Mobility (AAM) security requires practitioners who understand the engineering, not just the vulnerabilities. I bring hands-on experience across the full lifecycle:

View Innovation Projects

View All Projects Contact

Frequently asked questions¶

What is runtime AI governance?¶

Runtime AI governance enforces policy on autonomous AI agent actions at the moment of execution, not at policy-document time. It classifies every agent action by risk tier, gates dispatch through governance enforcement points, and produces a tamper-evident audit trail. It is the difference between an AI compliance program that exists on paper and one that actually enforces.

How is SDOS different from AI guardrails or AI safety frameworks?¶

Guardrails and most AI safety frameworks are advisory — they recommend behavior. SDOS is enforcement-bearing — agents physically cannot execute actions the policy layer denies. The framework is cataloged in the NIST OLIR catalog as a Trifecta of Draft Informative References against AI RMF 1.0 (Reference ID 212), CSF 2.0 (Reference ID 215), and SP 800-53 Rev 5.2.0 (Reference ID 217).

What does NIST OLIR catalog inclusion mean?¶

The NIST Online Informative References Program is the federal registry of frameworks that map to NIST core standards. Three SDOS Concept Crosswalks are cataloged: SDOS-RuntimeGov-to-AI-RMF-v1.0 (Reference ID 212), SDOS-RuntimeGov-to-CSF-2.0-v1.0 (Reference ID 215), and SDOS-RuntimeGov-to-SP-800-53-Rev-5.2.0-v1.0 (Reference ID 217) — meaning any organization implementing AI RMF, CSF 2.0, or SP 800-53 has a publicly cataloged pathway to a runtime governance layer that enforces, not just advises. OLIR catalog inclusion is an informative reference, not a NIST endorsement of the framework.

Why does AI agent governance matter for regulated organizations?¶

Federal procurement, EU AI Act compliance, and NIST-aligned vendor risk programs all require demonstrable AI risk management. Most AI governance today is policy documents and post-incident reviews. Regulated organizations need controls that operate at the moment AI agents take action — not after. That is the gap SDOS closes, and the gap NIST has now listed against AI RMF 1.0.

What is the risk of deploying AI agents without runtime governance?¶

Autonomous AI agents take actions that affect data, money, infrastructure, and human safety. Without runtime enforcement, agent actions are ungoverned at the moment they occur. Audit becomes forensic — after the fact, after the loss. Runtime governance moves enforcement to the point of decision, so violations are prevented rather than investigated.