ARTIFICIAL INTELLIGENCE-BASED PROCESS GOVERNANCE AND VERIFICATION SYSTEM AND METHOD

Abstract

This invention relates to a system (1) and method (100) that enables the use of corporate documents in a version-controlled and machine-interpretable control plane in enterprise software development and AI-native enterprise process execution environments, the semantic modeling of said documents with the enterprise ontology and ontology-aware knowledge graph, the activation of the rules determined via the graph for the selected process context in policy-as-code form, and the execution of the production, verification, proof generation and feedback steps within this context.

Description

1 TARIFF AI-BASED PROCESS GOVERNANCE AND VERIFICATION SYSTEM AND METHOD Technical Area 5 This invention is geared towards enterprise software development and artificial intelligence-based (AI-native) enterprise solutions. in process execution environments; version-controlled and machine-generated corporate documents its use as an interpretable control plane, The documents' corporate ontology and ontology-aware infographic with semantics 10 modeling it as such, determined graphically for the selected process context. enabling the rules in policy-as-code form, production, verification, evidence generation, and feedback steps within this context It relates to a system and method that enables its execution. Previous Technique Current studies show that corporate standards are textual and fragmented. Because they are in this state, artificial intelligence systems can identify them consistently. unable to implement; document, decision record, architectural rule and process requirements 20 The relationship between them cannot be derived by machine, and the verification results cannot be based on any particular rule. and the way it is produced based on the context cannot be traced in a verifiable manner, The approved results cannot be fed back into subsequent production runs in a controlled manner. In the current state of the art, code assistants are conversational, generative artificial intelligence. tools and enterprise code completion solutions; document as classic code. (docs-as-code) repositories; Continuous Integration (CI) / Testing on Continuous Delivery / Deployment (CD) lines, Static code analysis process (lint), static analysis, security scan, and distribution gateway. (Deployment gate) mechanisms; 30 that generate compliance reports and evidence artifacts. mechanisms; knowledge graphics and ontology-based knowledge representation; and workflows. 2 Automation and enterprise AI orchestration are distinct approaches. They are known separately. Some solutions generate graphs from domain ontology. We assist in code generation, and some solutions require knowledge of enterprise codebases. Generating productive code recommendations, some solutions are a pre-deployment policy gateway. In practice, some solutions require document updates based on code changes. 5 some solutions suggest proof and compliance reports from corporate tools. It collects. However, the following technical shortcomings persist in current approaches: 1. Most corporate documents are textual, disorganized, and context-sensitive; 10 Artificial intelligence systems cannot interpret these in a deterministic way. 2. The document-as-code approach mostly keeps the document up-to-date; however It does not turn the document into an executable control plane. 3. Ontology or knowledge graph solutions, in most cases, involve searching and acquiring information. It is used for organization; artificial intelligence generation, policy activation, 15 semantic validation and proof packaging in a single pipeline They don't integrate. 4. Distribution gateway or compliance documentation solutions, which typically... It does not pursue knowledge of which policy the ontological context necessitates. 5. Solutions that perform code-document synchronization will display approved changes within 20 days. Closed-loop learning where the information is written back into institutional semantic memory. It does not necessitate the mechanism. 6. Broad enterprise generative AI architectures make enterprise data accessible. It is possible; however, process-based semantic constraint derivation is graph-based. a combination of proof package and human-validated ontology feedback 25 It is not mandatory to offer it. In non-software processes, guidelines, checklists, approval matrices, risk rules, and regulatory obligations often form an interconnected semantic graph Because it is not executed, AI outputs can be monitored and reused. 30 It does not transform into corporate knowledge. 3 Therefore, considering the studies and shortcomings in the current technique... when present, the disconnect between documentation and production reducing, ensuring the correct application of corporate standards according to the context, artificial Semantic consistency, traceability, and auditability in intelligence-assisted processes are 5 increasing, ensuring governance during production, Continuous Integrated Development Environment in the Integration / Continuous Delivery / Distribution Line Artificial intelligence both within and outside of the Integrated Development Environment (IDE). a system that enables its applicability in enterprise-based workflows and It appears that the method is needed. 10 United States patent number US11748395B2 in the known state of the art The document discusses object ontologies and data usage using machine learning. We are talking about a system that enables the development of models. The system in the invention uses artificial intelligence to create an enterprise ontology, application data 15 Usage patterns and / or data dependencies between applications are being developed. Using artificial intelligence, pattern recognition and / or information extraction techniques, the application to create an ontology and / or usage model for common DDL or SQL It can analyze the application's source code to determine its meaning. A semantic Multiple application ontologies and / or data usage to create a central hub 20 The model can be used. The semantic center addresses data redundancy, data usage frequency, potential data quality issues and / or data transfer between applications By analyzing them to identify their dependencies, one or more of the old applications... a data abstraction model that enables communication with multiple data repositories It can be produced. 25 Brief Description of the Invention The goal of this invention is to develop enterprise software and artificial intelligence-based enterprise solutions. in process execution environments; version control and machine-tested processing of corporate documents. its use as an interpretable control plane, 4 the institutional ontology and ontology-aware infographic of the documents and semantics modeling it as such, determined graphically for the selected process context. enabling rules in a political form as code, production, verification, evidence generation and feedback steps are carried out within this context. It is about implementing a system and method developed to provide this. 5 Detailed Description of the Invention The "Artificial Intelligence-Based Process" implemented to achieve the purpose of this invention. The "Governance and Verification System and Method" is shown in the attached document, and this 10 shape; Figure 1 shows a schematic view of the system that is the subject of the invention. Figure 2 shows a schematic view of the invention method. The parts shown in the figures are individually numbered, and these numbers... The corresponding answers are given below. 1. System 2. Document Reference Database as Code 20 3. Ontology Definition Module 4. Ontology Aware Knowledge Graph Database 5. Ontology / Information Graph Creation and Alignment Module 6. Context Selector and Subgraph Generator Module 7. Policy Compiler Module 25 as Code 8. Artificial Intelligence Orchestrator 9. Verification Module 10. Evidence Package and Origin Database 11. Human Consent and Governance Module 12. Feedback and Semantic Update Module 30 Method 100 Enterprise software development and AI-based enterprise process execution. in environments where corporate documents are version-controlled and machine-generated. its use as an interpretable control plane, the aforementioned 5 the institutional ontology and ontology-aware infographic of the documents and semantics modeling it as such, determined graphically for the selected process context. enabling rules in a political form as code, production, verification, evidence generation and feedback steps are carried out within this context. The system that is the subject of the invention was developed to provide (1); 10 - corporate standards, development guidelines, Architectural Decision Log, safety policies, regulatory interpretations, operational guidelines, checklists, approval matrices, integration agreements, and processes to keep records of data in the form of documents document reference database (2), 15 as at least one code structured - organizational concepts, process types, roles, artifact classifications, requirements, relationships, exceptions, risk levels, and types of evidence to represent, in the form of an application, Network Ontology Language, Resource Definition Frame, Shape Constraint Language, another application 20 to use product graphic diagrams and rule definitions in this format It is structured to define at least one ontology that is structured accordingly. module (3), - the contents of the document reference database (2) as code ontology Storing by linking elements, document sections, Architectural Decision Records, services, domain assets, risk controls, process steps, 25 data classes, teams, tools, quality gates, and evidence types Using nodes, with the edges it uses, "makes it mandatory". “effects”, “requires evidence”, “applies”, “defines exceptions”, “role approval” It represents relationship types such as "requires", "updates", and "replaces". knowledge graph 30 structured to be aware of at least one ontology database (4), 6 - concept extraction from documents, ontology mapping, relationships analysis, handling version differences, change impact analysis, and Updating quality assurance involves comparing old documents with new ones. conflicts between policy texts and ontological shift at least one ontology / knowledge structured to identify their states 5 Graphic creation and alignment module (5), - specific tag, user need, code change, process initiation Which document, rule, decision, role and for the request or operational event? Determining which types of evidence are relevant, process type as input, domain, technology stack, risk level, data class, environmental conditions, 10 Retrieving data in the form of regulation area and change type, output at least one structured to generate context-specific subgraphs. context selector and subgraph generator module (6), - The requirements, constraints, and exceptions in the selected subgraph can be enforced. Converting to policy rules, allowed dependency list, data processing 15 constraints, network separation, confirmation chain, test threshold, scope threshold, contract verification, guideline requirement or audit artifact the most structured to transform requirements into a policy package policy compiler module (7) as a small code - Generating a task plan using the selected sub-graph and policy package; 20 code, configuration, workflow, manual, form, decision summary, or other at least one artificial intelligence configured to generate process artifacts orchestrator (8), - testing, static code analysis process, Static Application Security Testing, Software Composition Analysis, Software Bill of Materials, contract testing, 25 along with classic quality gates in the form of infrastructure verification. at least one validation configured to execute semantic gates module (9), - for each execution; the ontology version used, the subgraph definition, policy revision, model / agent identity, command / prompt or plan 30 summary, verification results, human validation records and generated 7 Keeping a record of the evidence package linking the artifacts, which results Questions such as "According to what rule was it produced?" can be made verifiable. at least one evidence package and origin data structured to retrieve it base (10), - withdrawal request approval, transit approval, electronic approval flow, risk acceptance 5 or managing processes such as exception approval, specific charts Which role or which multiple approvals depending on the nodes at least the combination is structured to determine what is needed a human approval and governance module (11), - learning from approved or rejected results, accepted 10 resolution patterns, grounds for exceptions, new types of evidence, and current trends. rules as code with document reference database (2) ontology / information to write back to the graph creation and alignment module (5) at least one configured feedback and semantic update module (12) includes. 15 The document reference database (2) is the code included in the system (1) which is the subject of the invention. Corporate standards, development guidelines, Architectural Decision Log (Architecture Decision Record (ADR), safety policies, regulatory interpretations, studies. runbooks, checklists, confirmation matrices, integration agreements 20 and keeping records of data in the form of process documents, textual and Receiving data as input in the form of structured documents, versioned The output includes data such as reference content, change history, and review records. It is structured to transmit in this way. The ontology definition module (3) in the system (1) that is the subject of the invention, institutional concepts, process types, roles, artifact classes, necessities, relationships, To represent exceptions, risk levels, and types of evidence, in a form of practice. Web Ontology Language (OWL), Resource Description Resource Description Framework (RDF), Shape Constraint Language (Shapes 30) 8 Constraint Language (SHACL), product graphics in another application form. It is configured to use schema and rule definitions. The ontology-aware knowledge graph database (4) included in the system (1) that is the subject of the invention, as code the contents of the document reference database (2) with ontology elements 5 Storing by linking, document sections, Architectural Decision Records, services, domain assets, risk controls, process steps, data classes, teams, tools, Using nodes in the form of quality gates and evidence types, the method it uses with margins; “mandates”, “affects”, “requires evidence”, “applies”, “defines exceptions”, Representing relationship types such as "requests role approval", "updates", and "replaces". 10 It is structured to do so. Ontology / information graphic creation and alignment in the system (1) that is the subject of the invention module (5), concept extraction from documents, ontology mapping / mapping (Mapping), relationship analysis, version difference handling, change impact analysis 15 and updating quality assurance, comparing old documents with new policies to identify conflicts and ontological shifts between the texts It is structured accordingly. The context selector and subgraph generator module (6) in the system (1) that is the subject of the invention, 20 a specific tag, user need, code change, process initiation request or Which types of documents, rules, decisions, roles, and evidence are relevant to the operational event? To determine this, the inputs include process type, domain, technology stack, and risk. level, data class, environmental condition, regulatory area and type of change 25 to retrieve data and produce context-specific subgraphs as output. It is being structured. The policy compiler module (7) is the code included in the system (1) that is the subject of the invention. The requirements, restrictions, and exceptions in the selected subgraph can be implemented into policy rules. translation, allowed dependency list, data processing constraints, network separation, checksum, test 30 threshold, scope threshold, contract verification, runbook requirement or 9 to transform audit artifact requirements into a policy package It is being structured. The artificial intelligence orchestrator (8) in the system in question (1) selects the sub-graph and Generating a task plan using the policy package; code, configuration, workflow, 5 to produce guidelines, forms, decision summaries, or other process artifacts It is structured. The artificial intelligence orchestrator (8) determines which tools to call, which data sources will be used, and which verification steps are mandatory. to decide what is the situation and in what circumstances human intervention is needed It is being structured. 10 The verification module (9) in the system (1) which is the subject of the invention, test, static code analysis process (lint), Static Application Security Testing Testing (SAST), Software Composition Analysis (Software Composition Analysis- SCA), Software Bill of Materials (SBOM), contract 15 semantic testing, along with classic quality gates in the form of infrastructure verification. It is configured to operate the gates. The validation module (9) is semantic Thanks to the gates; graph integrity, ontology constraint compliance, architectural layer violation, Prohibition, addiction, lack of evidence, incorrect role matching, lack of consent, contradictory policies. or to identify situations involving process-step skipping 20 It is being structured. The evidence package and origin database (10) included in the system in question (1) each For execution; the ontology version used, subgraph definition, policy revision, model / agent ID, command / prompt or plan summary, verification 25 a package of evidence linking the results, human confirmation records, and generated artifacts keeping records, questions such as which result was produced according to which rule It is structured to make it auditable. The human approval and governance module (11) in the system (1) which is the subject of the invention, pull 30 request approval, ticket transition approval, electronic approval flow, risk acceptance or Managing processes such as exception approval, tied to specific graph nodes. to determine which role or which combination of multiple approvals is required It is structured accordingly. The feedback and semantic update module in the system (1) is 5 (12), learning from approved or rejected results, accepted solution code patterns, grounds for exceptions, new types of evidence, and current rules. as a document reference database (2) and creating an ontology / knowledge graph and It is configured to write back to the alignment module (5). Enterprise software development and AI-based enterprise process execution. in environments where corporate documents are version-controlled and machine-generated. its use as an interpretable control plane, the institutional ontology and ontology-aware infographic of the documents and semantics modeling as such, 15 determined graphically for the selected process context. enabling rules in a political form as code, production, verification, evidence generation and feedback steps are carried out within this context. The inventive method developed for the purpose of providing (100); - a business request, user story, bug, architectural change, or Information regarding regulatory requirements and type of request, 20 service area, risk level and target technology stack Determination of information (101), - related document, Architectural Decision Record, policy, role, type of evidence and Generating the subgraph containing the validation rules (102), - Generating an executable rule set from the selected subgraph and the same subgraph 25 Creating a production plan using the graph (103), - Code, configuration, testing, pipeline definition, Architectural Decision Log drafts, document updates or equivalent artifacts production (104), 11 - semantic validations with classic continuous integration checks running them together and, if necessary, the automatic correction cycle execution (105), - evidence package including verification outputs and origin information creation (106), 5 - along with a package of evidence for the defined role or combination of roles. Review of the artifacts produced and decision on approval, rejection or exception. (107), - code merging, distribution progress, or once approval is received. The process progresses; if the conditions are not met, the transition is 10 days. prevention (108), - rewriting of approval reasons, corrections and new patterns (109) It includes the steps. Industrial application of the invention 15 The invention is about system (1) and method (100) corporate software development and artificial In intelligence-based enterprise process execution environments; version control of corporate documents its use in the form of a controlled and machine-interpretable control plane, these documents include the corporate ontology and ontology-aware infographic and 20 semantically modeling it, graphically for the selected process context. the activation of the established rules in a political form as code, production, verification, evidence generation, and feedback steps within this context It is structured to ensure its implementation. Around these fundamental concepts, the subject of the invention is "Artificial Intelligence-Based Process". There are many different types of “Governance and Verification System (1) and Method (100)”. It is possible to develop applications, and the invention is illustrated with the examples described here. It cannot be restricted, it is essentially as stated in the claims.

Claims

12 REQUESTS 1. Enterprise software development and AI-based enterprise processes in execution environments; version-controlled and operational corporate documents its use as a control plane that can be interpreted by the machine, word 5 The subject of the documents is the institutional ontology and ontology-aware infographic. semantically modeling it, graphically for the chosen process context. rules determined through this in a political form as code activation, production, verification, proof generation, and feedback. to ensure that the steps are carried out within this context 10 developed; - corporate standards, development guidelines, Architectural Decision Log, safety policies, regulatory interpretations, operational guidelines, checklists, approval matrices, integration agreements, and processes 15 to keep records of data in the form of documents Document reference database (2) with at least one code structured. - organizational concepts, process types, roles, artifact classifications, requirements, relationships, exceptions, risk levels, and types of evidence to represent, in the form of an application, Network Ontology Language, Resource Definition Framework, Shape Constraint Language, another application 20 to use product graphic diagrams and rule definitions in this format It is structured to define at least one ontology that is structured accordingly. module (3), - the contents of the document reference database (2) as code ontology Storing by linking elements, document sections, Architectural Decision 25 Records, services, domain assets, risk controls, process steps, data classes, teams, tools, quality gates, and evidence types Using nodes, with the edges it uses, "makes it mandatory". “effects”, “requires evidence”, “applies”, “defines exceptions”, “role approval” 30 Represents relationship types such as "wants", "updates", and "replaces". 13 a knowledge graph structured to be aware of at least one ontology database (4), - concept extraction from documents, ontology mapping, relationships analysis, handling version differences, change impact analysis, and Updating quality assurance involves comparing old documents with new ones. conflicts between policy texts and ontological shift at least one ontology / knowledge structured to identify their states Graphic creation and alignment module (5), - specific tag, user need, code change, process initiation Which document, rule, decision, role and 10 for the request or operational event? Determining which types of evidence are relevant, process type as input, domain, technology stack, risk level, data class, environmental conditions, Retrieving data in the form of regulation area and change type, output at least one structured to generate context-specific subgraphs. context selector and subgraph generator module (6), 15 - The requirements, constraints, and exceptions in the selected subgraph can be enforced. converting to policy rules, allowed dependency list, data processing constraints, network separation, confirmation chain, test threshold, scope threshold, contract verification, guideline requirement or audit artifact EN 20 is structured to transform its requirements into a policy package. policy compiler module (7) as a small code - Generating a task plan using the selected sub-graph and policy package; code, configuration, workflow, manual, form, decision summary, or other at least one artificial intelligence configured to generate process artifacts orchestrator (8), 25 - testing, static code analysis process, Static Application Security Testing, Software Composition Analysis, Software Bill of Materials, contract testing, along with classic quality gates in the form of infrastructure verification. at least one validation configured to execute semantic gates module (9), 30 14 - for each execution; the ontology version used, the subgraph definition, policy revision, model / agent identity, command / prompt or plan summary, verification results, human validation records and generated Keeping a record of the evidence package linking the artifacts, which results Questions such as "According to which rule was it produced?" can be verified. 5 at least one evidence package and origin data structured to retrieve it base (10), - withdrawal request approval, transit approval, electronic approval process, risk acceptance. or managing processes such as exception approval, specific charts Which role or which multiple approvals depending on the nodes 10 at least the combination is structured to determine what is needed a human approval and governance module (11), - learning from approved or rejected results, accepted resolution patterns, grounds for exceptions, new types of evidence, and current trends. rules as code document reference database (2) with ontology / information 15 to write back to the graph creation and alignment module (5) at least one configured feedback and semantic update module a system characterized by (12) (1).

2. Corporate standards, development guidelines, Architectural Decision Log, security 20 policies, regulatory interpretations, work guides, checklists, approval matrices, integration agreements, and process documents keeping data on record, textual and structured documents receiving data in this format as input, versioned reference content, modification 25 to transmit the data in the form of historical records and investigation reports. characterized by the document reference database (2) as structured code. A system like the one in Request 1 (1).

3. Institutional concepts, process types, roles, artifact classifications, requirements, relationships, exceptions, risk levels, and types of evidence 30 to represent, in the form of an application, Network Ontology Language, Resource Definition Frame, Shape Constraint Language, in another form of implementation configured to use product graphic schema and rule definitions from the above requests characterized by the ontology definition module (3) a system like any other (1).

4. Ontology of the contents (2) in the document reference database as code Storing by linking elements, document sections, Architectural Decision Records, services, domain assets, risk controls, process steps, data. classes, teams, vehicles, quality gates, and types of evidence Using nodes, with the edges it uses; “requires”, “affects”, 10 “requires evidence”, “applies”, “defines exceptions”, “requires role approval”, “updates”, structured to represent relationship types such as "replacement" ontology awareness characterized by knowledge graph database (4) a system like any of the above requests (1).

5. Concept extraction from documents, ontology mapping. relationship analysis, version difference handling, change impact analysis, and Updating quality assurance, comparing old documents with new policies. Identifying conflicts and ontological shifts between the texts Ontology / knowledge graph creation and alignment structured for 20 any of the above requests characterized by module (5) a system like one of them (1).

6. A specific label, user need, code change, process initiation request. or which document, rule, decision, role and evidence for the operational event 25 To determine if the types are relevant, process type and domain are entered as input. technology stack, risk level, data class, environmental conditions, regulatory area and receiving data in the form of change type, outputting context-specific sub- Context selector and subgraph generator configured to produce graphs. 16 in any of the above requests characterized by module (6) such a system (1).

7. Enforceable policies for requirements, restrictions, and exceptions in the selected subgraph. Converting to rules, allowed dependency list, data processing restrictions, network 5 separation, confirmation chain, test threshold, scope threshold, contract verification, policy requirements for guidance or audit artifact requirements Policy compiler as code configured to convert to package in any of the above requests characterized by module (7) such a system (1). 10 8. Generate a task plan using the selected sub-graph and policy package; code, configuration, workflow, guide, form, decision summary, or other process with an artificial intelligence orchestrator (8) structured to produce artifacts a 15 as in any of the above characterized claims system (1).

9. Which tools will be called upon, which data sources will be used, which verification steps are mandatory and in what situations human artificial intelligence structured to decide when intervention is necessary 20 any of the above requests characterized by its orchestrator (8) a system like one of them (1).

10. Testing, static code analysis process (lint), Static Application Security Testing (Static Application Security Testing (SAST), Software Composition Analysis (Software 25 Composition Analysis (SCA), Software Bill of Materials Materials-Based Optimization (SBOM), contract testing, and infrastructure validation are classic methods. configured to operate semantic gates along with quality gates from the above requests characterized by the verification module (9) a system like any of them (1). 30 17 11. Through semantic gates; graph integrity, ontology constraint compatibility, architecture layer breach, prohibited addiction, missing evidence, wrong role match, missing approval, conflicting policies or process-stepping situations 5 characterized by the verification module (9) configured to detect a system like any of the above-mentioned requests (1).

12. For each execution; the ontology version used, the subgraph definition, and the policy. revision, model / agent ID, command / prompt or plan summary, verification results, human verification records, and generated artifacts 10 keeping a record of the evidence package connecting the two, determining which result corresponds to which rule to make questions such as "was it produced according to..." verifiable characterized by the structured evidence suite and origin database (10) a system like any of the above requests (1).

13. Withdrawal request approval, transit (ticket transition) approval, electronic approval flow, Managing processes such as risk acceptance or exception approval, specific charts Which role or which multiple approvals depending on the nodes human approval structured to determine if the combination is necessary 20 of the above requests characterized by the governance module (11). a system like any other (1).

14. Learning from approved or rejected outcomes, the accepted solution. patterns, grounds for exceptions, new types of evidence, and current rules Ontology / Information Graphic 25 with document reference database (2) as code back configured to write back to the create and align module (5) characterized by the feed and semantic update module (12) a system like any of the above requests (1). 18 15. Enterprise software development and AI-based enterprise processes in execution environments; version-controlled and operational corporate documents its use as a control plane that can be interpreted by the machine, word The subject of the documents is the institutional ontology and ontology-aware infographic. semantically modeling it with the selected process context, graph 5 rules determined through this in a political form as code activation, production, verification, proof generation, and feedback. in order to ensure that the steps are carried out within this context developed; - a business request, user story, bug, architectural change, or 10 Information regarding regulatory requirements and type of request, service area, risk level and target technology stack Determination of information (101), - related document, Architectural Decision Record, policy, role, type of evidence and Generating the subgraph containing the validation rules (102), 15 - generating an executable rule set from the selected subgraph and the same subgraph Creating a production plan using the graph (103), - Code, configuration, testing, pipeline definition, Architectural Decision Log drafts, document updates or equivalent artifacts production (104), 20 - semantic validations with classic continuous integration checks running them together and, if necessary, the automatic correction cycle execution (105), - evidence package including verification outputs and origin information creation (106), 25 - along with a package of evidence for the defined role or combination of roles. Review of the artifacts produced and decision on approval, rejection or exception. (107), - code merging, distribution progress, or once approval is received. The process status progresses; if the conditions are not met, the transition is 30 days. prevention (108), 19 - rewriting of approval reasons, corrections and new patterns (109) a method characterized by (100). 10 20 30

Images