Skip to content
Mike S Ncube
Back to work2026
builtGoverned AI · Control planePrivate repo

Zororo AI OS

Sole builder — early stage, not deployed

Governed AI control plane: every event passes Presidio PII detection, an OPA policy check, risk scoring, then ALLOW / MONITOR / APPROVE / BLOCK, with a hash-chained audit log.

Architecture

Problem

Claims, policy changes, LLM queries and tool calls each need the same governed path. If any control fails, the event must not proceed.

What I built

Every event (claims, policy changes, LLM queries, tool calls) enters one pipeline: PII detection → OPA policy check → risk scoring → ALLOW / MONITOR / APPROVE / BLOCK → hash-chained audit log. Fail closed. MCP gateway: capability tokens and replay protection.

Engineering decisions

  1. 01

    One fixed pipeline for every event type, so claims, policy changes, LLM queries and tool calls share the same controls.

  2. 02

    PII detection uses Microsoft Presidio plus custom recognizers for South African ID, Zimbabwe national ID and asylum/refugee permits.

  3. 03

    OPA (Rego) is the policy check; pytest and Rego policy tests are both in the suite.

  4. 04

    Risk scoring combines fixed rules with anomaly statistics, then emits ALLOW, MONITOR, APPROVE or BLOCK.

  5. 05

    The audit log is tamper-evident and hash-chained.

  6. 06

    If any step fails, the event is blocked by default.

  7. 07

    The MCP gateway uses capability tokens and replay protection.

  8. 08

    LangGraph and pgvector are planned; they are not in the running system.

Outcome

Built. Early stage, not deployed. README reports 310 passing tests, including pytest and Rego policy tests. LangGraph and pgvector are planned. Private repo.