AEP Access & Governance Guide

The AIX Enterprise Platform (AEP) serves as an enterprise-grade control tower for AI asset admission, ODCS data contract compliance, and separation-of-duties access control. This guide walks enterprise compliance officers, data stewards, security auditors, and system architects through workspace activation, 7-connector health monitoring, capability contract inspection, automated Cedar policy simulation, dual-node Feishu approval loops, and cryptographic SLSA audit trails.

5 Enterprise Governance Checkpoints

Checkpoint 1: Governed Workspace & 7 Enterprise Connectors

Access the enterprise governance portal (https://aix.snnc.cc/aep/):

• Activate Enterprise Profile: Verify that an enterprise profile (such as SN_PRODUCTION or GOVERNED_PILOT) is active, enforcing privileged baselines.
• Inspect 7 System Connectors: Audit health metrics across infrastructure endpoints, including Alibaba Dataphin, Apache APISIX model routing gateways, IAM/LDAP directories, runtime event buses, and Feishu automation bots.
• Real-time Health Synchronization: Trigger an on-demand probe to test network isolation boundaries and append-only audit persistence.

Checkpoint 2: Capability Discovery & ODCS Contract Review

Navigate to Governance → Capability Catalog (/aep/catalog):

• Asset Discovery: Search through 45+ enterprise-certified agents and business pipelines (e.g., Pricing Review Agent, Fraud Detection Engine).
• ODCS (Open Data Contract Standard) Inspection:
  • Sensitivity Classification: Verify classification levels (Confidential or Restricted), guarding against cross-tenant exposure.
  • Side-Effect Scope: Explicitly categorized as Read-Only or Scoped Write with mandatory audit webhooks.
  • Sandboxing: Validate that execution requires isolated MicroVM runtimes.
• Click Request Access to initiate admission review.

Checkpoint 3: PAM Access Requests & Separation-of-Duties Approvals

Navigate to Operations → Access Requests (/aep/requests):

• Ticket Metadata: Provide project justification, target environment (dev, staging, production), and privilege duration (capped at 90 days).
• Automated Cedar Policy Simulation: The underlying Cedar engine automatically runs conflict detection, identifying separation-of-duties violations and circular privilege hierarchies in milliseconds.
• Dual-Node Approval Pipeline: High-privilege access requests automatically branch into parallel approvals across both the Direct Line Manager and the Corporate Data Security Officer via Feishu or email notifications.

Checkpoint 4: DevEx Pack & CLI Scaffolding Integration

Navigate to Build → Templates & Blueprints (/aep/templates):

• Certified Blueprints: Select verified templates tailored to business domain requirements (e.g., Pricing Review Desk, Campaign Copilot).
• CLI Command Copy: Run pre-configured initialization commands directly in your terminal:

  aix aep init --template tpl-pricing-audit --project proj-sweetnight-commerce

• Production Scaffold Export: Generate standard packages containing manifest.yaml, type-safe ODCS schema definitions, network policy rules, and test suites.

Checkpoint 5: SLSA Cryptographic Audit Ledger & Compliance Trails

Navigate to Observe → Audit Evidence (/aep/audit):

• Tamper-Evident Event Chains: Trace cryptographic evidence across every step:
  1. Entitlement Precheck: Policy evaluation hash and context snapshot;
  2. Two-Person Approval: Dual cryptographic signatures and approval ticket IDs;
  3. Provider Grant Issued: Lower-level credential issuance receipts;
  4. Execution Provenance: SLSA supply chain attestations carrying immutable correlation IDs.
• Compliance Export: Generate timestamped, watermarked audit bundles for internal compliance, SOX 404, and ISO 27001 reviews.

Governance References

• Capability standards and contracts: Capabilities & Contracts
• Formal policies and approval matrices: Governance & Approvals
• Verification logs and provenance: Evidence & Audit