The instrument and the program.
.png/:/rs=w:1240,cg:true,m)
The 5×5 Control Matrix™ is the instrument. The AI Control Assessment™ is the diagnostic built around it.
The Matrix measures where an institution stands — its demonstrable ability to own, control, and audit the AI behind its decisions, across all twenty-five intersections of five pillars of control by five AI ecosystems. The Assessment applies that instrument in two directions.
- Deep — the institution's own matrix: its demonstrable control over the AI it operates directly, from power to agents.
- Wide — a matrix for every material relationship in its chain. Institutions do not operate most of the AI they depend on; it runs inside the managers, servicers, and providers they delegate to. The Assessment maps that chain and runs the same instrument on each — a distinct matrix per relationship, because the same provider reads differently for every institution. Control lives in the contract and the reach it grants, not in the vendor.
The Assessment sets the reading against your peer group, calibrates it to where your obligations require you to be, and returns the distance as a defined control program.
One instrument. Deep and wide. One program.
BEFORE YOU TAKE THE ASSESSMENT
If any of these questions does not have a confident, evidenced answer, the assessment will show you why — and exactly which intersection of the Matrix is exposed.
How ThE AI Assessment™ Works: Three Steps
.png/:/cr=t:0%25,l:0%25,w:100%25,h:100%25/rs=w:600,cg:true)
Most frameworks begin by asking where you want to go. This assessment begins by establishing where you actually stand — deep within your institution, and wide across the chain you depend on. The distinction is deliberate.
Strategy without an honest baseline is aspiration. A baseline without benchmarking lacks urgency. Both without a strategic direction lack purpose.
The three steps work together, and they work in this order.
Where does our AI control stand today?
The 5×5 Control Matrix™
The Matrix reads your institution's demonstrated ability to own, control, and audit the AI systems behind its decisions. It applies five dimensions of control — Jurisdictional, Logical, Technical, Operational, and Contractual — independently to each of five AI ecosystems: Power, Compute, Data Centers, Models, and Agents.
The result is twenty-five specific, answerable control questions. Each intersection is placed on a five-tier scale — Sovereign, Governed, Evolving, Reactive, or Not Disclosed — according to what the evidence supports, not what policy asserts. The pattern across the twenty-five cells shows not only how well-controlled your AI is overall, but exactly which intersections are exposed and where investment will change the most.
The Matrix reads the record, not the reputation. A tier above the baseline requires an identifiable, auditable mechanism — control is never inferred from an institution's size, its spending, or the volume of its AI activity.
The finding that recurs. Across institution types, the Models and Agents ecosystems are consistently the least controlled. This is structural, not incidental. External model providers process institutional queries on their own infrastructure, retain interaction logs in their own systems, and operate under terms most institutions have never negotiated against their fiduciary obligations. Enterprise tiers offering zero-retention and confidential inference exist; few institutions have negotiated them, and fewer still have verified that what the contract promises is what the architecture actually enforces. This is not a worst-case scenario. It is the ordinary operational reality of how AI is served today.
STEP 2 — How do we compare to our peers? Sector Benchmarking
A control position means little in isolation. The same standing can be reassuring or alarming depending entirely on where the peer group sits.
Benchmarking places your Matrix reading against institutions of comparable size, regulatory obligation, and AI use — turning a standing into a position.
It also establishes urgency: a posture that looks acceptable on its own becomes a board conversation when it sits below the peer range.
STEP 3 — Where do we need to go? The 0–160 Strategic Assessment
The strategic evaluation weighs your regulatory obligations, AI dependency, risk tolerance, and financial capacity, and returns a single strategic direction on a 0–160 scale. The score maps to one of four infrastructure strategies:
- 0–40 · RENT — Managed cloud under standard controls; AI is supplementary.
- 41–80 · RENT + CONTROL — Enhanced contractual controls and customer-held encryption keys.
- 81–120 · COMPOSE — Hybrid architecture: own the critical ecosystem, rent the rest.
- 121–160 · BUILD — Full institutional infrastructure and independence.
The Build–Compose–Rent + Control–Rent framework identifies the destination. It is not a judgment that more infrastructure is better; the right strategy is the one your obligations require, which for many institutions is Compose or Rent + Control rather than Build.
THE GAP BETWEEN STEP 1 AND STEP 3 IS YOUR PROGRAM
The Matrix tells you where you stand — deep and across your chain. The 0–160 tells you where your obligations require you to be. The benchmark tells you how urgently.
The distance between them — intersection by intersection, relationship by relationship — is the control program.
WHAT YOU RECEIVE
A tiered, benchmarked control profile — deep within your institution, and wide across your chain.
A tiered, benchmarked, and strategically calibrated control profile — deep, and wide across your chain.
Depending on the scope agreed for your institution, an engagement may include:
- YOUR CONTROL MATRIX — THE DEEP READING. Your institution's standing across all twenty-five intersections of the 5×5 Control Matrix™, with cell-by-cell findings placing each on the five-tier scale and identifying every exposed intersection in the AI you operate directly.
- RELATIONSHIP MATRICES — THE WIDE READING. A distinct matrix for each material relationship in your delegation chain — your managers, servicers, and providers — read through the same twenty-five intersections. The same provider reads differently for every institution, because control lives in the contract and the reach it grants; the wide reading shows where your duty extends further than your contracts currently reach.
- THE PEER BENCHMARK. Your matrix readings positioned against institutions of comparable size, sector, and regulatory profile, with peer-range context.
- THE STRATEGIC EVALUATION. Your strategic direction and its recommendation — Rent, Rent + Control, Compose, or Build — calibrated to your obligations, dependency, risk tolerance, and capacity.
- THE CONTROL PROGRAM. A structured map of the gaps between current standing and required standing — intersection by intersection, and relationship by relationship — prioritized by impact and sequenced by dependency.
- A CONFIDENTIAL DEBRIEF. A working session with Institutional AI leadership to walk through the findings and discuss next steps.
The composition and depth of each engagement are scoped to the institution's obligations, AI footprint, and delegation chain. Not every element applies to every institution.