Where new approaches to
platform assurance are
explored and tested.
Not everything in assurance is solved. Labs is where Aethos works on the problems that don't have a clear answer yet—prototype models, experimental approaches, and early-stage thinking on where platform assurance needs to go.
Rougher edges than the rest of the platform. That's by design. The point is exploration, not polish. Two prototypes are currently live and interactive below.
The work that doesn't fit anywhere else.
Dialogue has a defined purpose. Frameworks have defined outputs. Labs is where Aethos works on things that are still being figured out—which is exactly where the most important assurance problems tend to live right now.
Prototype Control Models
Early-stage control architectures for environments where no solid model currently exists. Not finished frameworks—working prototypes that get pressure-tested against real audit scenarios before they graduate into something more formal.
Experimental Validation Approaches
New ways of thinking about what "testing a control" means in a system that changes continuously. Exploring how evidence design, sampling logic, and operating effectiveness need to evolve for modern platforms.
Practitioner Tooling
Conceptual and working tools for practitioners who spend time inside audit engagements—control rationalization, evidence workflow, domain-grounded AI assistance, and coverage analysis for complex technology stacks.
Cross-domain Experiments
Exploring the intersections that current disciplines treat as separate: where security engineering meets audit evidence, where platform governance meets control design, where DevSecOps meets SOX compliance.
Labs feeds the rest of the platform.
Nothing that comes out of Labs is finished. But the best of it eventually becomes the foundation for something that is.
Aethos Labs
Exploration and prototype. Rough edges. Working hypotheses.
Aethos Frameworks
Validated models become opinionated, structured frameworks.
Aethos Dialogue
Frameworks stress-tested against real enterprise complexity through direct practitioner exchange.
The path isn't always linear—some Labs work feeds directly into Research, some Dialogue experience feeds back into Labs. But the direction is consistent: exploration toward application.
Two tools currently in development.
Both are interactive. Neither is finished. They represent two distinct questions Labs is working on—one about how practitioners engage with individual controls, and one about how the right set of controls gets determined in the first place.
A domain-trained AI embedded inside the framework. Loads the control you’re looking at as context and answers questions about evidence, testing, and failure modes with the specificity of a specialist—not a general-purpose assistant pointed at a document.
Declare your technology stack. The engine maps each platform to canonical SOX ITGC risks, eliminates redundant controls, and produces the minimum audit-defensible set—with PCAOB rationale for every elimination and live recalculation when a control fails or can’t be implemented.
The two tools are designed to be complementary—one helps you work inside a framework, the other helps you build the right framework for your stack. The interactive demos for both are below.
Aethos Platform Intelligence Agent
Domain-trained across the full framework corpus, grounded in PCAOB AS 2201, SOX §404, COSO, ISO 27001, and SOC 2. Context-aware by design: it loads the control you’re in, knows how to design and implement the controls your organization needs, understands the evidence you need to collect, and knows what your auditor will test. Not a general AI. A specialist.
The hardest part of using a compliance framework isn’t finding the right control. It’s knowing what a specific section means for your exact situation — your platform configuration, your audit scope, your evidence gaps. The Platform Intelligence Agent closes that gap. When you click any section, it already has that content loaded as context. Ask it anything: what the CLI query is proving, whether your evidence is sufficient for ToE, how a specific failure mode applies to your environment.
This is not a general-purpose AI pointed at a document. The agent knows the difference between “SAML enabled” and “SAML enforced.” It knows why the SSO exemption list is the gap auditors consistently miss. It knows what “Required — Configured” means versus “Required — Any Implementation” and what the testing implications are for each. That domain depth — built into the model, not inferred from a prompt — is what makes it useful in an actual audit engagement.
Audit log: disable events → GitHub API / SIEM
Member SAML linkage → GraphQL export
gh api graphql -f query='{ org(login:"ORG") { samlIdentityProvider { ssoUrl }}}'
# Check for SSO disable events (should return empty)
gh api orgs/ORG/audit-log \
-f phrase="action:org.disable_saml" \
--jq '.[] | {actor, action, created_at}'
Aethos Control
Optimization Engine
Most SOX ITGC programs carry more controls than they need — not because the risk demands it, but because controls accumulate across platforms without a systematic rationalization layer. The Control Optimization Engine changes that.
Declare your technology stack. The engine maps each platform to canonical SOX ITGC risk domains, identifies where multiple systems address the same control objective, eliminates redundancy, and produces the minimum viable audit-defensible control set. Every elimination includes a documented PCAOB AS 2201 rationale. When a control cannot be implemented, the engine recalculates — surfacing the specific compensating controls needed to maintain full risk coverage.
The output is a structured, traceable control framework mapped Risk → Control Objective → Implementation, with Design of Controls and Test of Operating Effectiveness procedures for each control in the optimized set.
to inspect coverage
Labs work surfaces first
through the Aethospect.
Early-stage thinking, prototype previews, and experimental models go to subscribers before they're published anywhere else.
Join the AethospectFree. No spam. Unsubscribe anytime.