Extensions

Modular Governance: 13 extensions provide plug-and-play governance capabilities. Each follows a common contract — ExtensionBase subclass, configuration validation, health checks, and OpenTelemetry instrumentation.

Extension Contract

Every extension adheres to these rules:

Accepts config: dict — no hardcoded values
Uses DefaultAzureCredential — zero secrets in code
Persists state to Cosmos DB or Event Grid — no new state stores
Emits OTel spans under afek.extensions.<name>
Implements validate_config(config) → list[str]
Subclasses ExtensionBase from extensions/base.py

Extension Inventory

Extension	ID	Purpose	Key Capabilities
Compliance Mapper	`G-06`	Framework mapping & evidence	Gap analysis, evidence collection, multi-framework support (SOC 2, ISO 27001, NIST AI RMF, EU AI Act, OSFI B-13, PIPEDA)
Data Residency	`G-05`	Sovereignty validation	Boundary enforcement for CA/EU/US/USGov, cross-border transfer controls, deployment validation
Drift Detection	`G-07`	Model output drift	Statistical drift tests (KS, PSI, Chi², JS divergence), alerting, auto-quarantine
Incident Response	`G-08`	AI incident management	Triage, escalation, remediation playbooks, severity classification, timeline tracking
Explainability	`G-04`	Decision transparency	Feature attribution, SHAP analysis, fairness metrics across protected groups
Third-Party Risk	`G-14`	Vendor governance	Vendor assessment, dependency scanning, supply chain risk scoring
DR Failover	`G-15`	Disaster recovery	RTO/RPO definitions, recovery playbooks for Cosmos DB, AI Search, Foundry, Agent Apps
Reporting	`G-16`	Compliance reports	5 report types (executive, compliance, risk, operational, audit), evidence packaging
Sovereign Keys	`G-21`	Key management	Automated rotation, 3 policy tiers (standard/high/sovereign), 4 data classifications
Confidential Compute	`G-20`	TEE operations	SEV-SNP attestation verification, confidential agent deployment, enclave management
Fine-Tuning	`G-19`	Model fine-tune governance	6 safety dimensions evaluation, training data audit, bias detection in fine-tuned models
Lifecycle Engine	`—`	Agent lifecycle management	State transitions (dev→staging→prod→retired), gate checks, retirement assessment
Token Economics	`—`	Token cost governance	Runtime budget enforcement, circuit breaker, optimization control-plane feature flags, spend attribution

IQ Accelerators

Five accelerators provide intelligence and automation capabilities that compose with extensions for end-to-end governance workflows.

Accelerator	Purpose	Key Operations
Foundry Control Plane	Central governance hub	Risk assessment, policy enforcement, deployment gating
Foundry IQ	Intelligence engine	Queries, trend analysis, anomaly detection, insight generation
Work IQ	Workload intelligence	Task analysis, optimization, capacity forecasting
Fabric IQ	Data intelligence	Pipeline analysis, lineage checking, quality assessment
Red Teaming	Adversarial testing	Attack simulation, vulnerability scanning, resilience scoring

CLI Commands

# List all extensions
python scripts/afek.py extension list

# Get extension details
python scripts/afek.py extension info compliance_mapper

# Run health check
python scripts/afek.py extension health drift_detection

# List accelerators
python scripts/afek.py accelerator list

# Get accelerator details
python scripts/afek.py accelerator info foundry_control_plane

Telemetry Integration

All extensions emit OpenTelemetry spans documented in the Telemetry Schema. The extension_spans section defines span types, operations, and attributes for each extension and accelerator.