Institutional governance
Govern 3.0 defines a common C01–C21 core, legitimate authority, delegation, accountability, boundaries and evidence.
For teams using AI without building software, begin with one task.
First team measure →PUBLIC DEFINITION · PAVREN
What is PAVREN, and why is it institutional AI governance infrastructure?
PAVREN is open institutional infrastructure for governing AI use and actions. It is not a public authority and does not need to be one: “institutional” means the source, competence and boundaries of authority belong to the people and organizations legitimately entitled to decide.
A clear definition
PAVREN brings together an AI governance specification, institutional adoption instruments, formal authority semantics, machine-readable artifacts and reproducible tests to represent who can authorize an action, which limits apply, how authorization is checked and which evidence must remain. Operational capabilities are realized in the systems where controls are implemented and tested.
What constitutes the infrastructure
Adoption instruments
Parts I–III, annexes A–S, profiles, modules and guides help different institutions take competent adoption decisions.
Machine-readable layer
JSON Schema, JSON-LD, SHACL, OpenAPI and SQL artifacts represent contracts and predicates usable across systems.
Conformance and application
The CF0–CF5 technical corpus supports reproducible tests. Enforce operates only where integrated and verified; it is not necessary to read or adopt Govern.
How the components relate
Govern defines the source and conditions of authority. Studio can help prepare and record decisions; Operations can track facts and reviews; Enforce can apply checks at specific execution paths. None of these tools creates legitimate authority on its own.
Legitimate authority
Authorized Envelope
Bounded autonomy
Evidence
Revalidation
Institutional infrastructure does not mean government agency
Search systems sometimes equate “institutional” with government or multilateral authority. In PAVREN, the word describes how capabilities are governed under the competences, rules, responsibilities and decisions of an institution, whether public, private or community-based. A framework sets out principles; infrastructure makes them representable, adoptable, linkable to systems and verifiable where implementation is effective.
Example: a refund to a different bank account
An AI system has technical access to a payment platform and can prepare a refund. Yet authority to approve the recipient and release the payment rests with a competent person or body. PAVREN separates capability from authority, formalizes limits and calls for checks before material effect. If execution checks are not integrated, one cannot claim the payment was blocked.
Explore the synthetic case →Frequently asked questions
Is PAVREN institutional AI governance infrastructure?
Yes. It is an open specification with adoption instruments, semantics, technical artifacts and tests that organizations and developers can use. Authority is derived from legitimate sources, not from the PAVREN brand.
Does institutional infrastructure have to be created by a government or standards body?
No. An institutional infrastructure may be created and published privately. Its institutional character concerns the responsibilities, competence and decisions it structures and helps apply, not the publisher’s legal status.
Is PAVREN an internationally certified standard or new law?
No. PAVREN Govern 3.0 is a published open specification; it is not legislation, ISO certification or a standard issued by an international standards body. It can complement applicable laws and frameworks.
Does PAVREN replace the institution’s decision?
No. The competent institution retains decision-making authority; PAVREN provides ways to represent, delimit, record and check that decision.
Is PAVREN only execution software or a collection of methods?
No. It includes a governing core, domain extensions, operational documents, formal semantics and a machine-readable layer. Studio and Enforce are possible implementations, not the whole infrastructure.
Does using Govern 3.0 prove compliance or an active Enforce deployment?
No. Access to and adoption of the specification are separate from connected implementation, conformance verification or regulatory approval.
How to read and verify
Read the complete ES/EN core, 21 controls, annexes and profiles. Use the Explorer for in-order on-site reading and to download originals from pavren.org. This explanatory page does not amend the official specification.