Skip to content

AI Governor

Jump to bottom
ghartrid edited this page Feb 9, 2026 · 1 revision

AI Governor

The AI Governor is PhantomOS's policy enforcement engine, implementing the core philosophy: "To Create, Not To Destroy." It monitors all system operations, blocks destructive actions, and provides behavioral analysis with machine learning capabilities.

Architecture

The Governor sits between application requests and kernel operations. Every potentially destructive action passes through policy checks before execution.

Application Request
       |
   Governor Check
       |
  +----+----+
  |    |    |
ALLOW DENY TRANSFORM
  |         |
Execute   Safe Alternative

Policy Domains

Domain Flag Covers
Memory 0x0001 Memory freeing, overwriting
Process 0x0002 Process kill, termination
Filesystem 0x0004 Delete, truncate, overwrite
Resource 0x0008 Resource exhaustion

Verdicts

Verdict Description
GOV_ALLOW Operation permitted
GOV_DENY Operation forbidden
GOV_TRANSFORM Converted to safe alternative (e.g., delete becomes hide)
GOV_AUDIT Allowed but logged as suspicious

Evolution (v1 through v4)

v1: Basic Policy Engine

  • Policy check/enforcement for memory, process, filesystem, resource operations
  • Circular audit buffer (128 entries)
  • Capability-based access control

v2: Predictive Intelligence

  • Predictive threat trends (rising/falling/stable)
  • Health score (0-100) with progress bar visualization
  • Decision explanations in audit entries
  • Interactive 8-page system tutorial

v3: Anomaly Detection

  • Memory spike detection: Flags sudden allocation surges
  • Process surge detection: Alerts on rapid process creation
  • Violation burst detection: Identifies repeated policy violations
  • Malicious pattern recognition: Detects known attack patterns
  • Context-aware AI responses: Tags like [!ALERT], [MEM HIGH], [HEALTH LOW]
  • Alerts command: Query current anomaly state

v4: Behavioral Learning

  • Per-policy normalcy profiles: Learns baseline behavior for each policy
  • Deviation detection: Flags operations that deviate from learned norms
  • Threat timeline: Bar chart visualization of threat history
  • Smart recommendations: Actionable suggestions based on system state
  • Quarantine system: Capture suspicious operations for manual review

Governor GUI

The Governor window has three tabs:

Overview Tab

  • Current threat level (LOW / MEDIUM / HIGH / CRITICAL)
  • Health score with progress bar
  • Active anomaly indicators
  • Threat timeline bar chart

Audit Tab

  • Scrollable audit log showing recent policy decisions
  • Each entry shows: policy, verdict, domain, timestamp, reason
  • Decision explanations for transform/deny verdicts

Config Tab

  • Interactive checkboxes to enable/disable individual policies
  • Per-policy statistics

AI Assistant

The desktop includes an AI Assistant panel (right side) that integrates with the Governor:

  • Text input for questions
  • Context-aware responses drawing from real system state
  • Recognizes conditions: memory pressure, health drops, active alerts
  • Tags responses with situational markers
  • Fuzzy string matching for natural-language queries

API

// Core
void governor_init(void);
gov_verdict_t governor_check_policy(gov_policy_t policy, gov_caps_t caps, const char *reason);

// Audit
void governor_log_audit(gov_policy_t policy, gov_verdict_t verdict, const char *details);
void governor_audit_record(const char *policy, const char *verdict,
                          const char *domain, const char *arg1,
                          const char *arg2, const char *reason);

// Control
void governor_enable_policy(gov_policy_t policy);
void governor_disable_policy(gov_policy_t policy);

// Diagnostics
void governor_dump_audit(void);
void governor_dump_stats(void);
const char *governor_verdict_string(gov_verdict_t verdict);

Clone this wiki locally