The CAGE CORPUS establishes the professional canon for continuous security governance in an age of
threat-speed adversaries and regulatory mandates. It defines both the ethical obligations
that govern automated governance systems and the operational domains required to implement
them at the millisecond latency demanded by DORA, NIS2, and the Cyber Resilience Act.
The C.A.G.E. Canons
The ethical pillars that govern the use and development of Continuous Active Governance
1
Protect Society, the Common Good, and the Stability of Infrastructure
Active Governance is a public trust. The architect shall ensure that C.A.G.E. implementations
prioritize the resilience of critical infrastructure and the digital sovereignty of the European
ecosystem over narrow technical or commercial interests.
2
Act Honorably, Honestly, Justly, Responsibly, and Legally
The engine shall be an instrument of truth. The architect must maintain radical transparency in
all automated intervention logic. To obfuscate a drift or manipulate governance telemetry is a
fundamental breach of this Canon.
3
Provide Diligent and Competent Service to Principals
The architect shall reject the "Snapshot Fallacy." It is the duty of the professional to provide
continuous visibility and active intervention, ensuring that the principal's risk posture is never
compromised by the latency of manual auditing cycles.
4
Advance and Protect the Profession
The architect shall contribute to the C.A.G.E. Corpus. By sharing lessons learned from automated
drift cycles and evolving the SPHERE model, we ensure that the profession remains capable of
defending against AI-orchestrated and threat-speed adversaries.
The C.A.G.E. Corpus
The foundational domains of knowledge required to master the framework
1
Drift Dynamics & Decay Modeling
- Quantifying the "89-Day Problem" through empirical measurement
- Calculating the half-life of static security controls in high-velocity environments
- Entropy modeling for security posture degradation over time
- Statistical risk accumulation between governance cycles
2
SPHERE Dimensionality (Advanced Integrity)
- Moving beyond the CIA Triad to five independent dimensions
- Implementing Authenticity verification for AI-driven data streams
- Non-Repudiation evidence standards for automated governance
- Pedigree tracking across complex supply chains and third-party integrations
3
The Active Feedback Loop (AFL)
- The technical engineering of the "Identify → Intervene → Correct" cycle
- Automating remediation without destabilizing business operations
- Human-in-the-loop vs. fully autonomous intervention patterns
- Rollback mechanisms and safety constraints for automated governance
4
Regulatory Mapping & Telemetry
- Translating C.A.G.E. engine data into DORA, NIS2, and Cyber Resilience Act compliance artifacts
- Cross-framework control mappings (ISO 27001, SOC 2, NIST CSF, CMMC)
- Automated compliance evidence generation with cryptographic verification
- Regulatory timeline adherence (4-hour DORA, 24-hour NIS2, 72-hour reporting)
5
Threat-Speed Governance Operations
- Designing governance architectures that operate at millisecond-latency
- Matching adversary speed: continuous detection without human-cycle delays
- Real-time policy enforcement across hybrid cloud and on-premise infrastructure
- Board-level governance dashboards with continuous compliance visibility
A Living Document
The CAGE CORPUS is not static doctrine—it is a continuously evolving body of knowledge maintained
by security professionals implementing continuous governance in production environments.
As new regulatory requirements emerge (AI Act, updated NIS2 guidance, DORA technical standards),
as adversary techniques evolve, and as organizations share lessons learned from automated drift
detection cycles, the CORPUS is updated to reflect the current state of the profession.
How to Contribute
- Security professionals implementing CAGE principles may submit domain updates
- Regulatory specialists can contribute compliance mapping refinements
- Academic researchers may propose new decay models or drift metrics
- All contributions are reviewed quarterly and incorporated with attribution