Secure-by-Design AI: Operationalizing Security Through Deterministic Runtime Governance

Runtime Governance Engineering Series — Volume 2

By John M. Willis | First Edition | October 2026

How do you ensure that an AI system's actions remain authorized, secure, and enforceable when they produce real-world consequences?

Traditional cybersecurity controls, AI risk management frameworks, and model-level guardrails provide essential protections. But as AI systems become increasingly autonomous, an additional engineering challenge emerges: ensuring that consequential actions satisfy applicable security and governance requirements at the moment of execution.

Secure-by-Design AI addresses this challenge through deterministic runtime governance—establishing enforceable boundaries between AI-generated proposals and operational consequences.

Written particularly for Information System Security Officers (ISSOs), Information System Security Engineers (ISSEs), security architects, control owners, and assessors, this volume provides a practical engineering approach for applying established security controls to autonomous and agentic AI systems.

What You'll Learn

• Operationalize Secure-by-Design principles using established cybersecurity controls and engineering practices.
• Apply NIST SP 800-53 to runtime AI governance through existing control-selection, tailoring, implementation, and assessment processes—without requiring a new control catalog or overlay.
• Engineer deterministic execution controls that evaluate authority, admissibility, operational context, and supporting evidence before consequential actions are committed.
• Translate security objectives into SSP implementation statements, including control responsibilities, inherited controls, enforcement mechanisms, and assessable evidence.
• Distinguish governance decisions from actual enforcement, including the need to constrain bypass paths and verify outcomes at affected targets.
• Assess runtime governance effectiveness using failure-oriented testing, evidence requirements, and independently observed operational outcomes.

From Security Policy to Verifiable Enforcement

The book connects runtime governance engineering with major cybersecurity and AI governance frameworks, including:

• NIST SP 800-53
• NIST AI Risk Management Framework
• CISA Secure by Design
• MITRE ATLAS
• ISO/IEC 42001

It includes a detailed ISSO/ISSE control-selection and SSP documentation workflow, a worked security-control implementation example, multi-system failure analysis, critical-infrastructure scenarios, framework crosswalks, and practitioner-oriented appendices.

A central principle runs throughout: a security policy, an authorization decision, or an audit record is not equivalent to demonstrated control over execution. Security assurance requires effective enforcement at the relevant operational boundary and evidence supporting the claimed outcome.

Who Should Read This Book?

This volume is intended for:

• U.S. government and federal contractor cybersecurity professionals
• ISSOs, ISSEs, and security control assessors
• Security architects and systems security engineers
• AI governance, risk, and assurance practitioners
• Developers and integrators of autonomous and agentic systems
• Critical-infrastructure security and operational technology professionals

About the RGE Series

The Runtime Governance Engineering Series develops the engineering foundations, architectures, implementation methods, and assurance practices needed to govern consequential AI and autonomous-system behavior.

Volume 2 is self-contained. No prior volume, proprietary platform, or particular AI governance control plane is required to apply its principal methods and examples.

Format: Digital PDF

Length: 198 pages

ISBN: 979-8-9971149-2-3

Publisher: Sustainable Future Tech Publishing

Price: $49 USD

Move beyond security intentions and model-level guardrails. Engineer, document, test, and assess the controls that govern what autonomous AI systems can actually do.