# BROCS: The framework for enterprise AI enablement > BROCS is the framework for enterprise AI enablement: Build, Run, Observe, Control, and Secure. Source: https://brocs.fyi/ Framework version: 1.3. Licence: CC BY 4.0, attribute to Leo Mata and brocs.fyi. ## Definition **BROCS** is a vendor-neutral framework for assessing enterprise AI enablement. It organizes the work under **Build**, **Run**, **Observe**, **Control**, and **Secure**. Use it to assess commercial and homegrown platforms before procurement or implementation. Enterprise AI requires more than model access. BROCS organizes the capabilities needed to develop systems, run them reliably, monitor behavior, control change, and manage security. ## Before and after deployment Before deployment, BROCS sets requirements for a first tool, pilot, supplier, or platform. Once AI is in use, it assesses the delivery paths, production services, telemetry, change mechanisms, and enforced requirements behind that work. - [Starting enterprise AI](https://brocs.fyi/resources/starting-enterprise-ai/): Use the five scopes as an onramp for tools, pilots, and platforms. - [Enterprise AI operations](https://brocs.fyi/enterprise-ai-operations/): Apply an operating model to AI systems already in use. - [Operational coverage](https://brocs.fyi/resources/operational-maturity/): Assess current evidence and locate the capability limiting scale. - [Delivery acceleration](https://brocs.fyi/resources/accelerating-ai-delivery/): Reduce delivery delays through shared capabilities and bounded change. ## The five capabilities ### [B / Build](https://brocs.fyi/build/): Provide approved tools and delivery paths. Tools, access, models, and data for technical and non-technical builders. - Tooling: IDEs, agent CLIs, notebooks, chat applications - Access: who gets which tools, and how fast - Keys and models: distribution, scoping, rotation, BYOK - Data access: without handing out production credentials - Idea to production: golden paths, templates, scaffolds ### [R / Run](https://brocs.fyi/run/): Operate AI workloads reliably. Runtime, state, secrets, provisioning, and placement across approved environments. - Runtime: where apps and agents actually execute - Data and state: provisioned, owned, backed up - Secrets: injected at runtime, never in code or chat - Provisioning: self-service, provision-build-deploy as one motion - Portability: the runtime goes where the data goes ### [O / Observe](https://brocs.fyi/observe/): Measure system behavior and quality. Metrics, traces, evals, and alerts for service owners. - Metrics: golden signals plus tokens, cost, tool calls - Traces: reconstruct what an agent did, with what, on what data - Alerts: routed to the builder who owns the app - Useful signals: decision-linked metrics and alert criteria - Model behavior: drift, unannounced provider updates, quality regressions ### [C / Control](https://brocs.fyi/control/): Manage change and access. Versioned configuration, ingress, identity, storage, routing, and remote access. - Configuration: declarative, versioned, reviewed, reversible - Ingress: a shared entry point for internal AI apps - Identity: SSO by default, external access without VPN sprawl - Storage and backups: retention, lifecycle, restore drills - Routing: model and provider routing, pinning, failover - Remote access: work reaches the data instead of the data reaching the laptop ### [S / Secure](https://brocs.fyi/secure/): Enforce policy and produce evidence. Governance, agent permissions, cost controls, incident records, and compliance evidence. - Governance: policy tied to enforcement points - Agents: tool permissions, audit trails, human in the loop - Shadow AI: discovery of unsanctioned tools and personal accounts - Cost: who spends what, on which model, showback and chargeback - Compliance: HIPAA, SOC 2, PCI, FedRAMP, EU AI Act as platform output ## Framework commitments ### Tools will change Keep identity, data access, runtime, telemetry, policy, and portability independent of any assistant or model provider. Replacing a tool should not require rebuilding the services beneath it. ### Deployment follows data constraints Support the locations and legal boundaries that govern the data, including private infrastructure and approved cloud accounts. A separate stack for each location creates uneven controls and duplicate work. ### Sovereignty shapes architecture Some workloads require local models or endpoints covered by specific contractual terms. Those paths belong in the core design and should receive the same operational support as hosted models. ### Integration cost compounds A separate integration and control set for each vendor raises cost and fragments evidence. Shared services reduce the work required to add or replace tools. ### Assistants cover part of Build A coding assistant helps people create software. Enterprise enablement also covers deployment, data connections, runtime operations, monitoring, policy, and incident response. ### The capabilities depend on one another Build relies on approved runtime paths. Observe supplies evidence to Control and Secure. Treat the capabilities as one operating model when assigning ownership and evaluating coverage. ## Framework and resources - [Build](https://brocs.fyi/build/): Enabling technical and non-technical people to make things with AI through supported tools, access, model keys, and data. - [Run](https://brocs.fyi/run/): The runtime underneath AI work: where apps and agents execute, the data and secrets they need, and the portability to run all of it where the data already is. - [Observe](https://brocs.fyi/observe/): Metrics, traces, alerts, and quality measurements for AI systems, available to the people who own them. - [Control](https://brocs.fyi/control/): Controls for changing AI system behaviour and returning to a known state. - [Secure](https://brocs.fyi/secure/): Governance, agent oversight, shadow AI, cost accountability, and compliance evidence for AI systems. - [Enterprise AI operations](https://brocs.fyi/enterprise-ai-operations/): How BROCS applies an operating model to AI already in use, covering operational maturity, production control, lifecycle management, and delivery speed. - [Field notes](https://brocs.fyi/post/): Short analysis of public incidents and research, mapped to Build, Run, Observe, Control, and Secure. - [Privacy](https://brocs.fyi/privacy/): What brocs.fyi measures, what it does not collect intentionally, and the controls applied to site analytics. - [Resources](https://brocs.fyi/resources/): Assessment, buyer questions, sourced failures, definitions, framework method, and citation resources for BROCS. - [Search](https://brocs.fyi/search/): Search the BROCS framework, practitioner guides, buyer questions, glossary, and sourced failure modes. - [The BROCS manifesto](https://brocs.fyi/manifesto/): The operating requirements behind enterprise AI enablement: Build, Run, Observe, Control, and Secure.