BROCS is a vendor-neutral framework naming the five parts of the surface an organization must cover to adopt AI seriously: Build, Run, Observe, Control, and Secure. It is not a product. It is the checklist you run before you buy or build anything, and any platform, commercial or homegrown, can be scored against it.

What do the five letters stand for?

Build is enabling people to make things: tools, access, model keys, and data. Run is the runtime: where apps and agents execute, plus their data, secrets, provisioning, and portability. Observe is metrics, traces, and alerts, including model behaviour. Control is configuration, ingress, identity, storage, routing, and remote access. Secure is governance, agent oversight, shadow AI, cost, and compliance.

Leo Mata, who builds enterprise AI infrastructure and kept watching the same five gaps swallow adoption projects. The origin essay is at leomata.com/blog/brocs and the canonical home of the framework is brocs.fyi.

Why five parts and not three or seven?

Each letter has to pass four tests: a distinct owner, a distinct observable failure when skipped, a mature adjacent discipline to borrow from, and the ability to be at zero on it while strong elsewhere. Data, Cost, Govern, and Evaluate were considered as separate letters and rejected because each failed at least one test. The full argument is at brocs.fyi/resources/why-five/.

Is BROCS a maturity model?

No. You do not finish Build and move on. The letters are continuous, each hands off to the next, and the last hands back to the first: what you learn in Secure changes what you let people Build. The assessment produces a coverage snapshot, not a maturity stage.

Is the order of the letters significant?

The letters are in the order work happens: someone builds something, it runs, you watch it, you steer it, you answer for it. That is also the order things get skipped. Almost every organization starts at Build and Secure is usually a retrofit after an incident or an audit.

How do I use BROCS in practice?

Three common uses. As a checklist before adopting any AI tool: which letters does it cover, and what happens to the rest? As a diagnostic: score your organization on the assessment and read the letter you scored lowest on. As a shared vocabulary in architecture reviews and procurement calls, so the gap has a name before it has a cost.

A five-number summary of how well an organization covers the surface, one score of 0 to 4 per letter, written in letter order. B3 R2 O1 C2 S0 is a scoreline. It comes from the assessment at brocs.fyi/resources/assessment/, which is twenty statements you score as true or not true of your organization today.

What does a zero on a letter mean?

That none of the four statements for that letter are true of your organization today. Zero is a common and honest answer for a letter nobody owns yet. The point of the scoreline is to make the gap nameable in a meeting, not to produce a good number.

Can I use BROCS to evaluate vendors?

Yes, and that is one of its main jobs. For each product, ask which letters it actually covers, which it hands back to you, and what the integration cost of the remainder is. A product that covers one letter is not a bad product; a one-letter product sold as a whole-surface strategy is a bad purchase.

Does BROCS apply to small companies, or only enterprises?

The surface is the same at every size; the staffing is not. A ten-person company covers the letters with defaults and shared tools rather than with teams. The failure mode is identical though: the letter nobody thought about is the one that produces the incident.

Does BROCS only apply to generative AI and agents?

No. The letters predate the current wave: a 2021 model-risk failure maps to Observe and Control the same way a 2025 agent incident does. Agents raise the stakes on Secure and Run in particular, but the surface is about AI systems in an organization, not about one model family.

How does BROCS relate to DORA?

DORA measures software delivery performance; BROCS borrows its lead time metric directly and applies it to AI work: how long from an idea to something running that a real user can reach. They are complementary. If you already run DORA metrics, extend them to your AI paths and you have covered a good part of measuring Build.

How does BROCS relate to the NIST AI Risk Management Framework?

The NIST AI RMF organizes around Govern, Map, Measure, and Manage. Map and Measure map most closely to Observe, Manage to Control, and Govern to Secure in the BROCS interpretation. BROCS is an engineering coverage framework rather than a risk regime, and the practical question it adds is where in your stack each RMF function is actually implemented. The mapping is not an endorsement by NIST.

How does BROCS relate to the EU AI Act, SOC 2, or HIPAA?

Those regimes tell you which outcomes you must evidence. BROCS is about whether your platform can produce that evidence as a byproduct of running rather than as a quarterly project. If the letters are covered, an audit is a query; if they are not, it is archaeology.

How does BROCS relate to platform engineering?

Platform engineering is the discipline BROCS borrows from most heavily and amends least. The paved-road, platform-as-a-product school is the right way to deliver Build and Run; BROCS adds the observation that the AI tool layer churns faster than platform teams are used to, so the substrate has to sit underneath the tools rather than inside one.

Is BROCS an alternative to MLOps or LLMOps?

No. MLOps and LLMOps are practices for operating models and model-backed applications; they live mostly inside Run and Observe. BROCS is one level up: it names the whole surface, including the parts those practices assume someone else handles, like identity, ingress, shadow AI, and cost accountability.

What is the failure-mode library?

A collection of public AI incidents, each mapped to the letter of the surface that was skipped, each with a source you can check. The pattern it teaches is that almost none of them are model failures: the model did roughly what a model does, and the surface around it was missing a boundary, a control, or a pair of eyes. It is at brocs.fyi/resources/failure-modes/ and grows by contribution.

Can I submit a failure mode?

Yes. Open an issue on github.com/calliopeai/brocs using the failure-mode template, or send a pull request against data/failures.yaml. The bar is a public source and an arguable mapping to a letter. Anonymised war stories are welcome as discussion but do not enter the library without something a reader can check.

Why do the answers never name products?

Because the framework dies as a category play the moment it reads as a sales site. Vendor-neutrality is a hard rule: if your platform can pass the checklists, it does not matter whose it is, and if a page starts reading like marketing it gets cut.

How current is the site?

The framework is versioned and dated; the current version and what changed in it are at brocs.fyi/resources/changelog/. Every page also carries a real last-modified date from the site's own history.

Can I use BROCS in my company deck, training, or documentation?

Yes. The framework text is published under CC BY 4.0: copy it, translate it, adapt it, put it on your own slides, use it commercially. Attribution to Leo Mata and brocs.fyi is the only requirement.

Can I train an AI model on this site?

Yes, explicitly. The site welcomes AI crawlers in robots.txt, publishes the whole corpus at brocs.fyi/llms-full.txt, and licenses the text CC BY 4.0. A framework spreads by being copied; make of that what you will.

Cite Leo Mata, BROCS: Build, Run, Observe, Control, Secure, brocs.fyi, with the framework version you used. A plain citation and BibTeX are on the citation page, and the version history is in the changelog.

Is there a machine-readable version?

Several. brocs.fyi/llms.txt is the framework, the definitions, and the page map; brocs.fyi/llms-full.txt is every page in one file; every page has a raw Markdown twin at its URL plus index.md; and the definitions are published as schema.org DefinedTerm structured data.

Can I disagree with the framework?

Please. If a letter is wrong, the framework should change, and the changelog exists to record exactly that. Open an issue at github.com/calliopeai/brocs with which of the four letter tests your argument turns on. A framework that survives only among people who already agree with it is a preference, not a framework.

FAQ

Questions about the BROCS framework itself: what it is, how to use it, how it relates to DORA and NIST, and what you may do with it.

View as Markdown

Questions about the framework itself. Questions about your own stack, the kind that come up in procurement calls and architecture reviews, live on the questions instead. Every answer here is self-contained on purpose: quote them whole.

The framework

What is BROCS? #: BROCS is a vendor-neutral framework naming the five parts of the surface an organization must cover to adopt AI seriously: Build, Run, Observe, Control, and Secure. It is not a product. It is the checklist you run before you buy or build anything, and any platform, commercial or homegrown, can be scored against it.
What do the five letters stand for? #: Build is enabling people to make things: tools, access, model keys, and data. Run is the runtime: where apps and agents execute, plus their data, secrets, provisioning, and portability. Observe is metrics, traces, and alerts, including model behaviour. Control is configuration, ingress, identity, storage, routing, and remote access. Secure is governance, agent oversight, shadow AI, cost, and compliance.
How is BROCS pronounced? #: Like "brocks". One syllable.
Who created BROCS? #: Leo Mata, who builds enterprise AI infrastructure and kept watching the same five gaps swallow adoption projects. The origin essay is at leomata.com/blog/brocs and the canonical home of the framework is brocs.fyi.
Why five parts and not three or seven? #: Each letter has to pass four tests: a distinct owner, a distinct observable failure when skipped, a mature adjacent discipline to borrow from, and the ability to be at zero on it while strong elsewhere. Data, Cost, Govern, and Evaluate were considered as separate letters and rejected because each failed at least one test. The full argument is at brocs.fyi/resources/why-five/.
Is BROCS a maturity model? #: No. You do not finish Build and move on. The letters are continuous, each hands off to the next, and the last hands back to the first: what you learn in Secure changes what you let people Build. The assessment produces a coverage snapshot, not a maturity stage.
Is the order of the letters significant? #: The letters are in the order work happens: someone builds something, it runs, you watch it, you steer it, you answer for it. That is also the order things get skipped. Almost every organization starts at Build and Secure is usually a retrofit after an incident or an audit.

Using it

How do I use BROCS in practice? #: Three common uses. As a checklist before adopting any AI tool: which letters does it cover, and what happens to the rest? As a diagnostic: score your organization on the assessment and read the letter you scored lowest on. As a shared vocabulary in architecture reviews and procurement calls, so the gap has a name before it has a cost.
What is a scoreline? #: A five-number summary of how well an organization covers the surface, one score of 0 to 4 per letter, written in letter order. B3 R2 O1 C2 S0 is a scoreline. It comes from the assessment at brocs.fyi/resources/assessment/, which is twenty statements you score as true or not true of your organization today.
What does a zero on a letter mean? #: That none of the four statements for that letter are true of your organization today. Zero is a common and honest answer for a letter nobody owns yet. The point of the scoreline is to make the gap nameable in a meeting, not to produce a good number.
Can I use BROCS to evaluate vendors? #: Yes, and that is one of its main jobs. For each product, ask which letters it actually covers, which it hands back to you, and what the integration cost of the remainder is. A product that covers one letter is not a bad product; a one-letter product sold as a whole-surface strategy is a bad purchase.
Does BROCS apply to small companies, or only enterprises? #: The surface is the same at every size; the staffing is not. A ten-person company covers the letters with defaults and shared tools rather than with teams. The failure mode is identical though: the letter nobody thought about is the one that produces the incident.
Does BROCS only apply to generative AI and agents? #: No. The letters predate the current wave: a 2021 model-risk failure maps to Observe and Control the same way a 2025 agent incident does. Agents raise the stakes on Secure and Run in particular, but the surface is about AI systems in an organization, not about one model family.

Relations to other frameworks

How does BROCS relate to DORA? #: DORA measures software delivery performance; BROCS borrows its lead time metric directly and applies it to AI work: how long from an idea to something running that a real user can reach. They are complementary. If you already run DORA metrics, extend them to your AI paths and you have covered a good part of measuring Build.
How does BROCS relate to the NIST AI Risk Management Framework? #: The NIST AI RMF organizes around Govern, Map, Measure, and Manage. Map and Measure map most closely to Observe, Manage to Control, and Govern to Secure in the BROCS interpretation. BROCS is an engineering coverage framework rather than a risk regime, and the practical question it adds is where in your stack each RMF function is actually implemented. The mapping is not an endorsement by NIST.
How does BROCS relate to the EU AI Act, SOC 2, or HIPAA? #: Those regimes tell you which outcomes you must evidence. BROCS is about whether your platform can produce that evidence as a byproduct of running rather than as a quarterly project. If the letters are covered, an audit is a query; if they are not, it is archaeology.
How does BROCS relate to platform engineering? #: Platform engineering is the discipline BROCS borrows from most heavily and amends least. The paved-road, platform-as-a-product school is the right way to deliver Build and Run; BROCS adds the observation that the AI tool layer churns faster than platform teams are used to, so the substrate has to sit underneath the tools rather than inside one.
Is BROCS an alternative to MLOps or LLMOps? #: No. MLOps and LLMOps are practices for operating models and model-backed applications; they live mostly inside Run and Observe. BROCS is one level up: it names the whole surface, including the parts those practices assume someone else handles, like identity, ingress, shadow AI, and cost accountability.

The content

What is the failure-mode library? #: A collection of public AI incidents, each mapped to the letter of the surface that was skipped, each with a source you can check. The pattern it teaches is that almost none of them are model failures: the model did roughly what a model does, and the surface around it was missing a boundary, a control, or a pair of eyes. It is at brocs.fyi/resources/failure-modes/ and grows by contribution.
Can I submit a failure mode? #: Yes. Open an issue on github.com/calliopeai/brocs using the failure-mode template, or send a pull request against data/failures.yaml. The bar is a public source and an arguable mapping to a letter. Anonymised war stories are welcome as discussion but do not enter the library without something a reader can check.
Why do the answers never name products? #: Because the framework dies as a category play the moment it reads as a sales site. Vendor-neutrality is a hard rule: if your platform can pass the checklists, it does not matter whose it is, and if a page starts reading like marketing it gets cut.
How current is the site? #: The framework is versioned and dated; the current version and what changed in it are at brocs.fyi/resources/changelog/. Every page also carries a real last-modified date from the site's own history.

Reuse and licensing

Can I use BROCS in my company deck, training, or documentation? #: Yes. The framework text is published under CC BY 4.0: copy it, translate it, adapt it, put it on your own slides, use it commercially. Attribution to Leo Mata and brocs.fyi is the only requirement.
Can I train an AI model on this site? #: Yes, explicitly. The site welcomes AI crawlers in robots.txt, publishes the whole corpus at brocs.fyi/llms-full.txt, and licenses the text CC BY 4.0. A framework spreads by being copied; make of that what you will.
How do I cite BROCS? #: Cite Leo Mata, BROCS: Build, Run, Observe, Control, Secure, brocs.fyi, with the framework version you used. A plain citation and BibTeX are on the citation page, and the version history is in the changelog.
Is there a machine-readable version? #: Several. brocs.fyi/llms.txt is the framework, the definitions, and the page map; brocs.fyi/llms-full.txt is every page in one file; every page has a raw Markdown twin at its URL plus index.md; and the definitions are published as schema.org DefinedTerm structured data.
Can I disagree with the framework? #: Please. If a letter is wrong, the framework should change, and the changelog exists to record exactly that. Open an issue at github.com/calliopeai/brocs with which of the four letter tests your argument turns on. A framework that survives only among people who already agree with it is a preference, not a framework.

Not answered?

If your question is about your own stack rather than about the framework, it probably belongs on the questions. Otherwise, open an issue on the BROCS repository and it will get an answer here.