Altiri Updated October 2026. This overview replaces the incomplete paper page previously available at this address.
Start with the evidence relationship
A policy describes an expectation. An implementation statement explains how an organization addresses it. Supporting records help a reviewer evaluate what actually happened. Keeping those relationships explicit makes the documentation easier to navigate and maintain.
Make each record understandable
Use readable files with a defined record type, a descriptive title, an owner, and relevant dates. Link controls, policies, evidence, findings, risks, and decisions so a reviewer can follow the basis for a claim.
Keep evidence in its appropriate location
A knowledge record can reference an artifact without containing the artifact itself. Define access to the source, the period it covers, and its limitations. Copying sensitive material into a knowledge bundle should be a deliberate, authorized decision.
Maintain the record over time
Assign review responsibilities and preserve documentation change history. A file's modification date alone does not prove that a safeguard operated, and documentation version history does not replace information-system audit logs.
Use AI with defined boundaries
If AI assistance is included, specify its permitted sources, access, model hosting, and review process. Check citations and proposed changes against the underlying evidence. Missing information should remain visible rather than being filled in with assumptions.
Explore the open-source materials
The okf-grc repository provides the published conventions, tooling, and fictional examples. Review the repository's current specification and license before adopting it. The upstream Open Knowledge Format materials provide additional context.
Apply the approach through AGKL
AGKL engagements define the organization-specific structure, implementation work, infrastructure, and maintenance responsibilities. Scope and deliverables are agreed for the engagement.