The MESA Framework: A Four-Altitude Diagnostic Model for Institutional AI Governance

Institutional AI governance is commonly assessed as a single capability and reported as a single grade. That treatment obscures the failure that matters most: an institution can hold current policies, a chartered committee and a complete documentation set while the systems those documents describe cannot produce the evidence the documents claim.

This specification defines the MESA Framework (Maturity, Evidence, Substrate, Alignment) around one proposition: institutional AI governance is an alignment condition across distinct governance altitudes, and governance maturity should therefore be diagnosed as a multidimensional state rather than reported as a single organizational score. The framework separates governance into four altitudes, each with a definition, its inputs and outputs, a single accountable role, and an evidence requirement an auditor can test: a Regulatory Floor, a Strategic Compass, Operational Machinery and a Technical Substrate.

Five mechanisms operate the architecture: layer separation, cross-layer cascade, an enforcement constraint by which the Technical Substrate bounds the effective state of runtime-dependent controls, mandatory interface couplings between control families, and an evidence-based maturity vector. The framework is calibrated to regulated institutions operating AI systems under more than one binding authority source, including institutions for which a Sharia Supervisory Board holds binding approval power.

MESA does not replace ISO/IEC 42001 or the NIST AI Risk Management Framework. Section 3 maps the four altitudes to those documents at clause and category level and states which implementation decisions each deliberately delegates and which of those MESA instantiates. What MESA adds is diagnostic altitude: a per-layer maturity profile that names which altitude is failing, in place of a single grade that cannot.

The specification states explicitly what has not been tested, lists seven conditions that would falsify the framework, and sets out a ten-item empirical research agenda. It is a specification, not a certification scheme, and no conformity assessment body operates against it.

Version 1.1 makes two scope and naming clarifications and no normative change. The acronym is expanded as Maturity, Evidence, Substrate, Alignment; the prior expansion, Middle East Strategic Alignment, described the framework's origin rather than its scope and is retired, while the regional origin remains a matter of record and is not disclaimed. A new section derives each term from language already present in version 1.0 and states that the four terms are not the four altitudes. Section 7.6 supersedes the Governance Maturity Model published in the companion book, with an informative mapping table and a statement of why substrate maturity cannot be inferred from a prior result. The four altitudes, the five operating mechanisms, the clause-level mappings, the conformance language, the falsification conditions and the research agenda are unchanged.