IRGS Core

Integrated Risk & Governance Suite

Python FastAPI Next.js TypeScript PostgreSQL Redis Docker Local AI

A note on this project: This is a personal portfolio project, built in my own time to explore solutions to problems I've encountered in practice. It implements the mechanics of RBNZ, ISO 27001 and Privacy Act workflows — it is a working prototype, not a certified or production system, and it has never held real customer data.

IRGS Core is a full-stack, self-hosted governance, risk and compliance platform built to demonstrate two things a CRO or CIO actually buys on: risk-based compliance decisioning, and executive reporting. It is scoped as the security and compliance stack for a fictional New Zealand bank, and it stands up completely offline with a single docker compose up — PostgreSQL, Redis, FastAPI, Next.js and a local Ollama model, with no cloud account and no external SaaS.

Eight governance modules run end to end and talk to each other live. A Redis event bus carries five cross-module cascades: a new critical vulnerability automatically raises a risk-register entry, live-updates the executive dashboard over Server-Sent Events, and can open an ITSM ticket — every step captured in a tamper-evident, hash-chained audit log, and every handler idempotent by design.

Every AI feature — board-report narratives, remediation playbooks, a natural-language assistant over the risk register, and contract-clause extraction — runs on a single local Gemma model via Ollama. No risk data ever leaves the machine, which is a hard requirement in this market. If the model has not been pulled, each feature degrades to a clearly-labelled deterministic template rather than failing, so a live demo never breaks in front of an audience.

It was built phase by phase over a few focused days in July 2026, each phase independently tested against a live running stack before being merged.

By the Numbers

8 / 8

Governance modules live

272 / 276

Spec features implemented (99%)

134

REST API endpoints

Database models

Passing unit tests

Zero

External AI calls

Inside the Platform

Governance & Risk

Central risk register with taxonomy, control mapping and ownership — the system of record every other module feeds into.

TPRM / Vendor Risk

Third-party register with a defensible Tier 1–4 engine weighing data sensitivity, operational criticality, financial dependency and regulatory scope.

Business Continuity

BIA and recovery planning, including a rule where linking an asset to a mission-critical process re-scores its technical risk automatically.

Policy Lifecycle

Seven-state machine with role-gated transitions, immutable version history and a two-approver chain for major changes.

Vulnerability Prioritisation

Composite scoring that blends CVSS, EPSS, CISA KEV, asset criticality and exposure, minus compensating controls — with a full per-component breakdown.

FAIR Quantification

Monte-Carlo engine in pure NumPy: 10,000 iterations in about 40 ms, producing real loss-exceedance curves and annualised loss expectancy.

Integration Hub

Connectors for threat intelligence and ITSM ticketing, so risk decisions leave the platform and land in the tools teams already use.

Executive Dashboards

CRO, CTO and CIO views with KPI rows, risk heatmaps, coverage matrices and attestation tracking, updating live as events fire.

Engineering Highlights

Quantitative, not CRUD
Five from-scratch scoring and simulation engines sit under the UI. Each number is explainable down to its components, so a risk owner can defend it to an auditor instead of pointing at a black box.
A real event-driven architecture
Redis pub/sub carries five distinct cross-module cascades between modules that stay genuinely decoupled — all idempotent, all written to a hash-chained audit trail.
Data-sovereign AI
One local Gemma model via Ollama powers every AI feature, with zero external API calls and a deterministic fallback for graceful degradation. Nothing about the risk posture is sent to a third party.
Built end to end with Claude Code
An example of AI-assisted engineering at non-trivial scale — 46 database models and 134 endpoints — built iteratively, with each phase verified against a running stack rather than generated in one shot.

Key Features

Composite vulnerability score blending CVSS, EPSS, CISA KEV, asset criticality and exposure against compensating controls, with a transparent per-component breakdown
Vendor tiering engine deriving Tier 1–4 from a weighted blend of data sensitivity, operational criticality, financial dependency and regulatory scope
Seven-state policy lifecycle with role-gated transitions, immutable version history and a two-approver chain for major changes
FAIR Monte-Carlo simulation producing loss-exceedance curves and annualised loss expectancy instead of a guessed dollar figure
“Business impact elevates technical risk” — linking an asset to a mission-critical business process automatically re-scores its vulnerabilities to critical tier, live
Hash-chained, tamper-evident audit log covering every cross-module event, with idempotent handlers throughout
Local-model AI for board narratives, remediation playbooks, risk-register Q&A and contract-clause extraction — with deterministic fallbacks

Stack

Built with: Python 3.12 · FastAPI · SQLAlchemy · PostgreSQL 16 · Redis 7 · Next.js 14 · TypeScript · Tailwind CSS · Recharts · Docker Compose · Ollama (Gemma)

Private repository — a code walkthrough or live demo is available on request.