Anatomy of a Governed AI Factory
The Colophon case study made the claim and the routing essay made the model calls; this is the architecture that makes a governed AI factory real and auditable, from the coordination plane to the eval loop.
Dayel Ostraco · Chief AI Officer, Accelera Solutions
A Chief AI Officer who still ships.
/ Secure, ATO-ready AI for federal missions
Architected and built. Not just managed.
Now shipping
Delivering AI agentic processes to DHA and the U.S. Navy.
Active engagement
Career at a glance
20
Federal delivery
$1.7B+
Program revenue
10M+
Daily transactions
2
Successful exits
IL5
GovCloud AI, IL5 controls
DoD Secret
Active clearance
~11×
Equifax Gov revenue growth
Governed delivery · what ships
Still shipping.
Architect-in-the-loop: agents write the code; I own the architecture, the guardrails, and every merge. A governed AI factory where each change clears antagonist peer review and Human CCB before it ships. The output is authorized federal software, delivered in weeks, not years, the same factory behind the Glyphon results below.
Every merge
Antagonist-reviewed + CCB-gated
4 wk
To ATO-ready delivery, from 12 months
0/0/0/0
Nightly CVE scans · 2 IL4 systems in production
Languages active
Java · TypeScript · Python · Go · Kotlin · Swift · Astro · Shell
Vallark · two IL4 systems in continuous production since March 2026, ATOs held without lapse · every change through antagonist review + Human CCB
About
Dayel Ostraco
Chief AI Officer · Accelera Solutions
Trusted by the DoD, DHA, SSA, and CMS, and by global financial institutions, to architect platforms that move billions in transactions, scale to millions of daily users, and survive the audit afterward. Currently Chief AI Officer at Accelera Solutions, delivering ATO-ready AI agents for federal missions.
20 years engineering secure, full-stack platforms for federal, defense, and public-sector clients, integrating generative AI, LLMs, and real-time data pipelines into systems that hold under Zero Trust, RMF, and FedRAMP / HIPAA.
Signature transformation
~11× the revenue. The same 100 people.
As Senior Director of Product Management at Equifax (2019–2025), leading all Product Management across three organizations (St. Louis, Atlanta, and Dublin, ~70+ people), I pivoted the business unit to an API-first model, productizing each API into a product sold to customers, and integrated The Work Number into a leading open-banking network to reach thousands of financial institutions, all while holding SOX and FCRA compliance. The API-productized business unit grew from ~$67M to ~$763M on flat ~100-person headcount, driven by the open-banking network expansion rather than added scale.
~$67M → ~$763M
Annual revenue, 2019 → 2025
~100
Flat headcount through the growth
~50%
Revenue CAGR, 2019 → 2025
SOX · FCRA
Held through the API + open-banking integration
Figures reflect the API-productized business unit I led, driven by open-banking network expansion. Equifax's government verification was a publicly reported growth driver within its Workforce Solutions segment over this period.
The lab
A self-contained AI lab. IL4-equivalent control set. Architected for IL5 and IL6.
I built and operate a self-contained lab where authorized AI agents (Glyphon playbooks, Colophon engineering teams, custom workloads) run against an IL4-equivalent control set. The same architecture extends to IL5 and IL6 for classified mission deployments.
Owned hardware hosts the largest-parameter open models inside the boundary, closed-network multi-model inference, no external dependencies.
2×
NVIDIA DGX Spark
GB10 superchip workstations.
4×
NVIDIA H100
Datacenter GPUs · 80GB HBM3.
512GB
Mac Studio
Unified memory for largest-parameter inference.
IL4
Equivalent today
Closed-network boundary, federated identity, multi-provider orchestration, hash-chained audit, no external telemetry.
IL5
Architected
Architecture extends to IL5 controls. Boundary, identity, and audit primitives already in place.
IL6
Designed
Patterns and segmentation designed for classified workloads. Ready for sponsorship and accreditation.
Flagship product
Glyphon™
Multi-provider AI agent orchestration with deterministic compliance output.
Multi-agent compliance pipelines producing deterministic, reproducible artifacts across OpenAI, Claude, Gemini, and AWS Bedrock. Seven production playbooks covering CVE resolution, AMI and container hardening, eMASS POAM submission, and FedRAMP SSP generation. Tested against the IL5 control baseline on AWS GovCloud with LLaMA 4 Maverick, April 2026, 9/9 green AMI hardening end-to-end.
-
83.5%
101 of 121 CVEs auto-resolved, 7 ecosystems
-
99.6%
246 of 247 Windows Server 2022 STIG controls passing, AMI-hardened
-
50
Production agents across 7 playbooks
-
IL5
GovCloud-tested · FedRAMP High ready
Delivering the U.S. Navy and DHA federal AI engagement · IL5 control baseline tested, April 2026
Zero Critical, High, or Medium findings across the four federal programs delivered on this stack (10 Low-severity findings total).
Five production DHA healthcare workloads hardened to near-zero CVE on RHEL UBI 9 Minimal, with a 93.2% STIG-checklist auto-pass verified in STIG Viewer (Semgrep, Gitleaks, Trivy, StackRox); the remaining checks were handled manually, since automating them risked OS and application stability.
The specifics behind these figures (program names, accreditation dates, evidence packages) are CUI or classified, and shared only with appropriately cleared parties through official channels.
Production playbooks
- ▸ CVE Resolution, 10 agents, 7 ecosystems
- ▸ AMI Hardening, 9 agents, 7 platforms
- ▸ Container Hardening, 7 agents, 4 registries
- ▸ Semgrep SAST Triage, 8 agents
- ▸ Security Posture Assessment, 7 agents, 14 tools
- ▸ eMASS POAM Submission, 4 agents
- ▸ FedRAMP SSP Generation, 5 agents (beta)
The product family
Four products, one thesis: humans stay in charge.
Proprietary
Colophon
Our internal AI delivery platform, 70+ specialist agents shipping with antagonist peer review and Human CCB approval.
colophon.build →
ShippingVallark
DoD-grade mobile API contract, OpenAPI 3.1 + iOS / Android / Web / API starters, with attestation and CUI handling baked into the spec.
vallark.build →
Live SaaSAffirmark
CMMC Level 1 and 2 self-assessment app for SMB DoD subcontractors, replaces the manual workbook with a chatbot-coached, hash-chained audit log.
Commercialized: paying corporate customers on both the Level 1 ($299/mo) and Level 2 ($799/mo) tiers.
affirmark.build →
Air-gappedLoadout
Air-gapped forensic-training toolkit. Synthetic DOMEX artifacts onto Android training devices, on-prem AI persona generation, zero residual data between exercises.
loadoutforensics.com →
Commercial line · revenue-generating AI products
I ship AI to the App Store, too.
Separate from the federal platform work above, and the one part of the portfolio anyone can verify by installing it. Under SigilArk I build, sell, and support commercial AI apps for pilots and sim racers: revenue-generating products with paying customers and active Discord support communities I run myself. Not experiments, the same design, ship, and operate discipline as the federal work, on a public storefront where the reviews and the pricing are open.
App Store · $12.99
Flight sim · MSFS 2024
Detent
Tactile cockpit radio panel for the sim. Haptic concentric knobs tune COM / NAV / OBS / transponder; pairs with VATSIM and PilotEdge.
flydetent.com →
App Store · $29.99Pilot training · AI
Squelch
AI ATC radio trainer for student pilots. Grades your readback word-by-word against FAA phraseology, no auto-correct, so the habit is real.
flysquelch.com →
App Store · FreemiumSim racing · GT7 + F1 25
Knurl
Real-time racing telemetry for Gran Turismo 7 and F1 25 on PS5. 60 Hz gear, speed, lap delta, tire temps, and fuel, locked to console data.
driveknurl.com →
Microsoft Store · FreePC bridge
Flight Sim Bridge
The free Windows bridge that links MSFS 2024 to the iOS apps, secure local link, no cloud, no telemetry.
Microsoft Store →
Recent engagements
From VA claims to classified AI.
-
2026-Present
Accelera Solutions
Chief AI Officer
Leads Accelera's technology organization, running Glyphon and the Colophon software factory in production to deliver the current U.S. Navy and DHA federal AI engagement, first established with mSTAX in 2018.
▸ Leads a 97-person organization, scaling to 140 ▸ AI strategy, delivery & engineering across the org ▸ Methodology adopted program-wide by DHA Cyber Command · PI Award -
2025-2026
SigilArk
Chief AI Officer
Architected Glyphon (multi-provider AI agent orchestration) on the Colophon governed software factory, and led the development work for DHA's agency-wide EMPIRE software factory. Built the specialist-agent bench and Claude Code skills that emit RMF artifacts as a byproduct of delivery. IL5 control baseline tested on AWS GovCloud, April 2026.
▸ Led development of DHA's agency-wide EMPIRE software factory ▸ Glyphon: 50 production agents, 7 playbooks ▸ Colophon: antagonist review + Human CCB, cATO discipline -
2019-2025
Equifax Government Services
Senior Director of Product Management
Pivoted the business unit to an API-first model, productizing each API into a product sold to customers, and integrated The Work Number into a leading open-banking network to reach thousands of financial institutions, holding SOX and FCRA throughout. In parallel, directed GenAI-powered eligibility decisioning across CMS, SSA, and state agencies, Ollama, Gemini, and Vertex AI integrated with agency policy logic on Apache NiFi, Kafka, and MLflow pipelines.
▸ Led all Product Management · 3 orgs (St. Louis · Atlanta · Dublin), ~70+ people ▸ ~$67M → ~$763M revenue · flat ~100 headcount ▸ Flagship revenue engine · ~50% CAGR (2019-2025) ▸ The Work Number → open-banking network, thousands of FIs ▸ 10M+ daily transactions -
2017-2019
Catapult.io (Singapore)
Founder & CIO · Acquired
Founded a secure identity firm. Built mSTAX, a U.S. Navy and DHA AI/ML evaluation platform whose customer relationship continues at Accelera today, and Linxens dLoc, NFC-linked blockchain document twins. Catapult was acquired in 2019 as I transitioned into the Equifax role.
▸ mSTAX showcased at 2018 DHA Open House ▸ ATO under HIPAA + MEDCOI -
2016-2017
CACI International
Chief Engineer · MHS GENESIS
Led backend engineering for MHS GENESIS, the Department of Defense's electronic health record program for the Military Health System.
▸ 50+ HL7/FHIR ingestion pipelines ▸ DHA + VA + all five service branches -
2011-2016
Earlier
- 2014-2016 Qonceptual Founder & CTO · Sold 2016
- 2013-2014 Starwood Hotels & Resorts Director of Mobile Development · Apple 2014 keynote
- 2011-2013 Booz Allen Hamilton Director of Software Engineering · VBMS
Full detail on every engagement is in the resume.
On the work
From the customer side.
I’ve never seen so many zero findings across our applications and environments. All deployed programs should adopt the techniques Accelera’s Cyber Agent Teams employ, or leverage the Agents directly.
Cybersecurity Lead
Federal Health Agency
Referring to Glyphon agents running CVE, AMI, and container hardening playbooks.
Insights
Thinking in public.
Field notes on agents, identity, and shipping inside the federal boundary.
We Don't Have a Favorite Model. We Have a Routing Table.
The question I get is which model is best. It is the wrong question. In our governed federal factory the first filter is the boundary, the second is failure mode, and the eval that matters is disagreement. The model is a commodity. The routing is the craft.
Capabilities
The stack I build with daily.
Languages & Frameworks
Architected production backends from MHS GENESIS HL7/FHIR pipelines to VBMS modernization to the Glyphon agent runtime.
- Python
- TypeScript
- Java · Spring Boot
- React · Node.js · NestJS
- SQL · REST APIs
Cloud & Infrastructure
GovCloud-native delivery for a decade. mSTAX multi-region AWS + Azure cross-cloud at DHA. Glyphon tested against the IL5 control baseline on AWS GovCloud, April 2026.
- AWS GovCloud · Azure · GCP
- Docker · Kubernetes
- AWS CDK · IaC · GitLab CI/CD
- PostgreSQL · MongoDB · CosmosDB
- Iron Bank · Chainguard
AI-Native Delivery
I run an AI software factory: Colophon's agent bench mixes Claude Code, Codex, and open models for development, UX, and adversarial review. Multi-provider orchestration in classified enclaves today, from Equifax GenAI eligibility decisioning to Glyphon.
- Agentic development (Claude Code · Codex)
- Skill & agent authoring · adversarial + UX passes
- Claude · Codex · Llama 4 Maverick · Kimi K2 · Gemini · Mistral
- Ollama · OpenWebUI · MLflow
- Apache NiFi · Kafka
Security & Compliance
ATOs under HIPAA + MEDCOI at DHA. FedRAMP / HIPAA / FISMA and SOX / FCRA at Equifax. STIG-compliant deployments, eMASS submissions, and IL5 architecture today.
- Zero Trust · RMF · ATO
- FedRAMP High · HIPAA · MEDCOI
- FIPS 140-3 · STIG · NIST 800-53
- eMASS
- SOX · FCRA
Education, certification & clearance
B.A. Math + B.A. CS
State University of New York at Purchase
CISSP
Certified Information Systems Security Professional · (ISC)²
DoD Secret
Active U.S. Department of Defense Secret clearance · TS-eligible
Resume
The unabbreviated version.
Full work history, every role and achievement.
Updated May 2026
Writing & recognition
Connect
Building something audit-grade?
Open to selective conversations on full-time leadership, federal partnership and JV opportunities, and a small number of advisory engagements per year.
Federal contracting available via Accelera Solutions contract vehicles.