Building Governance for Multi-Planetary Missions —
FAIG Applied to Aerospace at Scale
The previous four articles in this series identified governance gaps that could derail the SpaceX IPO — AI systems without documented governance trails, ITAR compliance exposure at AI scale, operator skills that do not transfer to governance construction, and Starlink data governance questions that have no documented answers. This article is different. This article is about what the solution looks like — specifically, what aerospace AI governance looks like when it is built right, mapped to the frameworks that institutional investors and regulators require, and constructed by someone who has built governance infrastructure that worked at Shell's multi-billion dollar scale.
I want to be clear about why I wrote this series. Not to predict SpaceX's failure. Not to attack Elon Musk or his extraordinary operational achievements. I wrote it because I have watched this pattern — brilliant organization, governance treated as friction, warning signs ignored — play out six times in 25 years. And I wrote it because I believe the multi-planetary mission is worth protecting. Humanity's access to space is too important to lose to a governance failure that was preventable.
The governance gaps I identified are fixable. Every one of them. The FAIG framework — Fisher AI Governance — maps directly to what aerospace companies need as they scale into public market accountability. This article shows what that mapping looks like in practice.
Why Governance Infrastructure Is the Mission-Critical Investment
SpaceX has invested billions in engineering infrastructure — launch systems, manufacturing, satellite production, ground stations. Every dollar was justified by the mission. The governance infrastructure required to protect that investment, sustain that mission, and allow SpaceX to operate as a public company with the institutional credibility that mission requires — that investment has not been made at the same scale.
This is not unusual. Almost every company that transitions from private to public discovers that its governance infrastructure is years behind its operational capability. The difference at SpaceX is the stakes. A governance failure at a consumer technology company is a regulatory fine and a board shakeup. A governance failure at the company that operates Starlink, launches US government payloads, and is building humanity's multi-planetary capability is a national security event.
"Good governance is not the enemy of the mission. It is the infrastructure that protects the mission from the governance failures that have ended every comparable organization that neglected it."
The argument for building aerospace AI governance infrastructure now — before the IPO, before the first regulatory incident, before the institutional investor governance screen becomes a barrier to capital — is the same argument for building any mission-critical infrastructure before it is needed rather than after. The cost of building it proactively is a fraction of the cost of building it reactively, under regulatory pressure, with a public paper trail documenting the gap.
The FAIG Framework — Five Categories Applied to Aerospace
The Fisher AI Governance framework organizes AI governance requirements into five categories. Each category maps to established standards — NIST AI RMF, COSO GenAI guidance, ISO 42001, SOC 2 — and each has specific aerospace applications that go beyond the generic framework to address the specific realities of launch vehicles, satellite constellations, and post-IPO public company accountability.
AI Strategy & Governance Structure
Documented AI strategy aligned with organizational mission. Board-level AI governance committee with independent authority. Clear ownership of AI governance function with reporting line to audit committee, not operations.
AI Risk Assessment & Classification
Every AI system classified by risk tier. Mission-critical systems identified and subject to enhanced governance requirements. Risk assessment documented and reviewed on defined schedule.
Data Governance & Privacy
Data classification framework covering all AI inputs and outputs. Privacy requirements mapped by jurisdiction. Data sovereignty conflict resolution framework documented and independently reviewed.
Security & Access Controls
Access controls for AI systems documented and enforced. Deemed export compliance framework for foreign national access. Vendor security assessments completed before integration.
Human Oversight & Audit Trail
Human oversight structure documented for every AI system by risk tier. Audit trail for AI decisions in mission-critical systems. Incident response framework for AI governance failures.
What the Shell Model Looks Like Applied to Aerospace
At Shell, the governance infrastructure for 17 Joint Ventures at board level was not built in a single project. It was built incrementally, starting with the highest-risk operations and expanding to cover the full portfolio. The methodology was forensic — start with the audit trail requirements, work backward to the controls that create the trail, and build the oversight structure that makes the controls credible.
Start with the audit trail — what do you need to be able to prove?
Before building any governance control, define the evidentiary standard. What does a DOJ examiner, SEC investigator, FAA auditor, and institutional investor governance team need to see? Build the audit trail requirements first, then design the controls that produce them.
Classify every AI system by risk and regulatory exposure
A complete inventory of every AI system in operational use, classified by safety criticality, national security adjacency, ITAR exposure, and data sovereignty complexity. This inventory is the foundation that every subsequent governance control depends on.
Build independent oversight before the IPO creates disclosure obligations
The board-level AI governance committee, the independent audit committee mandate, the AI governance function with a reporting line to the board — these need to be in place and operating before the S-1 is filed.
Map every governance control to a specific regulatory requirement
Every governance control documented with its regulatory justification — which NIST AI RMF function it satisfies, which COSO principle it implements, which ITAR requirement it addresses, which SEC disclosure obligation it supports.
Test the framework against adversarial scenarios before regulators do
Run the governance framework through the scenarios that will stress-test it. Does the audit trail exist? Is the human oversight record complete? Can the decision logic be explained to a regulator who is looking for a violation? If the answer to any of these is no — fix it before the scenario is real.
The Governance Infrastructure That Protects the Mission
The multi-planetary mission is real. Starship is real. The possibility of humanity becoming a spacefaring civilization — genuinely multi-planetary, with a presence beyond Earth that survives catastrophic events on any single planet — is the most consequential engineering project in human history.
That mission requires SpaceX to survive. Not just to succeed operationally — but to maintain the institutional credibility, the regulatory standing, the investor confidence, and the national security partnership that allows it to continue operating at the scale and with the government support that the mission requires.
A governance failure that triggers simultaneous SEC, DOJ, FAA, and State Department scrutiny does not just cost money. It consumes the organizational attention, the leadership bandwidth, the regulatory goodwill, and the public trust that the mission depends on. It creates the kind of institutional damage that Boeing has not recovered from in years of trying.
Why This Perspective Is Missing — And Why It Matters
The aerospace industry has brilliant engineers. The investment banks advising on the SpaceX IPO have experienced capital markets teams. The law firms have expert securities counsel. What is missing from the conversation — what has been missing from every conversation about the SpaceX IPO I have read — is the forensic GRC perspective.
Not the legal perspective on disclosure requirements. Not the financial perspective on valuation. The forensic perspective — the view that asks: if everything that could go wrong does go wrong simultaneously, is the governance infrastructure robust enough to survive it? Is the audit trail complete enough to demonstrate that the controls were in place and operating? Is the oversight structure independent enough to satisfy a regulator who is looking for a reason to find a violation?
That perspective comes from a specific combination of credentials and experience that is rare in the AI governance space and almost nonexistent in the aerospace AI governance space. Nineteen years at Shell. CPA. CFE. FAIG framework. The evidentiary standards that exist to create documentation that survives adversarial review — applied to AI governance specifically.
I am not a rocket engineer. What I can evaluate — and what almost nobody else in the AI governance space can evaluate with this specific combination — is whether the governance infrastructure matches the institutional accountability requirements of a publicly traded aerospace company operating AI systems under ITAR, SEC, and FAA scrutiny simultaneously.
A Direct Message to SpaceX, Blue Origin, Rocket Lab, and Joby Aviation
If anyone from these organizations is reading this series — and I hope someone is — here is my direct message:
The governance gaps I have identified are real. They are not unique to your organization — they exist across the aerospace industry wherever AI systems are being deployed at operational scale without the governance infrastructure that public market accountability will require. You are not being singled out. You are being warned, from a perspective that has seen this pattern play out enough times to recognize it early.
The solution is not expensive relative to the exposure it prevents. A forensic GRC assessment of your AI governance posture — mapped to NIST AI RMF, COSO GenAI, ISO 42001, ITAR compliance requirements, and SEC disclosure obligations — is a fraction of the cost of a regulatory enforcement action that could have been prevented by the documentation it would have produced.
I am available for consulting engagements, board-level advisory roles, and senior GRC positions. I am a US citizen based in Manila, available for engagements worldwide.
More importantly: I am writing this because I want the mission to succeed. Multi-planetary humanity is worth the governance infrastructure required to protect it.
The governance infrastructure that protects the mission starts here.
Free FAIG assessment — 15 questions, 5 minutes, scored against NIST AI RMF, COSO, and ISO 42001. Or contact Monte directly to discuss aerospace AI governance advisory, IPO readiness assessments, ITAR compliance frameworks, or board-level GRC roles.
US Citizen · Independent forensic CPA · No vendor agenda · 19 years Shell GRC · JV board level · SOX compliance · CPA (Texas, Ret.) · CFE · IAPP Member · Consulting, advisory, and senior GRC roles considered