NIST AI Risk Management Framework (AI RMF 1.0) — Alignment Assessment¶

Disclaimer: This document is an internal self-assessment mapping, NOT a validated certification or third-party audit. It documents how the toolkit's capabilities align with the referenced standard. Organizations must perform their own compliance assessments with qualified auditors.

Agent Governance Toolkit (AGT) Document Version: 1.0 Date: 2026-07-14 Classification: Public Framework Reference: NIST AI 100-1 — Artificial Intelligence Risk Management Framework

Table of Contents¶

1. Executive Summary
2. Methodology
3. GOVERN — Policies, Processes, and Procedures
4. MAP — Context and Risk Identification
5. MEASURE — Assessment, Analysis, and Tracking
6. MANAGE — Risk Response and Monitoring
7. Coverage Summary Matrix
8. Gap Analysis and Recommended Actions
9. Cross-References to Other Compliance Frameworks

1. Executive Summary¶

The Agent Governance Toolkit (AGT) is an open-source, multi-language governance framework for AI agent systems. This document provides a systematic alignment assessment of AGT against all 19 subcategories of the NIST AI Risk Management Framework (AI RMF 1.0), covering the four core functions: GOVERN, MAP, MEASURE, and MANAGE.

Scorecard¶

AGT demonstrates strong-to-excellent coverage across all four RMF functions. The toolkit's strongest capabilities lie in policy infrastructure (10+ PolicyEngine implementations across Python, .NET, and TypeScript), risk response mechanisms (circuit breakers, kill switches, saga compensation), and deep observability (OpenTelemetry, fleet monitoring, rogue agent detection). The primary improvement opportunities are in bias/fairness evaluation, compliance trend analysis, and formal benefit-maximization framing.

2. Methodology¶

This assessment maps AGT capabilities to each of the 19 NIST AI RMF subcategories using the following evidence types:

• Code artifacts — Source files, classes, functions, and configuration schemas
• Documentation — Architecture docs, threat models, and compliance mappings
• Benchmarks — Performance measurements quantifying governance overhead
• Templates — Policy-as-code YAML templates for common regulatory patterns

Coverage levels are assigned as:

3. GOVERN — Policies, Processes, and Procedures¶

GOVERN 1: Policies Reflecting Risk Management Are in Place¶

Coverage: ✅ FULLY ADDRESSED

AGT implements a multi-layered, declarative policy system with schema validation, versioning, conflict resolution, and multiple backend support.

How AGT addresses this subcategory: Policy-as-code with YAML templates supports declarative governance across environments. Multiple backend engines (native, OPA Rego, Cedar) allow organizations to use existing policy infrastructure. Schema validation, versioning (PolicyVersion), diff tracking, and conflict detection provide lifecycle management. Three enforcement modes (strict, permissive, audit) enable progressive policy rollout.

Gaps: None identified.

GOVERN 2: Accountability Structures Are in Place¶

Coverage: ✅ FULLY ADDRESSED

AGT provides cryptographic audit trails, Merkle hash chains, Shapley-value fault attribution, and joint liability tracking.

How AGT addresses this subcategory: Merkle hash chains provide tamper-evident audit trails where each entry is cryptographically linked to its predecessor. Shapley-value attribution enables mathematical fault attribution across multi-agent systems — a capability rare in governance toolkits. RBAC with four predefined roles (READER, WRITER, ADMIN, AUDITOR) enforces least-privilege access. DID-based agent identity ensures every action is traceable to a specific agent.

Gaps: None identified.

GOVERN 3: Workforce Diversity and Expertise¶

Coverage: ⚠️ PARTIALLY ADDRESSED

AGT has community governance documentation but no code-level enforcement of diversity, expertise requirements, or contributor roles.

How AGT addresses this subcategory: Community documentation establishes contribution norms, inclusive conduct standards, and security reporting processes. The Microsoft Open Source Code of Conduct provides an organizational commitment to diversity and inclusion.

Gaps: No machine-readable role definitions, no expertise verification mechanisms, no diversity tracking. This is primarily an organizational obligation typically outside the scope of a governance toolkit.

GOVERN 4: Organizational Practices with Third-Party Entities¶

Coverage: ✅ FULLY ADDRESSED

AGT implements comprehensive supply chain security including plugin signing, trust tiers, MCP gateway controls, AI-BOM, and dependency confusion protection.

How AGT addresses this subcategory: Ed25519-signed plugins and manifest validation ensure supply chain integrity. The five-tier trust scoring system (0–1000) with filter_capabilities() restricts third-party agents to appropriate privilege levels. MCP gateway allowlist/blocklist controls, security scanning (tool poisoning and injection detection), and egress policies manage third-party data flows. AI-BOM v2.0 provides model provenance, dataset lineage, and weights versioning.

Gaps: None identified.

GOVERN 5: Risk Management Processes Are Defined and Implemented¶

Coverage: ✅ FULLY ADDRESSED

How AGT addresses this subcategory: EU AI Act four-tier risk classification (UNACCEPTABLE, HIGH, LIMITED, MINIMAL) provides structured risk assessment. AgentRiskProfile aggregates risk signals per agent. The compliance engine supports multi-framework verification, allowing organizations to define and enforce risk management processes declaratively.

Gaps: None identified.

GOVERN 6: Policies and Procedures Aligned with Applicable Requirements¶

Coverage: ✅ FULLY ADDRESSED

AGT maintains dedicated compliance mapping documents for seven major frameworks.

How AGT addresses this subcategory: Each compliance document systematically maps AGT capabilities to specific regulatory requirements, identifies gaps, and provides code citations. This document (NIST AI RMF alignment) extends coverage to the eighth framework.

Gaps: None identified.

4. MAP — Context and Risk Identification¶

MAP 1: Context Is Established¶

Coverage: ✅ FULLY ADDRESSED

How AGT addresses this subcategory: ContextualPolicyEngine binds policy evaluation to rich execution context including governance tiers, environment type, and operational mode. The four-ring privilege model (Ring 0: kernel through Ring 3: untrusted) establishes operational boundaries for each agent. ContextScheduler manages token budgets and resource allocation within context.

Gaps: None identified.

MAP 2: Categorization of AI Systems¶

Coverage: ✅ FULLY ADDRESSED

How AGT addresses this subcategory: Dual categorization systems — EU AI Act risk levels (UNACCEPTABLE, HIGH, LIMITED, MINIMAL) and the five-tier trust score (0–1000) — enable AI systems to be categorized by both regulatory risk and behavioral trust. The four-ring execution model further segments agents by privilege level.

Gaps: None identified.

MAP 3: Benefits and Costs Assessed¶

Coverage: ⚠️ PARTIALLY ADDRESSED

AGT provides comprehensive performance benchmarks quantifying governance overhead but lacks formal cost-benefit frameworks.

How AGT addresses this subcategory: Governance overhead is rigorously quantified in latency and throughput terms. Sub-millisecond policy evaluation and microsecond-level audit writes demonstrate that governance does not impose meaningful performance penalties.

Gaps: No formal ROI model or cost-benefit analysis framework. Overhead is quantified in technical terms (latency/throughput) but not in business value terms (risk reduction, compliance cost savings, incident prevention value).

MAP 4: Risks and Impacts Identified¶

Coverage: ✅ FULLY ADDRESSED

How AGT addresses this subcategory: STRIDE-based threat modeling systematically identifies risks across four trust boundaries and six attack surfaces. Prompt injection detection (12+ pattern families), memory poisoning defense, and cascade detection provide defense-in-depth. Chaos engineering and adversarial evaluation proactively discover risks before production deployment.

Gaps: None identified.

MAP 5: Impacts to Individuals, Groups, and Communities¶

Coverage: ⚠️ PARTIALLY ADDRESSED

AGT has PII/PHI protection via regex patterns and GDPR policy templates but lacks ML-based bias detection or fairness evaluation.

How AGT addresses this subcategory: GDPR policy templates provide declarative PII protection across 10+ categories with right-to-erasure and data minimization controls. Memory guard actively redacts PII from agent context. HIPAA-compliant agent tutorials demonstrate PHI protection patterns.

Gaps: - No ML-based NER (e.g., Presidio) for PII/PHI — regex-only detection - No bias detection algorithms or fairness metrics - No demographic parity or equalized odds evaluation - No consent management system - No Data Subject Access Request (DSAR) workflow automation

5. MEASURE — Assessment, Analysis, and Tracking¶

MEASURE 1: Metrics Identified and Applied¶

Coverage: ✅ FULLY ADDRESSED

How AGT addresses this subcategory: SLI/SLO/error budget engine provides structured quantitative metrics with dashboard visualization. Trust scoring (0–1000, five tiers) quantifies agent trustworthiness. Shift-left metrics track governance violations by lifecycle stage (pre-commit, PR, CI, runtime). OpenTelemetry integration exports metrics to industry-standard observability platforms.

Gaps: None identified.

MEASURE 2: AI Systems Evaluated¶

Coverage: ⚠️ PARTIALLY ADDRESSED

How AGT addresses this subcategory: Content quality evaluation and plugin quality assessment provide governance-level evaluation. Red-team datasets and 30-scenario OWASP benchmarks test governance enforcement under adversarial conditions. The Cross-Model Verification Kernel (CMVK) enables constitutional AI checks across models.

Gaps: No formal model accuracy or correctness evaluation pipeline. Quality assessment focuses on governance and content safety rather than model performance metrics (e.g., accuracy, calibration, hallucination rate).

MEASURE 3: Mechanisms for Tracking Identified AI Risks¶

Coverage: ✅ FULLY ADDRESSED

How AGT addresses this subcategory: Behavioral baselines establish normal operating patterns per agent. Drift detectors identify deviations from expected behavior. The rogue agent detector classifies agents exhibiting anomalous patterns. Flight recorders provide forensic-grade telemetry for post-incident analysis. Fleet monitoring aggregates health across agent populations.

Limitation: Behavioral baselines are in-memory only — no durable cross-session persistence. Baselines are lost when agent sessions terminate.

MEASURE 4: Feedback About Efficacy of Measurement¶

Coverage: ⚠️ PARTIALLY ADDRESSED

How AGT addresses this subcategory: Shift-left metrics track violations by lifecycle stage (pre-commit, PR, CI, runtime), enabling measurement of where governance catches issues. SLO dashboards provide point-in-time compliance snapshots. Integration with Langfuse and OpenLit enables external measurement platforms.

Gaps: No time-series compliance trend analysis, no measurement-of-measurement loops, no formal reports on metric effectiveness. The toolkit provides raw measurement capabilities but does not yet evaluate whether those measurements are themselves effective.

6. MANAGE — Risk Response and Monitoring¶

MANAGE 1: Risks Prioritized and Responded To¶

Coverage: ✅ FULLY ADDRESSED

How AGT addresses this subcategory: Multi-tier risk response: circuit breakers (with trip/open/half-open state machine) prevent cascade failures; kill switches provide immediate agent termination for six enumerated risk categories; rate limiters (sliding window, token bucket) control throughput across all language packages. Approval workflows with quorum requirements add human oversight. Saga orchestrators enable compensating transactions to roll back multi-step operations upon failure.

Gaps: None identified.

MANAGE 2: Strategies to Maximize AI Benefits¶

Coverage: ⚠️ PARTIALLY ADDRESSED

How AGT addresses this subcategory: Trust-based capability delegation (child ≤ parent) ensures agents earn expanded privileges through demonstrated trustworthy behavior. Progressive delivery (canary deploys) minimizes risk when introducing governance changes. Trust decay ensures agents maintain good behavior to retain capabilities.

Gaps: No formal "benefit maximization" framework. Trust-based capability delegation exists but is framed as security controls rather than benefit optimization. No documented strategy for balancing governance overhead against agent utility.

MANAGE 3: Risks from Third-Party Entities Managed¶

Coverage: ✅ FULLY ADDRESSED

How AGT addresses this subcategory: Defense-in-depth for third-party risks: MCP security scanner detects tool poisoning and injection; gateway enforces allowlist/blocklist policies; plugin signing (Ed25519) and manifest validation prevent supply chain attacks. AI-BOM v2.0 tracks model provenance and dataset lineage. Egress policies control outbound data flows to authorized domains only.

Gaps: None identified.

MANAGE 4: Risks Monitored¶

Coverage: ✅ FULLY ADDRESSED

How AGT addresses this subcategory: Deep observability stack: OpenTelemetry integration across all packages (spans, metrics, events) exports to OTLP/Jaeger/Zipkin. Rogue agent detector uses behavioral scoring to classify anomalous agents. Fleet monitoring provides population-level health dashboards. Governance-enriched OTel spans embed policy evaluation results directly into distributed traces, enabling governance-aware debugging.

Gaps: None identified.

7. Coverage Summary Matrix¶

Totals: 12 Fully Addressed · 7 Partially Addressed · 0 Gaps

8. Gap Analysis and Recommended Actions¶

Priority 1 — HIGH¶

Priority 2 — MEDIUM¶

Priority 3 — LOW¶

9. Cross-References to Other Compliance Frameworks¶

This alignment assessment complements and cross-references the following AGT compliance documents. Subcategory mappings below show where NIST AI RMF requirements overlap with other frameworks.

Related Documents¶

• ATF Conformance Assessment: docs/compliance/atf-conformance-assessment.md
• OWASP Agentic Top 10: docs/OWASP-COMPLIANCE.md
• OWASP LLM Top 10: docs/compliance/owasp-llm-top10-mapping.md
• EU AI Act Checklist: docs/compliance/eu-ai-act-checklist.md
• SOC 2 Mapping: docs/compliance/soc2-mapping.md
• NIST RFI Response: docs/compliance/nist-rfi-2026-00206.md
• Threat Model (STRIDE): docs/THREAT_MODEL.md
• Architecture Overview: docs/ARCHITECTURE.md

This document was prepared for submission to the National Institute of Standards and Technology (NIST) in response to the AI Risk Management Framework (AI RMF 1.0) alignment assessment process. It reflects the state of the Agent Governance Toolkit as of 2026-07-14. For questions or clarifications, please refer to the project's SUPPORT.md or open an issue on GitHub.