This page is for risk managers, security architects, and the engineers who answer NIST AI RMF questions in vendor questionnaires, federal proposals, and board reports for organizations running AI agents. It maps the controls Praesidia provides to the framework's four functions, Govern, Map, Measure, and Manage, at the subcategory level, and it lists the evidence you can export for each.
The NIST AI Risk Management Framework 1.0 (January 2023) is voluntary, outcome-oriented, and deliberately technology-neutral. It defines seven characteristics of trustworthy AI (valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, fair) and organizes practice into four functions with numbered categories and subcategories. The Generative AI Profile (NIST AI 600-1, July 2024) adds suggested actions for generative risks under the same structure. Nothing certifies alignment; the framework asks you to be able to show your work.
Agents change the difficulty of that showing. GOVERN 1.6 asks for an inventory of AI systems; agents are created by developers faster than any registry is updated. MEASURE 2.4 asks for production monitoring; an agent's behaviour is a stream of tool calls and inter-agent messages, not a single output. MANAGE 2.4 asks for mechanisms to supersede, disengage, or deactivate; a fleet on shared credentials cannot be stopped one agent at a time. The NIST AI RMF for agents post works through each function; the AI governance guide gives the broader control model.
Control mapping
| Requirement / criterion | What Praesidia provides | Evidence you can produce |
|---|---|---|
| GOVERN 1.4 — Risk-management processes are transparent and documented | Framework report generation against the AI RMF control catalogue with evidence collection and gap tracking; compliance reports summarising posture. | Generated framework report; gap list with owners and status. |
| GOVERN 1.5 — Ongoing monitoring and periodic review of the risk process | Alert rules over the audit stream; access-review workflows on a schedule you set; per-agent risk classification reassessable on change. | Alert history; completed access-review records; classification revision history. |
| GOVERN 1.6 — Inventory of AI systems maintained and resourced | Registration of every agent, MCP server, and application with its own identity; discovery surfaces agents operating outside governance so they can be adopted. | Inventory export; the discovery inbox listing agents that were observed but not yet adopted. |
| GOVERN 1.7 — Safe decommissioning processes | Single-agent revocation that invalidates one identity and its tokens without affecting the fleet, recorded in the trail. | Revocation events with operator and time. |
| GOVERN 2.1 — Roles, responsibilities, and lines of communication documented | Customer control; Praesidia contributes role-based access for the control plane, SSO/SCIM tied to your identity provider, and scoped API keys so automation has a named, bounded role. | Role assignments; SCIM lifecycle records; API-key scope listing. |
| GOVERN 6.1 — Policies for third-party software, data, and supply-chain risks | Customer control; Praesidia contributes bring-your-own-key model-provider access, governed MCP-server connections with per-tool authorization, and a published subprocessor list on the security page. | Provider and MCP-server inventory; tool-authorization configuration. |
| MAP 1.1 — Intended purposes, context of use, and assumptions documented | Declared connections, permitted tools, guardrails, and policies per agent as a machine-readable statement of intended operation; risk tier recorded on the agent. | Per-agent configuration export; classification record. |
| MAP 5.1 — Likelihood and magnitude of impacts characterised | Customer control; Praesidia contributes structured per-agent risk classification and the historical behaviour data (denied requests, guardrail hits, spend) needed to ground the estimate. | Classification with rationale; behaviour metrics for the period. |
| MEASURE 2.4 — Functionality and behaviour monitored in production | OpenTelemetry metrics and traces, guardrail hit rates, denied-request counts, spend attribution per agent, team, and workflow, SIEM forwarding. | Metric exports; dashboards; forwarded events. |
| MEASURE 2.7 — Security and resilience evaluated and documented | Bidirectional guardrails against prompt injection and data exfiltration; intent rules that block the right call against the wrong data; non-human identity with rotation and per-region vaulting. | Guardrail decision records; blocked-injection samples; rotation history. |
| MEASURE 2.8 — Transparency and accountability risks examined | An append-only, attributable record of every request, response, and policy decision on routed connections, with optional cryptographic tamper-evidence and an offline verifier. | Signed bundle export plus verifier result, reproducible by a third party. |
| MEASURE 2.10 — Privacy risk examined and documented | PII detection and redaction in both directions; data-residency controls per connection; GDPR erasure support. See the GDPR mapping. | Redaction decision records; residency configuration; erasure records. |
| MANAGE 2.4 — Mechanisms to supersede, disengage, or deactivate | Single-agent revocation on the next request; fail-closed block verdicts; hard spend caps; human approval gates before consequential actions. | Revocation, cap, and approval events with operator and time. |
| MANAGE 4.1 — Post-deployment monitoring, incident response, recovery, and change management | Customer control; Praesidia contributes forensic search, hop-by-hop attribution across agent chains, alerting, and an attributable change history for every control. | Incident-period export with chain views; change history for the affected connection. |
What this mapping is not
The NIST AI RMF is voluntary and has no certification scheme, so there is nothing to certify against; this mapping supports your assessment and does not constitute certification or an endorsement by NIST. It shows which subcategories Praesidia's controls contribute to and what artefacts you can pull for each. It does not decide your risk tolerance (MAP 1.5), rank your risks (MANAGE 1.2), or write your incident-communication plan (MANAGE 4.3).
Most of GOVERN is organisational: policy, culture, workforce competence, and engagement with affected communities (GOVERN 1.1, 1.2, 3, 4, 5). The MAP function is largely analytical work by people with domain knowledge (MAP 1.2, 2.3, 3). Praesidia gives those activities a system of record and operating data; it does not perform them.
Two scoping statements belong in any alignment claim you make. The audit trail records connections routed through Praesidia; agent traffic that bypasses the platform is not visible to it. And when cryptographic signing is enabled, the offline verifier proves exported records were not altered after signing, not that every action was captured in the first place. Those limits are written out at /security/verify-your-audit-trail, and a careful reviewer will want them stated rather than discovered.
Getting started
- Close the GOVERN 1.6 gap first. Register every agent, MCP server, and application at /start, following the getting-started guide, and adopt anything discovery surfaces that nobody registered.
- Record intended purpose and a risk tier per agent (MAP 1.1, MAP 5.1), then attach the treatments, guardrails, policies, budgets, and approval gates, to the connections they mitigate.
- Rehearse MANAGE 2.4. Revoke a test agent, confirm the rest of the fleet keeps running, and confirm the revocation appears in the trail. The kill-switch post covers the design questions; the incident readiness checklist covers the runbook.
- Produce one piece of MEASURE 2.8 evidence end to end via from agent action to audit evidence, verify the export offline per /security/verify-your-audit-trail, then generate the AI RMF framework report and assign owners to the gaps it lists.
Common questions
It is voluntary guidance from the U.S. National Institute of Standards and Technology, published as AI RMF 1.0 in January 2023 with a Generative AI Profile (NIST AI 600-1) in 2024. It is widely referenced in U.S. federal procurement, state laws, and customer questionnaires, so many organizations treat alignment as a practical requirement even though no regulator certifies it.
It means you can show, subcategory by subcategory, what you do and what evidence supports it. Praesidia generates framework reports against the AI RMF control catalogue with evidence collection and gap tracking, so the claim is backed by exports rather than a narrative. This mapping supports your assessment and does not constitute certification.
GOVERN 1.6 (inventory) because agents proliferate; MEASURE 2.4 and 2.7 (production monitoring, security and resilience) because agents act continuously against live tools; and MANAGE 2.4 (the ability to supersede, disengage, or deactivate) because an agent that cannot be stopped surgically is a risk the framework names explicitly.
Single-agent revocation takes effect on the next request and contains the blast radius to that one identity; fail-closed block verdicts stop specific actions; hard spend caps stop runaway consumption. Each is recorded in the tamper-evident trail with the operator and time, which is the evidence MANAGE 4.1 asks you to keep.
The Profile adds suggested actions for generative risks such as prompt injection, data leakage, and confabulation under the same four functions. The guardrail, identity, and monitoring rows below are the controls those actions point to; the Profile's governance and content-provenance actions remain largely yours.