Compliance · NIST AI RMF 1.0 · Agentic AI

The framework asks four questions. For agents that act, Manage is the one with teeth.

The NIST AI Risk Management Framework, version 1.0 (NIST AI 100-1, released January 2023) with the Generative AI Profile (NIST AI 600-1, released July 2024), is voluntary. The Manage function is where an agent that acted, on a real system, has to leave a record.

§ 01 The four functions

Voluntary, not optional. The framework most teams are graded against.

NIST AI RMF 1.0 organizes AI risk into four functions: Govern (the organization's authority and culture for AI), Map (the context and risks of a specific AI system), Measure (the methods used to assess those risks), and Manage (the controls and the evidence that they were applied).

Govern, Map, and Measure can be documented in a deck. Manage cannot. Manage requires the record.

§ 02 The evidence

What Manage looks like for an agent that acted.

The substrate makes the Manage function a property of the action.

The question a Manage reviewer asks

Without the substrate

With Subnet345

Which agent acted on which AI-influenced decision, under which policy

Reconstructed from logs, if at all

Attributed at the moment of action

What controls were applied, when, and by whom they were authorized

Inferred from procurement language and review meetings

The policy, the version, and the approver, on the record

What refusals the policy produced, and how they were resolved

Refusals not durably captured

Every refusal recorded as an attributable event

Where the record lives when an auditor asks for it

Vendor-managed, with caveats

Inside your boundary, retained on your retention schedule

Hand the examiner evidence in a form they can read

A bespoke log export, assembled by hand

Evidence exports in a format your examiner can read, run by your operator inside your perimeter

This material is informational, not legal or regulatory advice. NIST AI RMF 1.0 is voluntary; its application to a specific organization depends on context. The substrate produces the record; it does not by itself make a program compliant or aligned. Assess your specific obligations with qualified counsel.

§ 03 Questions

NIST AI RMF and agentic AI, answered.

Is NIST AI RMF mandatory?

No, it is voluntary. It is also the framework that regulators, procurement teams, and internal AI governance committees most often reach for when they need a defensible shape to evaluate an AI system against.

Is this legal or regulatory advice?

No. This material is informational. The substrate produces the record; it does not by itself align a program to NIST AI RMF or any other framework. Assess your specific posture with qualified counsel and your internal AI governance function.

Can you show Manage was applied, action by action?

Request a demo →Financial Services brief →