Standards Support
Control Mappings
How Attested Governance Artifacts provide evidence for regulatory framework controls.
Important: References to NIST, CISA, SLSA, and other standards are informational mappings to support governance discussions. This is not certification, endorsement, or compliance advice.
Attested Intelligence™ is not affiliated with, approved by, or endorsed by NIST, CISA, or any standards body. These mappings are provided as a conceptual alignment guide only. Actual compliance depends on implementation context and auditor assessment.
Mappings v1.0Last updated: January 2026
Download PDFNIST AI RMF 1.0
AI Risk Management Framework (NIST AI 100-1)
| Control | Requirement | Mechanism | Evidence Field(s) | Verification Step |
|---|---|---|---|---|
| GOVERN 1.1 | Policies established | Policy Artifact with enforcement_parameters | policy_reference, sealed_hash, artifact_signature | Verify signature against pinned key, parse enforcement parameters |
| GOVERN 1.3 | Oversight mechanisms | Enforcement Receipt chain | receipt.decision, receipt.chain | Verify receipt signatures, validate chain continuity |
| MAP 1.5 | Risk documented | Evidence Bundle commitment | bundle_manifest.policy_hash | Verify commitment hash matches policy artifact |
| MAP 3.1 | Benefits/costs assessed | Telemetry policy thresholds | telemetry_policy.drift_rule | Parse threshold definitions from policy |
| MEASURE 2.3 | Effectiveness tracked | Continuous drift detection | receipt.event_type: MEASUREMENT_OK/DRIFT_DETECTED | Verify receipt signatures, check measurement hashes |
| MEASURE 2.6 | Feedback incorporated | Policy versioning | policy_version, previous_artifact_ref | Verify version chain, check policy_id linkage |
| MANAGE 2.4 | Incidents documented | ENFORCED receipts with forensic data | receipt.decision.action, receipt.decision.reason_code | Verify enforcement receipt, validate action matches policy |
| MANAGE 4.1 | Risk response deployed | Automatic enforcement actions | receipt.event_type: ENFORCED | Verify enforcement occurred per policy mapping |
NIST SSDF
Secure Software Development Framework (SP 800-218)
| Control | Requirement | Mechanism | Evidence Field(s) | Verification Step |
|---|---|---|---|---|
| PO.1.1 | Security requirements defined | Policy Artifact integrity_policy | integrity_policy.baselines | Verify policy signature, parse baseline definitions |
| PO.3.2 | Roles and responsibilities | Key custody and key_id binding | issuer.key_id, signer.key_id | Verify key_id matches authorized issuers |
| PS.1.1 | Software protected | Integrity baseline enforcement | integrity_policy.container_image_digest | Compare runtime digest to sealed baseline |
| PS.2.1 | Software integrity verified | Launch Gate validation | receipt.event_type: POLICY_LOADED | Verify POLICY_LOADED receipt exists and is valid |
| PW.4.4 | Cryptographic practices | Ed25519 signatures, SHA-256 hashing | All artifact.signature fields | Verify all signatures using declared algorithm |
| PW.8.1 | Testing and verification | Offline Verifier conformance | verifier_output.verdict | Run verifier, confirm PASS/FAIL matches expectations |
| RV.1.1 | Vulnerabilities identified | Drift detection and reporting | receipt.event_type: DRIFT_DETECTED | Verify drift receipt, parse mismatched_paths |
| RV.3.3 | Root cause analyzed | Receipt chain forensics | Full receipt chain with timestamps | Reconstruct event timeline from chain |
NIST SP 800-53 Rev. 5
Security and Privacy Controls (Selected)
| Control | Requirement | Mechanism | Evidence Field(s) | Verification Step |
|---|---|---|---|---|
| AU-2 | Event Logging | Enforcement Receipt emission | receipt.event_type, receipt.timestamp | Verify all required event types present |
| AU-9 | Audit Information Protection | Signed, hash-chained receipts | receipt.chain.prev_receipt_hash | Verify chain integrity, detect tampering |
| AU-10 | Non-repudiation | Ed25519 signatures on all artifacts | artifact.signature, receipt.signature | Verify signatures against published keys |
| CM-2 | Baseline Configuration | Policy Artifact integrity baselines | integrity_policy.config_digest, sbom_digest | Compare runtime to sealed baselines |
| CM-3 | Configuration Change Control | Drift detection + policy versioning | DRIFT_DETECTED receipts, policy_version | Verify all changes trigger drift detection |
| SI-4 | System Monitoring | Continuous integrity measurement | MEASUREMENT_OK receipts | Verify measurement cadence matches policy |
| SI-7 | Software Integrity | Container/subject digest verification | integrity_policy.container_image_digest | Verify runtime digest matches sealed value |
| SA-10 | Developer Configuration Management | SBOM and build provenance | sbom_digest, build attestations | Verify SBOM hash, check provenance chain |
CoSAI MCP Security Threat Coverage
12/12Coalition for Secure AI (CoSAI), OASIS Open Project, January 2026
The CoSAI MCP Security whitepaper identifies 12 core threat categories and nearly 40 distinct threats specific to Model Context Protocol deployments. AGA addresses all 12 categories through its existing governance architecture.
| ID | Threat Category | Domain | AGA Governance Mechanism |
|---|---|---|---|
| T1 | Improper Authentication | Identity & Access | Ed25519 artifact signatures, pinned issuer keys, TTL re-attestation, key rotation chain events |
| T2 | Missing Access Control | Identity & Access | Portal as mandatory enforcement boundary, sealed constraints, delegation with scope diminishment |
| T3 | Input Validation Failures | Input Handling | Runtime measurement against sealed reference, behavioral drift detection |
| T4 | Data/Control Boundary Failures | Input Handling | Behavioral baseline (permitted tools, forbidden sequences, rate limits), phantom execution forensics |
| T5 | Inadequate Data Protection | Data & Code | Salted commitments, privacy-preserving disclosure with substitution, inference risk prevention |
| T6 | Missing Integrity Controls | Data & Code | Content-addressable hash binding, 10 measurement embodiments, continuous runtime verification |
| T7 | Session/Transport Security | Network & Transport | TTL-based artifact expiration, fail-closed on expiry, mid-session revocation, Ed25519 signed receipts |
| T8 | Network Isolation Failures | Network & Transport | Two-process architecture, agent holds no credentials, NETWORK_ISOLATE enforcement action |
| T9 | Trust Boundary Failures | Trust & Design | Enforcement pre-committed by human authorities in sealed artifact, not delegated to LLM |
| T10 | Resource Management | Trust & Design | Per-tool rate limits in behavioral baseline, configurable measurement cadence (10ms to 3600s) |
| T11 | Supply Chain Failures | Operational | Content-addressable hashing at attestation, runtime hash comparison blocks modified components |
| T12 | Insufficient Observability | Operational | Signed receipts, tamper-evident continuity chain, Merkle anchoring, offline evidence bundles |
Evidence Artifact Summary
Policy Artifact provides:
- Governance policy establishment (GOVERN)
- Baseline configuration (CM-2)
- Security requirements (PO.1.1)
Enforcement Receipt provides:
- Event logging (AU-2)
- Non-repudiation (AU-10)
- Incident documentation (MANAGE)
Continuity Chain provides:
- Audit protection (AU-9)
- Change control (CM-3)
- Effectiveness tracking (MEASURE)
Evidence Bundle provides:
- Offline verification capability
- Third-party audit support
- Portable evidence packaging