What NIST Has Published, and What It Does Not Cover
NIST AI RMF 1.0, published in January 2023, established four core functions for AI risk management: Govern, Map, Measure, and Manage. In July 2024, NIST released the Generative AI Profile, designated NIST AI 600-1, as a companion resource that identifies generative-AI-specific risks including confabulation, harmful bias, data privacy exposure, and value-chain integration risk. Each risk is mapped to suggested actions under the four functions.
Neither document, nor the accompanying AI RMF Playbook, defines technical constructs specific to autonomous agents. There is no NIST-specified treatment of agent identity, tool-call permission scopes, or agentic action audit trails. The Playbook itself is explicitly non-mandatory and intended for organizations to adapt rather than implement literally. Enterprise architects working with agentic systems are therefore extending, not simply applying, existing NIST guidance.
Recent Organizational Shift: AI Safety Institute to CAISI
One notable change in the past 12 months is organizational rather than technical. NIST's AI Safety Institute was renamed the Center for AI Standards and Innovation (CAISI) in 2025. This shift reflects an evolving federal emphasis toward standards development and evaluation work.
It does not itself constitute new agentic-specific technical guidance, and enterprises should not treat the renaming as a signal that agent-specific NIST controls are imminent. It is worth monitoring, however, since it may influence the direction of future profile updates relevant to autonomous systems.
Translating the Four Functions Into an Enforcement Architecture
Because NIST's functions are deliberately framework-level rather than prescriptive, enterprise architects need an internal translation layer to make them enforceable at runtime. The table below maps each RMF function to the runtime control category it implies for agentic systems.
| RMF Function | Runtime Control Implication | What to Implement |
|---|---|---|
| Govern | Policy ownership and escalation tied to agent identity, not just human roles | Define approval workflows for new agent deployments; assign accountable owners per agent |
| Map | Agent registry documenting permitted tools, data scopes, and use cases | Maintain a structured inventory of deployed agents with declared capabilities and boundaries |
| Measure | Telemetry on tool-call frequency, scope violations, and output drift | Instrument agent runtimes to emit structured logs; define threshold-based alerting |
| Manage | Enforcement points that throttle, block, or require approval for agent actions | Implement runtime policy guards at the tool-call layer; define escalation and override procedures |
The Agent Identity Gap
A recurring technical prerequisite across all four functions is agent identity and credential management, including short-lived tokens and scoped API keys. Current NIST profile guidance does not explicitly specify this construct, yet without it, Govern-function accountability and Manage-function enforcement have no reliable anchor.
Most existing identity and access management systems are built around human identities and require custom lifecycle management to accommodate non-human agent identities operating across multiple tool calls and sessions. This includes creation, rotation, and revocation processes that standard IAM tooling does not provide out of the box.
Agent identity is a foundational dependency for all four RMF functions. Until agent identity is solved, Govern and Manage controls in particular remain logically incomplete, regardless of how well the policy layer is documented.
Operationalizing the Four RMF Functions in Practice
Govern: Establish ownership before deployment
For agentic systems, the Govern function requires that every deployed agent have a named owner, a documented purpose, and a defined approval process before it enters production. This is analogous to application onboarding in traditional IT governance, but must account for the dynamic, tool-invoking nature of agents. A policy that states "AI systems must have accountable owners" is insufficient unless it specifies how ownership transfers when agent capabilities change or expand.
Map: Build an agent registry
The Map function implies maintaining a current, structured registry of all deployed agents. Each entry should capture the agent's declared tool set, the data scopes it may access, the use cases it is authorized to serve, and the human roles that authorized it. This registry is the operational foundation for both Measure and Manage controls: you cannot measure what you have not catalogued, and you cannot enforce permissions that are not specified.
Measure: Instrument the runtime
Measurement for autonomous agents goes beyond standard model evaluation. It requires runtime telemetry: structured logs of every tool call, the inputs provided, the outputs returned, and whether the call fell within declared scope. Useful metrics include tool-call frequency by agent, rate of out-of-scope attempts, latency and error distributions per tool, and output drift indicators over time. These signals support both retrospective audit and real-time alerting.
Manage: Enforce at the tool-call layer
Management controls for agents should be implemented as enforcement points at the boundary between the agent and the tools it can invoke. These enforcement points can operate in several modes: permissive (log only), restrictive (block disallowed calls), and interactive (require human approval for specific call types). Defining which mode applies to which tool, under which conditions, is a policy decision that should be governed by the same ownership structure established under the Govern function.
Governance Considerations for Enterprise Architects
NIST AI RMF and AI 600-1 remain voluntary, non-regulatory frameworks in the United States, though they are increasingly referenced in vendor risk assessments and procurement requirements. Enterprises should document Govern-function ownership, specifically identifying who approves new agent deployments, to support internal accountability and readiness for potential future regulation.
Because current NIST guidance does not define agent-specific accountability structures, treat existing RMF and Profile mappings as a baseline that requires internal supplementation rather than a complete specification. As CAISI's role develops, track whether future NIST outputs begin to address agentic constructs directly, but do not delay internal control development while waiting for that guidance to materialize.