← Evidence guides
NIST AI RMF 1.0
Use authorization evidence in your AI risk program.
NIST AI RMF is a voluntary framework organized around GOVERN, MAP, MEASURE, and MANAGE. Authorization records can support parts of that broader process.
NIST AI RMF CoreThis is a topic-level evidence guide for AI RMF 1.0, not a NIST certification or an assessment of your organization.
What the evidence can contribute.
Permission Protocol’s suggested mappings below are for review. Confirm the fields available in your integration and whether the artifact is independently signed. Authorization evidence alone does not prove execution, complete coverage, or compliance.
GOVERN: accountability
- Potential receipt or decision evidence
- An approver identity, policy reference, and authorization time tied to the reviewed action.
- Your team must establish
- Assign responsible owners, approve policies, establish escalation paths, and verify the signer's authority.
MAP: context and scope
- Potential receipt or decision evidence
- The action, resource, and available environment or agent context in the selected receipt format.
- Your team must establish
- Document the system's purpose, affected parties, deployment context, and risks beyond the gated action.
MEASURE: evaluation
- Potential receipt or decision evidence
- Sample authorization records alongside approval, denial, and changed-action test results.
- Your team must establish
- Define risk metrics, evaluate control effectiveness, and assess missing or bypassed paths. Receipt counts alone do not establish coverage.
MANAGE: risk response
- Potential receipt or decision evidence
- Decisions recorded for configured enforcement paths.
- Your team must establish
- Select risk treatments, test outage behavior, manage exceptions, and monitor the system after deployment.
Build an evidence pack for one workflow.
Agree the requirement with your reviewer. Collect the configuration, approval records, verification results, exception handling, and tests for the chosen path. Evaluate gaps before expanding.