NIST AI RMF
Govern, map, measure and manage — at the action layer
The framework is voluntary and function-based rather than a checklist. ApexClaw contributes mostly to Measure and Manage: the controls that make an agent's actions bounded, and the artifacts that make them checkable afterwards.
Contribution by function
| Function | Where ApexClaw contributes | Where it does not |
|---|---|---|
| Govern | Policy is versioned, deterministic and auditable, so the organisation's rules for agent action exist as an artifact rather than a convention. | Organisational accountability, culture, roles and training. |
| Map | The action surface is enumerable: which agents may reach which actions, on whose behalf, within what limits. | Context establishment, impact assessment and stakeholder analysis. |
| Measure | Every decision and effect is recorded with its policy version and outcome, including refusals and undeterminable results. | Model-level evaluation, bias and performance measurement. |
| Manage | Hard limits, human approval bands, revocation at dispatch and exactly-once execution bound the realised risk. | Prioritisation across the organisation's whole AI portfolio. |
Mapped means we assert the control addresses the requirement. Evidence-backed means the control emits an artifact a reader can verify. Conformity readiness means the evidence an assessor would request is assembled. Certification means an accredited third party assessed the system and issued a certificate — ApexClaw holds none, and displays none.
Generative AI Profile — the action-layer risks
The profile calls out risks specific to generative systems. These are the ones that land on the execution layer rather than the model.
Information integrity reaching a tool
Content the system ingests can carry instructions. Where that content leads to a tool call, the call is authorized independently of the content that prompted it.
Dangerous or unsafe actions
A prohibited action class produces no effect, and no approval can release it. The refusal is itself a record.
Human-AI configuration
Which decisions require a person is set by policy, not by the model's own assessment of its confidence.
Value chain and component integration
Tool provenance is signed inside the evidence envelope, so which component reached which action is part of the record.
The AI RMF is voluntary guidance. Nothing on this page is a claim of conformance to it, and there is no certification scheme against the framework to claim.