Compliance
AIControls maps your active policies and enabled capabilities to the NIST AI Risk Management Framework (AI RMF). The Compliance page shows which controls are covered, which are partial, and which are missing — giving you an actionable gap list for security reviews and audits.
NIST AI RMF
The NIST AI Risk Management Framework is the leading US standard for managing risk in AI systems. It organizes controls across four core functions — Govern, Map, Measure, and Manage — covering everything from policy documentation to incident response.
AIControls evaluates your workspace configuration against the AI RMF controls that are relevant to AI agent and LLM deployment: access control, monitoring, content safety, human oversight, auditability, and supply chain integrity.
Coverage status
Navigate to Security → Compliance to see your current coverage. Each control is reported as one of three states:
| Status | Meaning |
|---|---|
| Covered | One or more active policies or enabled capabilities directly address this control. No action required. |
| Partial | The relevant capability is enabled but not all risk vectors within the control are addressed by a policy. The detail panel shows what is missing. |
| Missing | No active policy or capability addresses this control. A suggested policy or configuration change is shown. |
Coverage is computed in real time from your loaded policies and current settings — it updates automatically when you add or modify a policy.
Control categories
The controls assessed by AIControls span seven AI RMF categories, grouped under the framework's Govern, Map, Measure, and Manage functions:
- Govern covers the governance foundations — whether your policies are documented, approval workflows exist, exceptions are tracked, and audit logs are retained.
- Map — Risk Identification covers how well you can attribute actions to identities, classify the tools and models in use, understand blast radius, and detect anomalies.
- Measure — Monitoring covers continuous audit logging, behavioral baselines, token spike detection, and violation rate tracking.
- Measure — Content Safety covers protections against unsafe content, including PII detection, prompt injection scanning, and output filtering.
- Manage — Human Oversight covers human-in-the-loop controls — approval rules for high-risk operations, auto-pause configuration, and session review.
- Manage — Access Control covers identity-scoped budget rules, tool-level allow/deny policies, and PAT scope restrictions.
- Manage — Incident Response covers your ability to respond to incidents — alert routing, anomaly escalation, session pause capability, and audit export for investigation.
For the full list of assessed controls and what AIControls checks for each, see Compliance Controls.
Improving coverage
Each missing or partial control on the Compliance page includes a targeted recommendation, since gaps are typically specific to a single AI RMF category — for example, a missing human oversight policy or disabled anomaly detection. Working through these recommendations is the fastest way to raise coverage, and revisiting them periodically (or after adding new policies) keeps coverage current as your configuration evolves.
Note that enabling a capability in audit mode (rather than enforce mode) still counts as coverage for monitoring-class controls, but not for enforcement-class controls — the detail panel distinguishes between the two.
For step-by-step guidance on closing specific gaps and exporting a coverage report, see Generate a Compliance Report.