NIST AI Risk Management Framework
How Crawdad maps to the four functions of the NIST AI RMF 1.0.
GOVERN Policies, accountability, and oversight
- Policy engine, configurable rules for which actions agents can take, with trust levels (Untrusted, Basic, Verified, Privileged)
- Governance plane and charters, on-device controls at the agent-to-tool boundary: autonomy ceilings, security zones, per-tool rules, a cumulative session-risk budget, and opt-in Contextual Agency Governance charters that govern each agent by its declared purpose (an allowlist over the tools, data, and effects its job needs) held outside the agent's control. Every charter and trajectory decision is recorded to the tamper-evident audit chain and reviewable on the local dashboard and the Fleet Console.
- Cryptographic audit trail, SHA-256 hash-chained log of every security decision (a linear hash chain). Ed25519 signed. Tamper-evident.
- Compliance report generation, signed attestation of what data leaves the network (run
curl localhost:7749/v1/verify)
- Role-based access, API keys scoped per project, admin keys separated from runtime keys
MAP Understanding context and identifying risks
- Threat intelligence feed, 28+ AI agent threats tracked from 10 security sources, updated every 4 hours
- MITRE ATLAS coverage mapping, 13 ATLAS techniques mapped to Crawdad controls (view coverage)
- OWASP LLM Top 10 coverage, all 10 categories assessed with honest status (view coverage)
- STRIDE threat model, systematic analysis of spoofing, tampering, repudiation, disclosure, DoS, and privilege escalation (view model)
- SBOM, CycloneDX bill of materials for every dependency (view SBOM)
MEASURE Quantifying risk and testing controls
- 3,737 automated tests across 26 Rust crates, 0 failures, 0 unsafe blocks
- Open 497-attack / 1,172-negative benchmark: 99.8% detection, 0.09% false-positive rate (1/1,172), F1 99.80% (published at
github.com/AndrewSispoidis/contemporary-agent-attacks, reproducible by any third party)
- Continuous red team mutation engine: ~75% block rate (adversarial harder set). Target 90%+ before scale, 95%+ at maturity.
- False positive benchmarks: 0 on 57-item hand-curated negative corpus; 1 on 1,075 wild StackOverflow developer messages (0.09% overall)
- Detection latency: sub-millisecond on pattern-only layers; the ML layer adds platform-dependent inference time (auto-downloaded on macOS ARM64, Linux x86_64, and Linux ARM64; pattern-only on macOS Intel and Windows)
- 12/12 production smoke tests passing, ran after every deployment
- CI/CD pipeline, unit tests, build verification, latency benchmarks on every push
MANAGE Active risk treatment
- Real-time threat blocking, multi-layer detection pipeline detects prompt injection, jailbreaks, and exfiltration in-proxy; the arbiter blocks corroborated threats and alerts on single-layer detections. 99.8% detection rate and 0.09% false-positive blocking rate (1/1,172) on the open 497-attack / 1,172-negative benchmark; ~75% on continuous red team mutation engine.
- Purpose-scoped enforcement, an agent action outside its charter is blocked at the wire with the divergence axis named, and a staged multi-step escalation (enumerate, read progressively more sensitive in-scope data, then send) is caught by the trajectory layer and held for human review when no on-device reasoner is reachable. Opt-in and composed most-restrictive with the detection pipeline; a separate governance axis that does not change the detection numbers.
- PII redaction, 15 PII categories + 10 credential types detected and redacted from outbound responses
- Incident audit log, every blocked request, every scan decision, hash-chained with Ed25519 signatures
- Signed compliance reports, cryptographic proof of what data stayed local and what was transmitted
- Threat intelligence updates, new detection signatures every 4 hours from live security feeds
- Transparent proxy, zero code changes to protect existing agents. Set one environment variable.