standard
A voluntary NIST framework guiding organizations in managing AI risks, structured around four functions: Govern, Map, Measure, and Manage.
No evidence-backed relationships are recorded.
NIST's own page says a revised AI RMF is in progress. The notice sits above the 2023 Core excerpt, and its four functions and subcategory numbering are what internal policies, audit files and vendor attestations quote.
Reality
A study accepted at GAISS 2026 reports that a specification baseline increased the attributability of reviewers' bug finds without increasing their count, and that on easy tasks the credit for spec-first prompting mostly belongs to reasoning effort.
Reality
OWASP's v1.0 standard says the payload is prose and the permissions belong to the host agent, which is another way of saying the SAST and SCA licences already on the books scan straight past the thing teams are installing this quarter.
Reality
A devops.com walkthrough puts the fix in ordinary change control rather than model tuning, and its simulation shows what blind retries cost once a timeout leaves the outcome unknown to the caller.
Reality
An essay on dev.to argues ISO 27001, SOC 2 and NIST SP 800-53 were built around authenticated human decisions with a paper trail. AI sessions leave none, and you cannot reconstruct them later.
Reality
Lakshman Pandey's write-up maps a production retrieval system to all four NIST functions. The controls that exist are documents and evals; the ones that would gate a deploy are still marked future.
Reality
Agent Governance Toolkit puts policy checks in the execution path rather than the prompt. The seam: the kernel is middleware inside the agent's process, so containers still do the isolating.
Reality