Function by function. The NIST AI Risk Management Framework 1.0 organises AI risk work into Govern, Map, Measure and Manage. Each applies to agents, but each needs adapting, because an agent acts rather than predicts. The framework is voluntary and sets no limits; it tells you what to think about, and you decide what the agent may do.
What is the NIST AI RMF, in brief?
NIST published the AI RMF 1.0 in January 2023 as voluntary guidance for organisations designing, developing, deploying or using AI. It has four functions:
- Govern: policies, roles, accountability and culture for AI risk.
- Map: understand the context: the system's purpose, users, affected people and potential impacts.
- Measure: assess, analyse and track risks with appropriate methods and metrics.
- Manage: prioritise and act on risks, including responses to incidents.
NIST also published a Generative AI Profile (NIST AI 600-1) applying the framework to generative AI. Neither document is a regulation. US firms often use the RMF to structure their approach. For the contrast with binding law, see EU AI Act vs NIST AI RMF for AI agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What does each function mean for an agent that acts?
| Function | For a predictive model | For an agent |
|---|---|---|
| Govern | Who approves the model | Who approves each capability, at what depth, and who can stop it |
| Map | Intended use and affected groups | Every tool the agent can call, what each changes, and whether it can be undone |
| Measure | Accuracy and bias metrics | Grounding, refusal, escalation and staying in scope, tested on real cases |
| Manage | Retrain or retire the model | Narrow limits, hold actions, drop depth, or stop the agent at once |
The biggest shift is in Map. A model's context is its use. An agent's context includes its tools, the systems those tools reach, and the content it reads, some of which may be written by people trying to manipulate it.
Concrete examples: what may the agent do, and what stays with a person?
The RMF does not answer this directly; the Manage function asks you to. A reasonable outcome for a lender's servicing agent:
- Agent may: answer account questions, explain statements, update contact preferences.
- Agent may, within limits: waive late fees up to a set amount, set up standard payment plans.
- Stays with a person: forbearance outside policy, any action for a customer flagged as vulnerable, closing accounts, and anything the agent's tests showed it handles poorly.
An illustrative example
Take a US credit union that adopts the RMF for its first member-service agent. Under Govern, it names the head of member services as owner and the risk committee as approver, and sets a rule that the agent's depth can only rise with test evidence. Under Map, it lists the agent's six tools, marks two that move money, and notes that members' emails may contain pasted content from elsewhere.
Under Measure, it tests the agent on several hundred past member conversations and scores whether answers were grounded, whether the agent refused out-of-scope requests and whether it handed over when it should. Under Manage, it sets fee waivers to execute within a limit and holds transfers for staff. Six weeks in, monitoring shows grounding slipping after a model update; the agent is held to read-only until re-tested. That monitoring is covered in NIST AI RMF monitoring and drift for AI agents.
What are the framework's limits for agents?
The RMF is a structure for thinking, not a set of controls. It will not tell you which actions to hold, what a test case looks like, or how to enforce a limit at the moment of action. Firms that treat completing the framework as the goal end up with good documents and uncontrolled agents. The argument is set out in the NIST AI RMF is a useful map, not a control set.
Firms deciding between the RMF and a certifiable system can read whether to follow the NIST AI RMF or ISO/IEC 42001. Those with EU exposure should also check whether the EU AI Act applies to AI agents, which is binding where the RMF is not. The full map is in AI agent regulation, mapped to controls.
Where Pryme fits
Pryme's controls line up with the RMF's functions: the minimum chain enforces Govern's limits at each action, Attest supplies Measure's evidence on the customer's own cases, and a short run cutting an agent to the highest depth it cleared is a Manage response that happens automatically.
Questions people ask
Is the NIST AI RMF mandatory for US companies?
No. It is voluntary. Some laws and contracts refer to recognised frameworks, which makes following one useful evidence of reasonable care.
Does the Generative AI Profile cover agents?
It addresses risks of generative AI that also affect agents, such as confabulation and information security. It does not replace an assessment of the agent's tools and actions.
Can a small firm use the RMF?
Yes. The functions scale. A small firm can cover all four for one agent in a short document, provided the testing and limits behind it are real.