NIST AI RMF accountability: roles and owners for AI agents

The NIST AI Risk Management Framework expects accountability structures in which people and teams have the authority, responsibility and training to manage AI risk. For AI agents, translate that into a decision-rights map: for each agent, who owns it, who may change it, who decides on what it holds, who may stop it, and who answers when it errs.

What does the framework say about accountability?

The NIST AI Risk Management Framework 1.0, published in January 2023, organises AI risk work into four functions: Govern, Map, Measure and Manage. It is voluntary. Accountability lives mainly in Govern, which asks organisations to establish policies, processes and structures so that AI risk is owned.

In substance, the framework expects:

• roles, responsibilities and lines of communication for mapping, measuring and managing AI risk to be documented and clear;
• people to be trained to carry out their responsibilities;
• executive leadership to take responsibility for decisions about risks associated with AI;
• organisational policies to address risks from third-party AI, including systems the organisation did not build;
• diverse perspectives to inform decisions across the lifecycle.

The Generative AI Profile (NIST AI 600-1) applies the framework to generative systems, which includes the models most agents run on. Our overview of how the NIST AI RMF applies to agents covers all four functions.

Who does it apply to?

Anyone who chooses to use it. It is widely referenced in the United States, by public bodies and by firms in regulated sectors, and used internationally as a common vocabulary. Because it is voluntary, it imposes nothing by itself, but supervisors and customers often ask how a firm's AI governance maps to it. We think it is a useful map, not a control set, and accountability is where that matters most: the framework tells you to assign roles but not which ones agents need.

Which decision rights does each agent need?

An agent acts, so accountability is about who may authorise, change, stop and answer for its actions. Map these decision rights for every agent:

1. Own. Who is accountable for the agent's purpose and outcomes? One named person, in the business.
2. Grant authority. Who decided the agent may take each kind of action, and on what evidence? Recorded per agent.
3. Change. Who may change the agent's brief, sources, tools or limits? And who approves those changes? Never the same person.
4. Decide on held actions. Who approves what the agent holds for a person? Named, with a deputy.
5. Stop. Who may suspend the agent at once if something goes wrong? This should be easy and well known.
6. Answer. Who explains the agent's actions to a customer, a supervisor or a court?

The answers should be in one place and current. An agent whose decision rights are spread across emails and wiki pages has no real accountability.

What is different about accountability for an agent that acts?

Three things set agents apart from other AI in this respect.

Authority compounds. One agent may call another, or use a tool with broad permissions. Accountability for the first agent must include what it can cause the second to do.

Speed outruns approval. An agent can take many actions before anyone notices a problem. The right to stop it must be held by someone who is watching and able to act immediately.

Third parties sit inside the action. Most agents rely on a model provider. The framework expects third-party risk to be governed, which means someone owns the relationship and the re-testing when the provider's model changes.

Human oversight is the operational side of accountability; our piece on NIST AI RMF and human oversight of agents covers how to design it.

How do you document accountability in a way that holds?

What will a supervisor, auditor or customer ask?

• Who owns this agent, and who granted it the authority to act?
• Who changed it last, and who approved the change?
• Who can stop it, and how quickly?
• Who decides when it holds an action?
• Who manages the model provider relationship?
• Which executive accepted the risk?

What does the framework not cover?

It is not a law and imposes no legal accountability. It does not assign individual liability, which sector regimes do. It does not prescribe controls in detail. In financial services, supervisors' model risk expectations, such as SR 11-7 in US banking, apply alongside it. Other frameworks treat accountability in similar terms; see MAS FEAT accountability and agent owners and what AI accountability is. Our guide agent governance is a bound, not a model explains why roles must come with enforced limits.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where Pryme fits

Pryme ties authority to evidence and to people. The agent's depth comes from Attest results and the customer's ceiling, every held verdict names its decider, and every verdict is filed so the question "who allowed this?" has a recorded answer. The platform cannot raise an agent's depth on its own; people and evidence do.