Mappings, not promises.
For each framework: what it asks, what Ares does, what the record shows, and what remains yours. Written for the compliance lead who has to forward it.
Four mappings, one record behind them.
EU AI Act
Logging, transparency, log retention, human oversight and deployer duties, article by article. With the dating caveat.
Read the mappingCSA agent identity
The Cloud Security Alliance buyer checklist for agent identity, with an honest answer per line.
Read the mappingOWASP agentic top 10
The ten agentic risks, and which ones the badge, the door and the record address. Some are outside Ares; we say which.
Read the mappingNIST AI RMF
Govern, map, measure, manage: what the record contributes to each. Plus the Canadian directive on automated decisions.
Read the mappingHow to read a mapping
Each row has four parts.
- What the framework asks. Paraphrased, short. Read the source for the exact wording.
- What Ares does. The mechanism: the badge (an agent identity with a scoped, time-limited permission), the door that checks it, and the record of every decision.
- What the record shows. The evidence you hand an auditor, so you replay what happened instead of reconstructing it.
- What remains yours. No product makes a system compliant. Risk assessments, policies, people and the decision to deploy stay with you.
Where a feature is planned and not shipped, the row says so. Where a risk is outside what Ares does, the row says that too.
What these pages are not
This page maps Ares features to a published framework. It is not legal advice, and it does not certify compliance. Your obligations depend on your system, your role and your jurisdiction; check them with your counsel.
Take the mapping into your review.
The security pack covers the architecture, the data flows and how the record is protected, at the depth these pages leave out. We send it after a short NDA.