NIST AI RMF: what the record contributes.
The framework has four functions. Ares does not run your risk program; it produces the evidence that program needs. Plus the Canadian directive on automated decisions.
Four functions, one record.
Functions are paraphrased. Read the framework for the full text.
| What the function asks | What the record contributes | What remains yours | |
|---|---|---|---|
| Govern | A culture, policies and accountability for AI risk across the organisation. | Policies take effect as badges and filters, not documents. Every agent is tied to an owning group in your directory; a named owner per agent is planned. | Policies, roles, risk tolerance and the people accountable. |
| Map | Understand the context: what each system does, for whom, and what could go wrong. | The record shows which agents actually talk to which, for whom, and with what permission. A map from evidence, not from a diagram. | Use cases, impact on people, and the risks you choose to accept. |
| Measure | Track and assess risks with evidence over time. | Every refusal, redaction and human review is counted on the record, with its reason. Trends come from decisions, not samples. | Metrics for accuracy, bias and model quality, which Ares does not measure. |
| Manage | Act on risks: prioritise, respond, recover. | Narrow a badge, add a filter or revoke an agent, and it takes effect at the door. The change is on the record too. | Incident response, communication and the decision to retire a system. |
Paraphrased from the NIST AI Risk Management Framework 1.0. Not legal advice.
Treasury Board Directive on Automated Decision-Making.
For federal institutions using automated systems in decisions about people. Requirements scale with the impact level from the assessment.
| What the directive asks | What Ares contributes | What remains yours | |
|---|---|---|---|
| Impact assessment | Complete an algorithmic impact assessment before production, and update it when the system changes. | The record shows what the system really does: which agents, which data, which decisions. Useful input to the assessment and its updates. | The assessment itself and its sign-off. |
| Records of decisions | Document automated decisions so they can be explained, reviewed and audited. | Every decision is on the record with its reason, the badge it ran under and the time. Retention is set by you, in your building if needed. | The explanation given to the person affected. |
| Human intervention | At higher impact levels, a person must take part before the final decision. | Steps over a limit wait for a person. Who decided, what, and when is on the record. | Setting which decisions need a person, and staffing it. |
Paraphrased from the Treasury Board of Canada Secretariat directive. Check the current version for your institution. Not legal advice.
On sovereign sites
Public-sector teams can run Ares in their own building, disconnected if needed, on one small machine at 20–25 W. The record stays on site. See for the public sector.
Take the mapping into your assessment.
The security pack covers the architecture, the data flows and how the record is protected, at the depth these pages leave out. We send it after a short NDA.