TL;DR — Key Takeaways
- Red Hat has launched asago, an open source project designed to automate how AI governance policies are translated into operational controls.
- The framework interprets corporate and regulatory policies, maps them to established AI risk frameworks and creates actionable risk profiles.
- It generates use-case-specific safety tests that probe AI applications and agents for harmful or non-compliant behavior.
- Based on test results, asago can recommend guardrails and mitigations while maintaining logs and distributed traces for auditing.
- Recommended controls can be applied declaratively as code through orchestration and automation platforms.
- The broader goal is to create a common standard for governing AI systems at machine speed without slowing innovation.
Red Hat this week launched an open source initiative that promises to automate how governance policies are applied in the artificial intelligence (AI) era.
Stuart Battersby, AI safety and model evaluation architect for Red Hat, said the goal for the AI Safety and Governance Orchestration project, otherwise known as asago, is to create a community around an open source orchestration engine and control plane that makes it simpler to safely deploy AI applications and agents.
Specifically, Red Hat is looking to form a community around an open source platform based on an Apache 2.0 license that translates complex corporate and regulatory AI governance policies into operational controls. At the core of that effort is a framework that automatically reads and interprets uploaded AI governance policies that are mapped directly to established AI Risk frameworks, ontologies and standards to turn policy language into actionable risk profiles.
Additionally, the framework generates and executes use-case-specific scenarios for automated safety testing that is tailored to identified risks, probing for harmful behaviors rather than relying solely on generic benchmarks that are often too broad to meet more granular organizational requirements, noted Battersby.
The framework will then recommend mitigations, including safety guardrails based on testing, to provide a clear audit trail that can be easily reviewed using log evidence and distributed trace capabilities to demonstrate compliance.
Finally, the framework will create configurations of recommended controls that can be declaratively applied as code via an orchestration engine or automation platform rather than requiring DevSecOps teams to create and maintain custom scripts. That approach will make it possible to integrate best-in-class open tools with the framework, noted Battersby.
Initial participants in the project include Brave Software, EvalEval coalition, IBM Research, Interdisciplinary Transformation University Austria, Microsoft, MIT Lincoln Laboratory, North Carolina State University, NVIDIA and The Alan Turing Institute. The project itself is an offshoot of the Open Secure AI Alliance that Red Hat and NVIDIA have previously supported.
The overall goal is to create a standard that translates abstract policy guidelines into functional software configurations that enable controls to be applied without slowing down the pace of AI innovation, said Battersby.
It’s not clear how much momentum there is behind the asago project, but some level of standardization for governing AI at machine speed will be needed. This initiative will make it possible for organizations to essentially observe the behavior of an AI agent and apply the appropriate controls in near real time, noted Battersby. In effect, Red Hat and other supporters of the project are making a case for a more holistic approach to AI governance that will prove to be accessible to a wide range of organizations, he added.
Managing compliance as code has, of course, been historically challenging for compliance teams. Each compliance mandate has its own unique requirements and few governance teams have the ability to turn those controls into code that they can support. On the flip side, however, many compliance mandates have similar controls that could be centrally managed via an orchestration framework. The challenge, as always, is making it as simple as possible to achieve that goal in a way that doesn’t require a massive amount of coding expertise.
