FedRAMP-Ready AI Agents: What Governance Controls Actually Look Like
FedRAMP-Ready AI Agents: What Governance Controls Actually Look Like
Category: Government & Regulated Industries | Reading time: 6 min
The FedRAMP Problem with AI
Federal agencies are under pressure to modernise with AI. OMB Memorandum M-24-10 directs agencies to designate AI safety officers, establish governance frameworks, and ensure responsible AI deployment. Executive Order 14110 sets requirements for AI safety, security, and trustworthiness in federal contexts.
But FedRAMP — the Federal Risk and Authorization Management Program that governs cloud service adoption in the federal government — was designed for conventional software systems. Its control families (access control, audit and accountability, configuration management, incident response) were written with static applications in mind.
AI agents are not static. They make dynamic decisions, act on behalf of users, chain through multiple systems, and produce outputs that can't be fully predicted at design time. Applying FedRAMP controls to AI agents requires understanding which controls are directly applicable, which need adaptation, and which new controls AI uniquely requires.
Mapping FedRAMP Controls to AI Governance
AC-2 / AC-3: Account Management and Access Enforcement
Traditional interpretation: manage user accounts and enforce access control policies.
AI adaptation: AI agents act on behalf of users. The OBO chain in Taos is the technical implementation of AC-2/AC-3 for agent actions — every AI action is attributed to an authorised human principal through a verifiable delegation record. The Rego policy controls what tools the agent can invoke (allowed_tools in the ART token), enforcing access control at the action level.
AU-2 / AU-3: Audit Events and Audit Record Content
Traditional interpretation: log system events with sufficient detail.
AI adaptation: The Taos audit log provides hash-chained, tamper-evident records of every workflow step, policy evaluation, approval decision, and compensation action. The rule_fired field identifies which specific policy rule governed each decision — meeting AU-3's requirement for "what type of event occurred" at a granularity beyond what traditional logging provides.
AU-9: Protection of Audit Information
Traditional interpretation: protect audit records from unauthorised access and modification.
AI adaptation: Hash-chaining means modification of any audit record breaks all subsequent hash links — making tampering immediately detectable without requiring separate integrity monitoring. This is a stronger implementation of AU-9 than write-once storage alone.
CM-3: Configuration Change Control
Traditional interpretation: control and document changes to system configuration.
AI adaptation: Policy changes in Taos are versioned, attributed, and require published through the control plane. Every policy bundle version is immutable — publishing a new version doesn't overwrite the old one. This provides the change documentation CM-3 requires, extended to cover the AI's behavioural parameters.
SA-11 / SA-15: Developer Security Testing and Development Process
AI adaptation: The Rego policy test suite provides automated validation that policy rules behave as intended. The simulate_erp_failure test parameter validates that compensation works correctly. These are the AI-specific equivalents of security testing requirements.
The Novel Controls AI Requires
FedRAMP's existing control families don't cover everything AI governance requires. Three control areas are unique to agentic AI:
Scope Bounding (no FedRAMP analogue)
AI agents must have explicitly bounded capabilities — a defined list of what they can and cannot do. Taos implements this via the ART token's allowed_tools field: a whitelist of permitted tool invocations. The agent cannot invoke a tool not on the list, regardless of LLM instructions.
For federal deployments, this list should be documented, approved through the ATO process, and auditable. Any change to the allowed tools list requires a change in the ATO documentation.
Delegation Accountability (partial AU coverage) When an AI acts on behalf of a human, the chain of delegation must be cryptographically verifiable. The OBO chain provides this, but it needs to be surfaced specifically in the ATO documentation as a novel accountability mechanism.
Policy Immutability (extends CM-3) AI policy changes must be subject to the same change control process as application code. The Taos versioned policy bundle system provides the technical mechanism; the agency's configuration management policy must cover it explicitly.
The FedRAMP Documentation Package
A FedRAMP-ready AI deployment using Taos would include the following in its System Security Plan (SSP):
Section 9 — System and Services Acquisition: Description of the Taos governance kernel as a security control boundary, including the Rego policy evaluation mechanism and its role in implementing access controls.
Section 10 — System and Communications Protection: Description of the OBO chain mechanism, including how delegation is recorded and how the chain signature prevents tampering.
Section 11 — Audit and Accountability: Detailed description of the hash-chained audit log: what events are recorded, what fields are included, how tampering is detected, and how records are exported for government agency review.
New Appendix — AI-Specific Controls: Documentation of scope bounding (allowed_tools), policy versioning, live policy reload procedures, and the authority process for policy changes.
Continuous Monitoring for AI Systems
FedRAMP's ConMon (Continuous Monitoring) requirements take on new dimensions for AI systems:
Policy drift monitoring: If the AI's policy is changed without going through the proper CM process, the Taos audit log will show a policy version change. Continuous monitoring should include alerts on unexpected policy version changes.
Anomaly detection in agent behaviour: The audit log provides a complete record of AI actions. Anomaly detection can flag unusual patterns — a spike in policy denials, an unusual distribution of approval tier hits, actions outside normal operating hours.
OBO chain integrity verification: Regular verification that the hash chain is intact confirms that no audit records have been modified. This can be automated as a daily check.
The Authorisation Timeline
For a federal agency pursuing an ATO for an AI system governed by Taos:
- 3AC (Assess and Authorise): The governance controls (policy engine, audit log, OBO chain) are concrete technical implementations that map clearly to FedRAMP control families. The assessment documentation task is manageable.
- ConMon: The audit log provides the continuous monitoring data stream needed for ongoing compliance evidence.
- Annual Review: Policy version history and audit exports provide the evidence package for annual security reviews.
The Bottom Line
FedRAMP compliance for AI agents is achievable — but it requires AI-specific governance controls that go beyond what OPA at the gateway or application-level logging provides. The Taos governance kernel implements the technical controls that FedRAMP requires and the AI-specific controls that FedRAMP doesn't yet explicitly require but will.
Build for FedRAMP compliance now. The regulatory frameworks for AI in government are evolving rapidly — an AI system with strong governance is better positioned for whatever requirements emerge.
Tags: FedRAMP, government AI, AI compliance, federal AI governance, audit trail, policy-as-code, ATO