FedRAMP High

A high impact federal workload accepts almost no margin for error. Severe harm would follow a loss of confidentiality or availability there, and the control baseline reflects that. This starter places AI traffic inside the baseline and supplies evidence inputs, and it produces no authorization.

Program teams reach for this starter when an assistant enters an authorized boundary and an assessor asks what governs it. The answer has to be specific, and it has to hold on the day of the review.

Access is the first real gate. The identity check rejects any call that lacks verified user and organization claims plus a personal identity verification header. Redaction masks case numbers, docket numbers, tax identification numbers and freedom of information request numbers. A separate list refuses any prompt carrying controlled unclassified markings or law enforcement sensitive material.

Tool use is deliberately narrow. Only document search and regulation lookup are permitted, and shell access, network scanning and external file upload are denied. A session may take three tool actions, which keeps an agent from working through a long chain unattended.

Returned text must reach a combined score of 0.85 and an accuracy score of 0.85, or it is blocked. After that gate, no response is delivered to the caller at all. Each one becomes a recorded escalation for a person to answer, whether it concerns a policy decision or a routine lookup.

Media protection, physical security and the assessment process stay outside this starter. A sponsoring agency, an independent assessment and a package review produce an authorization. No configuration shortens that path.