NIST AI RMF

The framework gives a team a common language for AI risk before any regulator supplies one. Four functions organize the work, and the generative profile adds concerns that appear only with language models. This starter makes two of those functions concrete for live traffic.

Voluntary adoption is the usual reason people reach for this material. A board asks for a method, and an engineering group needs something it can configure this quarter. Measurement and management are the parts that a gateway carries well.

Measurement lives on the response path. Source grounding is checked against a confidence floor of 0.85, and a thin citation is flagged while the answer still returns. Combined quality must reach 0.85, with relevance and accuracy at 0.80. A reply shorter than 120 characters or a single sentence fails.

The request path stays light. Injection screening runs, identity is verified, and national identifier and biometric references are masked before the model is called. No broad block list ships here, which keeps the starter usable across many cases.

Governance shows up as a hard stop. No response returns to the caller, and each one is recorded as an escalation for a named person to decide. Risk classification, model approval and policy exceptions are the decisions that group must be ready for, and everyday traffic joins the same queue.

The generative profile adds worries such as fabricated content and unclear data provenance. Grounding measurement helps with one of them. Impact assessment, incident handling and third party evaluation remain your program work.