The NIST AI Risk Management Framework in Practice

TL;DR

• The NIST AI Risk Management Framework (AI RMF 1.0) provides a structured methodology to manage artificial intelligence risks across four core functions: Govern, Map, Measure, and Manage.
• Translating NIST AI RMF from policy documents into operational engineering requires runtime enforcement mechanisms, including virtual keys, content guardrails, and audit logging.
• Bifrost, an open-source AI gateway written in Go by Maxim AI, acts as the runtime control plane that enforces NIST governance policies across multi-provider LLM traffic.
• Bifrost Edge extends gateway-level governance, security policies, and endpoint enforcement to developer workstations, local coding agents, and Model Context Protocol (MCP) servers.

The NIST AI Risk Management Framework provides voluntary, non-sector-specific guidance for organizations designing, deploying, and governing artificial intelligence systems across their lifecycle. While the framework defines essential risk principles, engineering teams often face a significant gap between written policy and runtime enforcement. Bifrost, an open-source AI gateway written in Go by Maxim AI, delivers the operational infrastructure necessary to translate high-level NIST requirements into deterministic API controls, request inspection, and verifiable compliance records.

What is the NIST AI Risk Management Framework?

The NIST AI Risk Management Framework (AI RMF 1.0) is a guidance document released by the National Institute of Standards and Technology to help organizations incorporate trustworthiness considerations into AI design, development, deployment, and evaluation. It equips cross-functional teams with a shared vocabulary and operational concepts to identify, assess, and manage risks to individuals, organizations, and society.

NIST developed the framework pursuant to the National Artificial Intelligence Initiative Act of 2020. Unlike prescriptive regulatory mandates, the framework is intentionally flexible, risk-based, and technology-agnostic. It applies equally to predictive machine learning models, fine-tuned domain classifiers, and large language model (LLM) applications. In July 2024, NIST expanded this guidance by releasing NIST AI 600-1, the Generative AI Profile, which identifies twelve specific risk categories unique to generative models, including confabulation, data privacy violations, and prompt injection vulnerabilities.

Organizations adopting the framework do not treat it as a static compliance audit. Instead, they operationalize it through four continuous, iterative functions: Govern, Map, Measure, and Manage.

       +---------------------------------------------+
       |                   GOVERN                    |
       |  (Policies, Culture, Accountability, Roles) |
       +---------------------------------------------+
                              |
       +----------------------+----------------------+
       |                      |                      |
       v                      v                      v
+--------------+      +---------------+      +---------------+
|     MAP      | ---> |    MEASURE    | ---> |    MANAGE     |
| (Context &   |      |  (Testing &   |      | (Mitigation & |
| Categorize)  | <--- |   Metrics)    | <--- |   Controls)   |
+--------------+      +---------------+      +---------------+

The Govern function operates across the entire framework, setting the organizational culture, policy definitions, and accountability structures. The Map, Measure, and Manage functions execute as an active technical loop throughout the system lifecycle.

Trustworthy AI Characteristics Defined by NIST

Under the framework, managing AI risk is equivalent to building trustworthy AI systems. NIST outlines seven core characteristics that define system trustworthiness. A failure in any single characteristic introduces organizational and operational risk.

Characteristic	Definition under NIST AI RMF	Primary Operational Risk	Runtime Control Mechanism
Valid and Reliable	The system performs accurately and consistently within its specified operational parameters.	Model drift, unexpected outputs, regressions after model updates.	Routing fallbacks, semantic caching, automated regression testing.
Safe	The system operates without causing physical, psychological, financial, or societal harm.	Harmful model recommendations, toxic responses, unsafe tool execution.	Pre-execution guardrails, automated content filters, policy enforcement.
Secure and Resilient	The system withstands unexpected disruptions, cyber threats, and adversarial prompt attacks.	Direct prompt injection, indirect data poisoning, credential extraction.	Input sanitization, secrets detection, private VPC network isolation.
Accountable and Transparent	System operations, decisions, and data access points are documented and traceable.	Inability to audit decisions, unknown data provenance, compliance failure.	Immutable audit logging, request tracing, role-based access logs.
Explainable and Interpretable	System outputs and reasoning logic can be understood and contextualized by operators.	Unverifiable multi-step agent decisions, opaque tool selections.	Context recording, agent trajectory tracing, model prompt tracking.
Privacy-Enhanced	The system respects privacy rights and prevents unauthorized data dissemination.	PII extraction, sensitive customer data leakage to model providers.	Real-time PII tokenization, regex-based redaction, local egress controls.
Fair with Harmful Bias Managed	The system minimizes systematic biases that lead to prejudicial treatment.	Disparate impact on protected groups, skewed classification outputs.	Baseline evaluation suites, fine-grained prompt constraints, review boards.

Balancing these characteristics requires continuous trade-off decisions. For example, deploying aggressive filtering to ensure safety may impact model utility, while extensive telemetry to guarantee transparency must be balanced against privacy constraints.

Operationalizing the Govern Function: Policies to Infrastructure

The Govern function establishes organizational policies, legal oversight, and accountability structures. However, enterprise policies that exist solely within documentation wikis fail to mitigate production incidents. Operationalizing the Govern function requires translating written policies into programmatic access controls, budget boundaries, and cryptographic authentication.

Within an infrastructure layer, this policy translation occurs at the model interface. Rather than distributing direct provider API keys across multiple development teams, organizations route requests through centralized AI governance mechanisms.

Bifrost implements this governance through virtual keys. A virtual key serves as an abstracted, policy-governed credential issued to a specific application, service, team, or developer. Each virtual key enforces deterministic constraints before any upstream call reaches an external model provider:

• Model Authorization: Restricting the key to pre-approved model identifiers (for example, allowing access only to specific vetted foundation models and blocking unauthorized experimental models).
• Provider Restrictions: Directing traffic exclusively through compliant enterprise cloud agreements, preventing accidental routing to public consumer APIs.
• Hierarchical Budgets: Applying real-time budget and rate limits at the virtual key, team, and department levels to prevent resource exhaustion or cost overruns.
• Identity Federation: Authenticating developers and microservices using role-based access control (RBAC) integrated with enterprise identity providers such as Okta or Microsoft Entra ID.

By centralizing these controls within the Bifrost AI gateway, organizations satisfy NIST Govern subcategories (such as GOVERN 1.1 and GOVERN 1.2) through verifiable code rather than relying on developer compliance.

Implementing the Map and Measure Functions: Risk Profiling and Evaluation

The Map function categorizes the context of use, identifying system dependencies, data pipelines, and potential harm vectors before deployment. The Measure function implements quantitative and qualitative metrics to evaluate system behavior against trustworthiness criteria.

In production environments, mapping requires visibility into every active model endpoint, consumer application, and data flow. Organizations running multiple microservices frequently suffer from model sprawl, where different engineering teams integrate competing SDKs and unvetted third-party endpoints.

Routing all model interactions through a unified interface provides complete topological visibility. Bifrost supports a drop-in replacement pattern across major provider SDKs, enabling platforms to map all upstream and downstream connections without rewriting core application logic.

Once the system context is mapped, teams implement the Measure function across two operational stages:

1. Pre-Deployment Evaluation

Before an AI application reaches production, teams run structured benchmark suites to assess validity, reliability, and bias. This process includes:

• Testing system prompts against adversarial jailbreak datasets.
• Measuring accuracy across specialized test cases using automated model evaluators.
• Simulating edge-case user interactions to evaluate agent tool invocation safety.

2. Runtime Telemetry and Monitoring

Evaluation must persist in live environments to detect model drift, latency anomalies, and unexpected output variations. Bifrost captures granular metrics on request rates, latency percentiles, error distribution, and token usage, streaming this telemetry natively into Prometheus metrics and OpenTelemetry (OTLP) collectors.

Teams cross-reference these runtime observations against pre-established risk thresholds. If error rates or anomalous token patterns exceed defined parameters, the system triggers alerts, fulfilling the continuous monitoring outcomes specified in NIST MEASURE 2.7.

Enforcing the Manage Function: Runtime Guardrails and Incident Response

The Manage function addresses risk treatment, incident response, and runtime mitigation. When a risk exceeds the organization's defined risk tolerance, the system must alter its behavior immediately to prevent harm.

Runtime guardrails serve as the primary operational enforcement mechanism for the Manage function. They inspect incoming prompts and outgoing completions inline, applying deterministic policies before data enters or exits a model pipeline.

Bifrost provides enterprise guardrails directly on the request path, adding only 11 microseconds of processing overhead at 5,000 requests per second in sustained benchmarks. These controls include:

• Secrets Detection: Utilizing automated scanners to identify and redact API keys, access tokens, and credentials before prompts leave the private network, as supported by Bifrost's secrets detection module.
• PII and Sensitive Data Redaction: Intercepting personally identifiable information via custom regex rules, preventing privacy violations under NIST Safe and Privacy-Enhanced criteria.
• Prompt Injection Defense: Integrating with external content safety filters (such as AWS Bedrock Guardrails, Azure Content Safety, and Patronus AI) to reject adversarial jailbreak payloads.
• Failover and Circuit Breaking: Managing availability risks by configuring provider routing rules and automatic fallbacks. If an upstream provider returns 5xx status codes or encounters severe latency spikes, Bifrost immediately diverts traffic to alternative models or standby infrastructure without application disruption.

The following configuration snippet illustrates how an organization can enforce runtime guardrails, data boundaries, and fallback routing at the gateway level:

# bifrost-governance-config.yaml
virtual_keys:
  - id: "vk-customer-support"
    name: "Customer Support Production Key"
    team: "customer-operations"
    rate_limits:
      requests_per_minute: 600
      tokens_per_minute: 500000
    budget:
      monthly_limit_usd: 2500
      action_on_exceed: "reject"
    allowed_models:
      - "anthropic/claude-3-5-sonnet"
      - "openai/gpt-4o"
    routing:
      primary: "anthropic/claude-3-5-sonnet"
      fallbacks:
        - "openai/gpt-4o"
    guardrails:
      secrets_detection:
        enabled: true
        action: "block"
      pii_redaction:
        enabled: true
        patterns: ["ssn", "credit_card", "email"]
        action: "mask"
      external_safety_provider:
        provider: "azure_content_safety"
        threshold: "medium"

To satisfy the accountability requirements of NIST MANAGE 4.1, all governance decisions, blocked payloads, and policy overrides generate structured audit logs. These tamper-resistant audit trails capture the calling virtual key, the applied policy, the provider destination, and execution timestamps, providing verifiable records for SOC 2, ISO 42001, and regulatory reviews.

Extending Governance to Developer Workstations with Bifrost Edge

A common vulnerability in enterprise AI risk management is the boundary between server-side production systems and unmonitored employee workstations. Security policies enforced on production backend servers do not capture developer activity within local desktop applications, CLI agents, or custom development environments.

Employees routinely install native AI chat clients, browser-based productivity extensions, and local coding tools like Cursor, Claude Code, and Codex CLI. Furthermore, modern agentic tools interface directly with external Model Context Protocol (MCP) servers, granting local AI processes the authority to execute bash commands, query corporate databases, and read local file systems. When these requests bypass the central gateway, organizations face severe "shadow AI" risks, exposing intellectual property and proprietary code to public models without audit logging or risk inspection.

Beyond routing server-side API traffic, Bifrost enforces centralized governance and security controls across production systems, and Bifrost Edge extends those same governance and security controls directly to AI traffic on employee machines, with endpoint enforcement on each device.

Currently in alpha, Bifrost Edge runs natively in the background on macOS, Windows, and Linux, operating as the endpoint extension of the central AI gateway. Rather than requiring users to manually update base URLs within individual configuration files, Bifrost Edge automatically routes local AI interactions through the enterprise gateway control plane.

Through this combined architecture, Bifrost Edge provides critical capabilities that satisfy NIST Govern and Manage requirements across distributed developer endpoints:

• Fleet-Wide AI App Governance: Central administrators manage which AI applications are authorized for organizational use through app governance controls. Disallowed tools are blocked at the device level before network transmission occurs.
• MCP Server Discovery and Authorization: Local coding tools frequently discover and connect to unvetted MCP servers. Bifrost Edge discovers active MCP connections across developer machines, giving security teams complete visibility into tool usage and enforcing MCP governance policies to block unapproved tool execution.
• Consistent Policy Enforcement: All prompts generated by desktop applications, browser tools, and IDE coding agents pass through the same gateway guardrails and secrets detection rules configured for production systems.
• Automated Fleet Deployment: System administrators deploy Bifrost Edge fleet-wide using enterprise mobile device management (MDM) platforms, including Jamf, Microsoft Intune, and Kandji, ensuring zero-configuration onboarding and immediate compliance.

By pairing centralized gateway routing with endpoint visibility, organizations eliminate the blind spots that typically undermine risk management frameworks.

NIST AI RMF Implementation Architecture: Framework to Infrastructure

Achieving verifiable alignment with NIST AI RMF requires mapping each theoretical outcome to an explicit technical control and an audit-ready artifact.

NIST AI RMF Function	Subcategory Focus	Runtime Technical Control	Verification Artifact
GOVERN	GOVERN 1.1, 1.2 Policies, roles, and risk tolerances established.	Virtual key provisioning, enterprise RBAC, and identity provider synchronization via Okta or Entra ID.	Access control matrices, virtual key configuration manifests, change audit logs.
GOVERN	GOVERN 6.1 Third-party AI risk management.	Centralized provider routing, in-VPC deployments, and model authorization white-lists.	Approved vendor lists, data processing addenda, network egress rules.
MAP	MAP 1.5, 2.1 System categorization and dependency mapping.	Universal proxy integration across client SDKs, full endpoint cataloging, and Bifrost Edge tool discovery.	Live service dependency maps, MCP server inventories, model catalogs.
MEASURE	MEASURE 2.7 System monitoring and metric evaluation.	Real-time telemetry extraction, Prometheus metrics, and distributed OTLP tracing.	Real-time monitoring dashboards, latency percentiles, error rate baselines.
MANAGE	MANAGE 2.2, 2.4 Risk mitigation and control application.	Content guardrails, secrets detection, and automated PII masking on request payloads.	Blocked request logs, redaction event metrics, incident response reports.
MANAGE	MANAGE 4.1 Incident handling and transparent accountability.	Automated provider failovers, circuit breaking, and immutable audit logs.	Tamper-evident transaction logs, SOC 2 compliance reports, uptime telemetry.

By establishing this architecture, enterprise engineering teams replace subjective compliance assertions with deterministic, observable infrastructure.

Frequently Asked Questions

What is the NIST AI Risk Management Framework?

The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary set of guidelines developed by the National Institute of Standards and Technology to help organizations improve the trustworthiness of AI systems. It provides structured guidance across four core functions: Govern, Map, Measure, and Manage, addressing risks such as security vulnerabilities, bias, safety hazards, and privacy violations throughout the AI lifecycle.

What are the four core functions of the NIST AI RMF?

The four core functions are Govern, Map, Measure, and Manage. Govern is an overarching organizational function that establishes risk culture, policies, and accountability. Map identifies the operational context, dependencies, and potential harms of AI systems. Measure develops quantitative and qualitative metrics to evaluate system behavior. Manage applies active mitigation controls, runtime guardrails, and incident response procedures.

Is NIST AI RMF certification mandatory for enterprises?

NIST AI RMF is not a mandatory legal standard, and NIST does not issue formal compliance certifications. However, federal agencies, defense organizations, and enterprise risk committees increasingly require vendors to demonstrate alignment with the framework. Furthermore, emerging regulatory regimes and international standards, including ISO/IEC 42001, borrow heavily from the NIST AI RMF core principles.

How does NIST AI RMF differ from ISO/IEC 42001?

NIST AI RMF is a voluntary, non-certifiable guidance framework that offers detailed technical suggestions and risk profiles. In contrast, ISO/IEC 42001 is an internationally accredited management system standard against which organizations can be formally audited and certified by independent third-party registrars. Many organizations implement NIST AI RMF controls as the technical foundation to achieve ISO/IEC 42001 certification.

What is the NIST AI 600-1 Generative AI Profile?

NIST AI 600-1 is a cross-sectoral companion profile to AI RMF 1.0, published in July 2024 to address risks specific to generative AI and foundation models. It defines more than 200 actionable suggestions to mitigate twelve distinct generative risks, including hallucination, confabulation, intellectual property theft, sensitive data leakage, harmful content generation, and automated prompt injection attacks.

How do engineering teams enforce NIST AI RMF controls in production?

Engineering teams enforce NIST AI RMF in production by placing an AI gateway on the data plane between applications and model providers. Gateways enforce governance policies programmatically through virtual keys, role-based access control, hierarchical spending limits, inline content guardrails, and cryptographic audit logs, ensuring that written policies are applied deterministically to every API request.

Getting Started with Practical AI Risk Management

Implementing the NIST AI Risk Management Framework successfully requires moving beyond abstract risk assessments and deploying automated controls directly into your application architecture. By centralizing request routing, authentication, and content inspection within a unified gateway, platform teams can enforce strict governance without hindering developer velocity.

Organizations seeking to establish a resilient AI risk posture can review the LLM Gateway Buyer's Guide to evaluate infrastructure requirements, examine the Bifrost open-source repository for local deployment options, or request a Bifrost demo to explore enterprise clustering, governance, and endpoint security controls.

Sources

• NIST AI 100-1: Artificial Intelligence Risk Management Framework (AI RMF 1.0)
• NIST AI 600-1: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
• NIST Trustworthy and Responsible AI Resource Center (AIRC)
• ISO/IEC 42001:2023 Information Technology — Artificial Intelligence — Management System