NIST Alignment
MAREF is designed around the concerns NIST has made concrete. This page maps MAREF to the real NIST programs — and states precisely what MAREF does not claim.
1. NIST AI Agent Standards Initiative
In February 2026, NIST's CAISI announced the AI Agent Standards Initiative, focused on making AI agents interoperable, secure, and trustworthy — covering agent security and safety, identity and attestation, and inter-agent interoperability. MAREF is a governance-first runtime purpose-built for these concerns.
| Initiative focus | MAREF mechanism | Evidence |
|---|---|---|
| Security & safety | Gray Code governance FSM, circuit breaker HALT, 4-level safety tree | src/formal/ · src/maref/governance/ |
| Identity & attestation | Zero-trust per-agent Ed25519 identity, time-scoped credentials | src/maref/identity/ |
| Interoperability | MCP (6 transports) + A2A v0.3 bridge + framework adapters | src/maref/mcp/ · src/maref/integration/ |
2. NIST AI Risk Management Framework 1.0
MAREF operationalizes the AI RMF 1.0 core functions at runtime, inside the agent loop:
| RMF function | MAREF implementation |
|---|---|
| GOVERN | Constitutional layer: policy engine, autonomy tiering, 4-level decision tree |
| MAP | Per-tool risk classification; threat-to-control mapping across all 10 OWASP agentic risk classes |
| MEASURE | Trust Engine v2 drift detection (KL/JS/Hellinger) + behavioral telemetry |
| MANAGE | Circuit breaker HALT, drift-triggered policy adjustment, Merkle audit chain |
Honest scope
- • MAREF is not NIST-certified and claims no NIST endorsement.
- • MAREF does not reference a "NIST AI RMF Agentic Profile" — as of 2026, no such NIST document exists; agentic work lives under the AI Agent Standards Initiative above.
- • Every mapping is claim → evidence, independently verifiable in the repository.
Repository reference: docs/compliance/nist-ai-agent-standards.md · Related: OWASP coverage · For AI Agents / LLMs