AGEI / CIAF Control Mappings
AGEI and CIAF provide implementation patterns for making AI governance controls observable, enforceable, and verifiable. These mappings illustrate how technical evidence may support internal governance, customer assurance, audit preparation, and regulatory review. They do not certify compliance or replace legal interpretation.
Illustrative technical mapping only. AGEI/CIAF can help an organization produce evidence relevant to defined controls. It does not itself determine legal applicability, establish compliance, certify a system, or prove that an AI system is safe.
Core Evidence Mappings
Last reviewed: August 2026
| Governance theme | Example AGEI / CIAF patterns | Example evidence artifacts | Reference Implementation |
|---|---|---|---|
| Risk management | Use-case classification, control tiers, versioned policy sets, gate definitions | Risk records, policy versions, gate evaluations | View governed procurement-agent example → |
| Human oversight | Delegated authority, approval thresholds, escalation, revocation, override controls | Authority grants, approval receipts, revocation events | View governed procurement-agent example → |
| Logging and traceability | Canonical receipts, policy/version links, signature metadata, lifecycle lineage | Signed receipts, evidence objects, audit packs | Inspect signed-receipt example → |
| Data governance and privacy | Processing-activity mapping, data classification, retention rules, redaction events | Data maps, retention records, redaction receipts | Inspect privacy-aware custody example → |
| Transparency and provenance | Disclosure workflow, release controls, artifact lineage, verification methods | Release records, provenance metadata, verification reports | Run audit-pack verifier → |
| Security and resilience | Tool gateway enforcement, scoped proof bundles, replay prevention, threat-model tests | Denial receipts, negative-path tests, verification findings | View proof-carrying execution example → |
| Audit and investigation | Sealed audit packs, detached verifier, custody records, legal-hold support | Audit manifests, verification reports, custody logs | Run audit-pack verifier → |
Ready to trace these mappings in code?
The AGEI examples repository provides runnable implementations that output these exact receipts, grants, and audit packs.
View the Reference Implementation