SprintiQ™
Agents aren't trustworthy.
They're auditable.
Writing from the practice on what it takes to deploy AI you can defend, and a working library of the standards that define the bar. The frameworks below are the ones we audit against. The essays are how we think about them.
From the practice.
Field notes on agent governance, audit methodology, and the gap between AI that works and AI that holds up under scrutiny. Essays publish as they're finished; links activate on release.
What survives an OIG inquiry, a GAO review, or an oversight letter, and what the evidence trail has to contain before one arrives.
How three established frameworks combine into a single defensible evidence record for agentic systems, and why no one of them is enough alone.
The agents making consequential determinations today will face oversight inquiries in two to three years. The governance layer that answers them has to be built first.
Unmanaged agents generate volume that looks like progress and lands as delivery debt. The closed loop is the operating discipline that decides what gets built, and by whom.
The standards we
audit against.
AI accountability is not a matter of opinion. These are the authoritative frameworks that define defensible AI deployment. Every Agent Trust Audit maps to them by name, so the evidence record speaks the language your examiner, counsel, or board already recognizes.
Risk & governance frameworks
The maturity baselineThe de facto federal reference. Four functions, Govern, Map, Measure, Manage, that our maturity scorecard maps to directly.
View frameworkNIST-AI-600-1. The companion profile that extends the RMF to generative and agentic systems, and the risks specific to them.
View profileThe first certifiable AI management system standard. The governance backbone for organizations operationalizing AI at scale.
View standardGuidance on AI risk management. The process discipline that sits underneath an ISO 42001 management system.
View standardThe framework federal auditors use to evaluate AI systems: governance, data, performance, and monitoring across the lifecycle.
View frameworkThe control catalog behind federal ATO. Where our OSCAL evidence packages land for authorization-bound engagements.
View controlsThreat modeling & security
The attack surfaceThe reference catalog of LLM-specific vulnerabilities: prompt injection, insecure output handling, excessive agency, and more.
View listThe adversarial threat landscape for AI systems. ATT&CK for machine learning: real tactics, techniques, and case studies.
View matrixThe six-dimension threat taxonomy our audit applies per node and per edge of your agent graph. Repudiation is where deployments fail first.
View methodRegulation
The legal floorThe first comprehensive AI law. Risk-tiered obligations with extraterritorial reach: if your system touches the EU, it applies.
View the ActAn ISO 42001 system mapped to NIST AI RMF is the most direct path to demonstrating EU AI Act conformity. We build the bridge.
How we map itWhere all of the above converges into one defensible artifact: STRIDE, FMEA, and NIST AI RMF in a single audit your stakeholders can act on.
See the practice