Built to Federal Standards.
Aligned to What’s Coming.

The NIST AI RMF establishes a voluntary framework for managing risks throughout the AI lifecycle, covering governance, mapping, measurement, and management of AI risk across four core functions: GOVERN, MAP, MEASURE, and MANAGE.

GRACE’s enforcement kernel operationalizes the AI RMF’s core functions at the system level, embedding risk controls directly into the agentic AI execution pipeline rather than treating compliance as a documentation exercise performed after deployment. Pre-execution validation (GOVERN / MANAGE), state capture via SHADOW (MEASURE), and cryptographically sealed Policy Action Packets (GOVERN) are all direct expressions of the RMF architecture, implemented at runtime.

In January 2026, NIST’s Center for AI Standards and Innovation (CAISI) launched the AI Agent Standards Initiative and issued a Request for Information on secure development and deployment of agentic systems — directly addressing the category of AI that GRACE governs.

GRACE’s architecture directly addresses the core concerns this initiative is designed to standardize: pre-execution intent validation, behavioral boundary enforcement, identity and authorization controls for autonomous agents, and auditable execution records at the individual action level. GRACE is positioned to align with formal NIST agentic AI standards as they are finalized, and the architecture was designed from the outset to accommodate that alignment without requiring material changes to the enforcement kernel.

GRACE uses ML-DSA-65, standardized under FIPS 204, for cryptographic signing of all execution logs. This post-quantum digital signature standard — finalized by NIST in August 2024 — ensures that GRACE’s audit trail remains cryptographically verifiable against adversaries operating with quantum computing capability.

Every Policy Action Packet produced by GRACE is signed with ML-DSA-65 at the moment of the enforcement decision. The signature is tamper-evident: any modification to the record after sealing invalidates the signature and is immediately detectable. The institution owns these records. The vendor does not.

For financial institutions subject to heightened national security cybersecurity scrutiny, post-quantum signing is not a future consideration. It is a present requirement that GRACE already meets.

Interagency supervisory guidance on model risk management (SR 11-7 / OCC 2011-12) remains the operative standard for how regulated financial institutions govern AI and algorithmic systems. Published in 2011, it has not been formally superseded for traditional model categories despite fifteen years of AI evolution.

SR 26-2, issued jointly by the Federal Reserve, OCC, and FDIC in April 2026, supersedes SR 11-7 for many model categories — but explicitly excludes generative and agentic AI from its scope in Footnote 3. The result is that the most consequential category of AI now operating inside regulated financial institutions exists outside the coverage of both the original guidance and its successor.

GRACE’s MRM continuity layer addresses this directly. It extends SR 11-7 and SR 26-2 model risk obligations to cover agentic systems, providing the validation documentation, performance monitoring architecture, and examiner-ready audit records that supervisory expectations require — for the category of AI that no existing guidance was written to reach.

The bipartisan Senate AI Policy Roadmap, produced by the Senate AI Working Group in May 2024, directed relevant committees to conduct a regulatory gap analysis in the financial sector and develop legislation ensuring financial service providers govern AI properly.

GRACE’s development was informed by the same gap the Roadmap identified — the absence of enforcement-layer infrastructure for agentic AI in regulated environments. GRACE is the practical answer to the gap that bipartisan Senate direction called for addressing: a pre-execution enforcement architecture that operates within existing regulatory frameworks, produces examiner-ready documentation, and does not require new legislation to deploy.