NIST AI RMF and behavioral records for AI agents

The NIST AI Risk Management Framework (AI RMF 1.0) is the United States’ voluntary framework for managing AI risk. Two of its four functions — Measure and Manage — ask organizations to monitor how an AI system behaves in production and to track incidents when they happen. This page covers what those functions ask for and how verifiable execution receipts serve them for AI agents.

This is an engineering explainer, not a conformance determination. The AI RMF is voluntary guidance, not a regulation. Subcategory references are to NIST AI RMF 1.0.

What the AI RMF asks for

The AI RMF Core organizes practice into four functions — Govern, Map, Measure, and Manage. Govern establishes accountability: under Govern 2.1, roles and responsibilities for managing AI risk are documented and clear. The operational demand for behavioral records shows up in the last two functions:

• Measure 2.4 — the functionality and behavior of the AI system and its components are monitored when in production.
• Manage 4.1 — post-deployment monitoring plans are in place, including mechanisms for capturing and evaluating input and for incident response and change management.
• Manage 4.3 — incidents and errors are tracked, responded to, and documented through a followed process.

For an AI agent that calls tools, moves money, or reads records on a user’s behalf, satisfying these means being able to answer, after the fact: what did the agent actually do, under what authority, and can that account be trusted when an incident is under review?

Where ordinary logging falls short

Monitoring and incident tracking usually rest on ordinary application logs. The gap is trust: a log in the operator’s own database is editable and deletable by the operator. When Manage 4.3 calls for incidents to be tracked and documented, a record that the responsible party can quietly rewrite is weak evidence — the exact moment you most need an unaltered account (an incident review) is the moment an editable log is least trustworthy.

How verifiable receipts map to the framework

A signed execution receipt turns monitoring output into evidence anyone can check. The bilateral receipt pattern — normative guidance in the OWASP Agentic Skills Top 10 (AST09) — emits two signed records per action:

• Admission receipt: the agent, the intended action, the authorized scope, and the policy in effect — the accountability Govern is after.
• Outcome receipt: what actually happened, linked to the admission by a content-derived hash (action_ref).

Both are canonicalized with JCS (RFC 8785), signed with Ed25519, and hash-chained. Mapped to the functions:

• Measure 2.4 (monitor behavior in production): each action emits a signed record of what the agent did — behavioral monitoring that is itself tamper-evident.
• Manage 4.1 / 4.3 (post-deployment monitoring and incident tracking): during an incident review, the receipt chain is an unalterable timeline — editing a record breaks its signature, deleting one leaves a gap.
• Independently verifiable: an auditor or a customer checks a receipt offline with just the receipt and a public key — the account does not depend on trusting the operator.

What this looks like in code

Instrumenting an agent action to emit AI-RMF-friendly records is one decorator:

from nobulex import track

@track(agent_id="billing-bot")
def charge(invoice_id: str, amount_cents: int):
    ...  # your existing code, unchanged

Verification is offline — no callback to the operator, the platform, or Nobulex:

from nobulex.agent import Agent

agent = Agent("billing-bot")
receipt = agent.act("charge", scope="invoice:042")
assert receipt.verify()  # recomputes action_ref, checks the signature, offline

One implementation, three frameworks

The AI RMF is voluntary, but the behavioral records it calls for are the same ones a regulation and a certifiable management system require. The identical receipts map onto the EU AI Act, Article 12 (automatic logs for post-hoc traceability) and ISO/IEC 42001, A.6.2.8 (event-log record-keeping) — so instrumenting once serves a US risk framework, an EU regulation, and an ISO management system at the same time. The AI RMF does not require cryptography; it asks for monitoring and incident records reliable enough to act on, and signed receipts are the strongest form of that evidence.

Getting started

pip install nobulex
# or
npm install @nobulex/core

Nobulex is the open-source (MIT) reference implementation of the bilateral receipt pattern. For the AST09 background, see OWASP AST09 execution receipts; for a step-by-step build, the verifiable audit trail guide; for where this sits in the market, the accountability landscape.

Get started Star