NIST AI RMF

Four functions

The RMF organizes controls into four functions. Chio contributes to each one differently. At a glance:

Chio's strongest contribution is to Map and Manage: capabilities, guards, receipts, and revocation are the tool-layer implementation of context identification, control cataloging, and risk response. Govern subcategories are largely organizational; Chio contributes where policy-as-code and workload identity touch organizational artifacts. Measure is partially covered: Chio emits the raw data but leaves risk scoring to the operator's analytics stack.

Coverage Legend

Function: GOVERN

Govern is primarily organizational. Chio aligns with the subcategories that describe signed policies, risk tolerance encoded as configuration, and lifecycle mechanics like decommissioning.

The time bounds GOVERN-1.1 rests on are the signing body of the capability token itself, so a token that outlives its window fails verification rather than merely reading as stale:

pub struct CapabilityTokenBody {
    pub id: String,
    pub issuer: PublicKey,
    pub subject: PublicKey,
    pub scope: ChioScope,
    pub issued_at: u64,
    pub expires_at: u64,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub delegation_chain: Vec<DelegationLink>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aggregate_invocation_budget: Option<AggregateInvocationBudget>,
}

Function: MAP

Map uses signed receipts, tool manifests, and capabilities with typed constraints. These records give the organization the context needed to review a tool call later.

Function: MEASURE

Measure asks for quantitative tracking of risks, mitigations, and outcomes. Chio emits the raw data: every invocation, every denial, every guard trigger, every cost event is a signed, queryable record. Scoring itself is left to the operator, because scoring requires taxonomy choices that are organization-specific.

Function: MANAGE

Manage covers prioritization, treatment, and post-deployment response. Chio's capability-plus-revocation model is precisely the primitive the Manage function needs at the tool boundary. The prioritization rows draw on chio-underwriting (crates/economy/chio-underwriting/src/lib.rs), which sorts an agent into one of four risk tiers: Baseline, Guarded, Elevated, and Critical, from its receipt, reputation, certification, and settlement evidence, and pairs each tier with typed reason codes.

Evidence Collection Example

A common review question is: "show me the evidence that covers MAP-2.1 and MANAGE-2.2 for the past quarter." Chio gives that as a queryable bundle. A local receipt read carries an explicit boundary: the command refuses rather than defaulting to every tenant.

$ chio --receipt-db ./receipts.db receipt list --outcome deny

error [urn:chio:error:cli:other]: --tenant <id> or --admin-all is required for local receipt reads
context: {"domain":"cli","severity":"error","stability":"deprecated","string_code":"CHIO-CLI-OTHER"}
suggested fix: Preserve the original message and migrate the call site to a specific registry code when touched.

With a boundary, the same read surfaces every denial in the window (MANAGE-2.2) as one JSON object per line. The count is two here, a guard refusal and an out-of-scope tool; a revoked or expired capability lands in the same file, because it fails closed as a signed deny receipt too. --outcome takes allow, deny, cancelled, or incomplete, and --since and --until take Unix seconds:

$ chio --receipt-db ./receipts.db receipt list --outcome deny --admin-all \
    > q1-denials.jsonl
$ wc -l < q1-denials.jsonl

2

Assembling the auditor-facing package (MAP-2.1 and MANAGE-2.2) is one command, and --require-proofs makes it fail rather than ship a package whose receipts are not yet covered by a checkpoint. On a store with no checkpoint, that is exactly what happens, and the refusal names the uncovered receipts:

$ chio --receipt-db ./receipts.db evidence export \
    --policy-file ./policy.yaml --admin-all --require-proofs \
    --output ./rmf-evidence-proofs

error [urn:chio:error:attest:provenance-missing]: evidence export requires checkpoint coverage, but 3 receipt(s) are uncheckpointed: 1bf1899605687b63a64d598e1b5fbad0e329ec304a13fdd128eb4dd03672d5d8@1, 6696bb2340f2f205f87ce289c18292cd64b9efe45ff5f1f3258035c85fd6a216@2, 87af412413cfd8f580b26c7db75bac4c4a155619859ac9ae98d6c5615f1becaf@3
context: {"domain":"attest","severity":"error","stability":"unstable","string_code":"CHIO-ATTEST-PROVENANCE-MISSING"}
suggested fix: Regenerate the evidence bundle and include provenance before submitting the operation.

Dropping the proof requirement exports the same window and records the gap in the manifest instead of refusing. The package carries the receipts and child receipts for the window, the capability lineage they reference, the covering Merkle checkpoints, per-receipt inclusion proofs, and the attached policy:

$ chio --receipt-db ./receipts.db evidence export \
    --policy-file ./policy.yaml --admin-all --output ./rmf-evidence
$ chio evidence verify --input ./rmf-evidence

evidence package verified
tool_receipts:          3
child_receipts:         0
checkpoints:            0
checkpoint_publications: 0
checkpoint_witnesses:   0
checkpoint_consistency_proofs: 0
checkpoint_equivocations: 0
capability_lineage:     3
inclusion_proofs:       0
uncheckpointed_receipts: 3
authorized_receipts:     1
trace_observations:      0
advisory_evaluations:    0
verified_files:         14
child_receipt_scope:    FullQueryWindow
transparency_preview_logs: 0
publication_state:      transparency_preview

An auditor verifies the package offline with chio evidence verify --input, as above, and pulls inclusion proofs for any subset of interest without runtime access to the live kernel. Tool definitions themselves live in signed ToolManifest documents, verified when a tool server is registered; they are not part of the evidence package.

Gaps and Non-Goals

• Risk scoring: Chio emits the raw data for MEASURE, but scoring is operator-owned.
• Residual-risk register: MANAGE-1.4 requires tracking residual risk. Chio does not model residual risk explicitly; operators build that register from receipt aggregates.
• Fairness, bias, environmental impact: MEASURE-2.9 through MEASURE-2.12 concern model-layer properties that a tool-governance layer cannot observe.
• Workforce-related Govern subcategories: roles, training, leadership commitment, and stakeholder culture are organizational and not implementable in code.

Cross-References

• Capabilities for the scoping model referenced in Map and Manage.
• Receipts for the evidence record format used by Measure.
• Guards for the named controls that implement Map-4.2.
• EU AI Act for the parallel mapping against Article 19 logging.