enterprise resource · crosswalk
A mapping between NIST AI RMF 1.0 functions (Govern, Map, Measure, Manage) and the artifacts Vibefixing produces today. Intended for security questionnaires and conversations between your compliance team and the engineers integrating the supervisor.
scope of this document
This crosswalk maps Vibefixing artifacts to NIST AI RMF sub-categories. It is not a certification. It does not constitute legal advice. Vibefixing does not hold a SOC 2 Type II report on the supervisor itself; the artifacts described below are intended to be consumed inside your organization's existing audit programs.
3 sub-categories mapped
3 sub-categories mapped
3 sub-categories mapped
3 sub-categories mapped
function
Culture, accountability structures, and policies that make AI risk management a managed activity, not a side effect.
vibefixing artifact
Versioned YAML policies under packages/policies/. Each policy is a file with a semantic version; every change ships through git review.
evidence
Policy files in source control with author, timestamp, and review trail. Policy version is stamped on every supervisor decision.
vibefixing artifact
Per-action ownership is encoded in the action_type registry: each action type names a responsible policy and a default enforcement mode (shadow / enforce).
evidence
/v1/action-types lists every action the supervisor knows about with its current policy_ref.
vibefixing artifact
Not addressed.
evidence
This is an organizational practice, not an artifact a runtime supervisor can produce. We do not claim coverage.
function
Establish the context: what the AI system does, what it is used for, what its capabilities and limitations are, and what risks it could create.
vibefixing artifact
Each action_type ships intercepted_signals (the inputs the policy can decide on) and the sample_payload that triggered evaluation. Gaps in coverage are visible by inspection.
evidence
action_type.intercepted_signals enumerates the supervisor's decision inputs. Anything outside that list is, explicitly, out of policy scope.
vibefixing artifact
The action_type registry assigns each action to a tier (security / reliability / efficiency / quality) and ships a one-liner explaining the business outcome being protected.
evidence
/v1/action-types responses include title, one_liner, and the policy_ref so the cost-of-violation is traceable.
vibefixing artifact
Threat catalog at /v1/threats/catalog links each known threat to an OWASP LLM Top 10 reference where one applies, plus a remediation string.
evidence
ThreatCatalogEntry.owasp_ref is non-empty for every cataloged threat. The crosswalk you are reading is the GOVERN-side analog.
function
Use quantitative, qualitative, or mixed-method tools to analyze, assess, benchmark, and monitor AI risk and related impacts.
vibefixing artifact
Every supervised action produces a deterministic risk score and a list of threat signals that fired, written to the evidence chain. Re-running the same input against the current policy is a dry-run via /v1/actions/evaluate.
evidence
Evidence events carry risk_score, threats[], reasons[], policy_version. Replay is reproducible.
vibefixing artifact
Evidence chain is append-only and hash-linked. Threat assessments are stored as ThreatAssessmentRow with timestamp, detector_id, severity level, and the signals that matched.
evidence
/v1/threats lists historical assessments. The hash link breaks visibly if a row is modified.
vibefixing artifact
Findings carry confidence tiers (high / medium / low). Public scans only surface high-confidence priority findings; the dashboard tracks user-initiated overrides as policy edits.
evidence
Decision overrides become policy diffs in source control; the feedback loop is the policy change.
function
Allocate risk resources to mapped and measured risks on a regular basis and as defined by the Govern function.
vibefixing artifact
Enforcement mode is a per-deployment environment variable: shadow (log without blocking) and enforce (block on violation). The mode is stamped on every decision so historical analysis distinguishes 'would have blocked' from 'did block'.
evidence
SUPERVISOR_ENFORCEMENT_MODE is read at decision time and recorded with the evidence event.
vibefixing artifact
The supervisor exposes Prometheus-style metrics on decision counts, denial rates, policy violations, and self-check drops. The threat assessment endpoint streams new assessments as they are recorded.
evidence
/metrics endpoint on the supervisor; ThreatAssessmentRow timestamps on /v1/threats.
vibefixing artifact
Not addressed end-to-end.
evidence
Vibefixing surfaces incidents to operators via the dashboard and webhooks. Communication to end users or affected communities is a downstream workflow your team owns.
Enterprise engagements include a working session with your compliance team to walk through each sub-category and identify the gaps where Vibefixing does not apply. The deliverable is a populated questionnaire your team can submit, not a marketing deck.
NIST AI Risk Management Framework (AI RMF 1.0) is a publication of the National Institute of Standards and Technology, U.S. Department of Commerce. Vibefixing is not affiliated with NIST.