How does NIST AI RMF apply to autonomous agents?

The four functions still apply, but three of them assume properties agents do not have. MAP assumes a system with a definable boundary, and an agent redraws its boundary every time it selects a tool. MEASURE assumes an evaluable output, and an agent's risk lives in its trajectory rather than its final response. MANAGE assumes a human sits in the loop at decision points that agents are specifically built to remove.

Adapt MAP by mapping capability rather than architecture. Enumerate every tool, MCP server, data source, and downstream system the agent can reach, and treat that reachable set as the system boundary. It changes when a tool is added, which means the mapping is continuous rather than an artifact.

Adapt MEASURE by evaluating trajectories. A response-level eval passes an agent that answered correctly after reading a credential file it had no business touching. Instrument the intermediate steps and measure attack success rate against adversarial objectives, not just output quality.

Adapt MANAGE by moving the control point to the tool-call boundary. Human oversight of a fully autonomous loop is a design claim, not a control, unless a specific class of action requires approval before it executes.

GOVERN survives largely intact, with one addition: agent permission grants need a named approver, because they are the decision that determines blast radius and they are usually made by whoever wrote the config.

NIST's Generative AI Profile, NIST-AI-600-1, published July 2024, is the more applicable companion document, though it too predates most production agent deployments.

Akto Argus operates at the MEASURE and MANAGE layer, providing continuous adversarial testing and runtime enforcement at the tool-call boundary for agentic applications.

Map what it can reach, not what it is.