Red Hat launches asago to connect AI governance policy with production controls

What changed

Red Hat has launched asago, short for AI Safety and Governance Orchestration, as an open-source community project intended to connect written AI governance policy with the controls applied to production AI systems. The project is being formed with participants from industry and research, including IBM Research, Microsoft, NVIDIA, Brave Software, MIT Lincoln Laboratory and The Alan Turing Institute.

The planned workflow has four stages: map policy requirements to recognized risk frameworks, generate use-case-specific safety tests, recommend mitigations based on test results, and package those controls for deployment. Red Hat says each stage is intended to retain evidence linking a policy clause to a risk, test and production control, creating an audit trail across work that is usually split among compliance, model-safety and platform teams.

Asago is an orchestration layer rather than a replacement for existing evaluation, red-teaming or guardrail projects. Its initial architecture maps policy-derived risks to the IBM AI Risk Atlas, produces scenarios for evaluation frameworks, and feeds results into a recommender loop whose outputs can eventually become Kubernetes custom resources, ConfigMaps or other deployable configurations.

The project is still in its formation phase, and much of that end-to-end design is a roadmap rather than a finished platform. However, development artifacts are public. The Asago Policy Mapper repository can parse unstructured policy documents, identify risk IDs, ground matches in source passages, assign confidence scores and map findings across taxonomies including NIST AI RMF and the OWASP Top 10 for LLM Applications.

Who is affected

Asago targets organizations where AI approval spans several groups. Compliance and risk officers need policy requirements and reviewable evidence; AI engineers need tests tied to a particular agent or model use case; platform engineers need those decisions expressed as maintainable deployment controls; and auditors need traceability between them.

That scope makes the project particularly relevant to teams moving from isolated AI experiments to long-running agents. The value proposition is not another generic benchmark. It is a shared workflow that can carry an organization’s own policy through risk identification, testing, remediation and deployment while preserving human review.

The early status also limits the immediate operational impact. Asago is not yet a turnkey governance product, and its stated goals should not be treated as proof that an AI deployment satisfies a regulation or internal policy.

What to do

Platform and AI-governance teams should first map their existing process: policy documents, risk taxonomies, evaluation tools, approval points, deployment controls and evidence retained for audit. That inventory will show where an orchestration layer could remove manual handoffs without delegating final accountability.

Teams that want to evaluate the project now can start with the Apache-2.0-licensed Policy Mapper using non-sensitive sample policies. Review extracted risks, evidence spans and confidence scores against human analysis before connecting its output to testing or remediation workflows. Treat every generated mapping and recommendation as reviewable evidence, not an automatic compliance decision.

Potential adopters should also follow the Asago community’s governance and integration work before designing a production dependency around it. The project’s significance is the attempt to define an open policy-to-production contract; its practical value will depend on whether the community can make that contract interoperable, testable and auditable across real enterprise environments.