AIBRIEF
The Apache 2.
Red Hat, NVIDIA, and IBM are backing an open-source project built around a single mechanic: a defensible audit trail that lets a reviewer trace any running Kubernetes control back to the exact policy clause that justified it.
The project, called "asago" for AI Safety And Governance Orchestration, launched this week under Apache 2.0 and is in formation phase. The asago-ai GitHub organization hosts the repos, with asago-policy-mapper handling the NLP pipeline that maps uploaded policy text to risk IDs in IBM's AI Risk Atlas, and midojo providing a red-team harness inspired by AgentDojo.
The workflow runs in four stages: risk mapping against NIST AI RMF, OWASP LLM Top 10, and the EU AI Act; risk assessment that produces use-case-specific scenarios; risk mitigation that recommends guardrails with a rationale trail; and orchestration that emits hybrid cloud and Kubernetes configurations. The trace is the product: every policy clause links to a test, every test links to a live control.
Red Hat's stated aim is to compress deployment timelines from months to days, framed against EU AI Act obligations that phase in across 2026 and 2027. The project extends work inside the Open Secure AI Alliance, which counts 35–37 members and recently open-sourced the NOOA framework. OpenAI, Google, and Anthropic are not on that list.
The open question is reviewer independence: if a reviewer disputes the risk mapping asago generated from their own policy, can they override it and produce a defensible alternative trail? That test separates a governance tool from a compliance-checkbox surface.