Red Hat, NVIDIA, IBM Support Open-Source Project That Turns AI Policies Into Deployable Code

 

Red Hat has introduced asago, a new open-source community project designed to transform artificial intelligence governance policies into technical safeguards that can be deployed directly into production systems.

Supported by major technology and research organizations including NVIDIA, IBM Research, Microsoft, Brave Software, MIT Lincoln Laboratory, and The Alan Turing Institute, the project aims to close the gap between compliance documents and the actual controls used to manage AI systems.

As governments introduce stricter AI regulations, companies are under increasing pressure to prove that their systems comply with safety, security, and transparency requirements.

However, many organizations still rely on manual compliance reviews, disconnected testing tools, spreadsheets, and separate engineering processes. This can delay AI deployments and make it difficult to determine whether governance policies are being enforced once an AI system begins operating.

The asago project seeks to automate that process.

From Written Policy to Technical Controls

According to Red Hat, asago provides an automated and auditable workflow that links corporate AI policies with testing procedures, risk assessments, guardrails, and live deployment configurations.

The system is designed to process an organization’s governance documents and identify the risks and obligations described within them.

It then maps those requirements against recognized AI safety and security frameworks, including:

• The European Union AI Act
• The NIST AI Risk Management Framework
• The OWASP Top 10 for Large Language Model Applications
• IBM’s AI Risk Atlas

Instead of requiring compliance personnel to manually compare internal policies with multiple regulatory frameworks, asago attempts to create an automated risk profile based on the uploaded policy.

Four Stages of AI Governance Automation

Red Hat describes the asago workflow as a four-stage process.

1. Risk Mapping

The system analyzes an organization’s governance policy and connects individual requirements to established regulatory, security, and risk-management frameworks.

For example, a company policy requiring protection against sensitive data leakage may be matched with related risks documented under the OWASP LLM Top 10 or IBM’s AI Risk Atlas.

2. Risk Assessment

After identifying the potential risks, the system generates testing scenarios based on the specific AI application.

Rather than relying only on a general safety checklist, the assessments are tailored to the organization’s actual use case.

An AI customer-service agent, for example, may be tested for unauthorized disclosure of personal data, harmful recommendations, policy violations, or attempts to bypass system restrictions.

3. Risk Mitigation

Based on the results of the assessment, asago recommends safeguards and technical guardrails.

The project is also designed to document why each safeguard was selected, creating a record that compliance officers, auditors, engineers, and regulators can review.

4. Deployment

The recommended safeguards are converted into deployment-ready configurations for hybrid cloud and Kubernetes environments.

According to Red Hat, the project can generate declarative configurations for technologies such as Kubernetes, Terraform, and Ansible.

This means organizations could apply the same AI safety requirements across different cloud environments without rebuilding every control from the beginning.

Red Hat says the approach could reduce governance implementation timelines from several months to only a few days. However, this claim has not yet been demonstrated through publicly released customer deployments or regulatory audits.

Creating a Continuous AI Audit Trail

One of asago’s main goals is to create a continuous and traceable audit record.

Every governance requirement should be linked to a specific risk test. Each test should then be connected to the technical safeguard deployed in the production environment.

In theory, an auditor could examine a live AI control and trace it back to the exact policy requirement that led to its implementation.

This approach treats AI governance as an ongoing operational process, rather than a one-time certification completed before deployment.

That distinction is becoming increasingly important as organizations move from temporary AI experiments to autonomous agents that can operate continuously, access company systems, interact with users, and make decisions with limited human supervision.

Steven Huels, Vice President of AI Engineering at Red Hat, said clear operational guardrails are becoming a critical infrastructure requirement as companies adopt long-running autonomous AI agents.

Huels also connected the project with Red Hat’s Lightwell initiative, which focuses on protecting the open-source software supply chain from AI-assisted security threats.

A Multi-Organization Open-Source Initiative

Although Red Hat introduced the project, asago is being positioned as a collaborative initiative rather than a single-company product.

Its early contributors include:

• Red Hat
• NVIDIA
• IBM Research
• Microsoft
• Brave Software
• MIT Lincoln Laboratory
• North Carolina State University
• The Alan Turing Institute
• EvalEval Coalition
• Interdisciplinary Transformation University in Austria
• Alquimia AI

Sarah Bird, Microsoft’s Chief Product Officer for Responsible AI, said many AI safety and security problems remain unresolved and cannot be addressed by one organization alone.

Veena Misra, Interim Dean of North Carolina State University’s College of Engineering, also emphasized that AI safety should be treated as an engineering challenge, not only as a policy issue.

The project is being released under the Apache License 2.0, allowing developers, researchers, enterprises, and government institutions to inspect, modify, and contribute to its development.

Still in the Early Formation Stage

Despite the involvement of major technology companies and research institutions, asago is not yet a finished enterprise product.

The project remains in its formation stage, with its repository and governance structure available through GitHub.

Red Hat has not yet published a production customer case study, independent benchmark, or completed regulatory audit showing that the framework can consistently reduce governance implementation from months to days.

Questions also remain about how the project will resolve disagreements among contributors, particularly when organizations or governments interpret AI risks and regulatory requirements differently.

AI regulations can vary significantly across jurisdictions. A safeguard considered sufficient in one country may not satisfy the legal or cultural expectations of another.

Red Hat is therefore encouraging researchers, technology companies, academic institutions, and government representatives from different regions to participate in the project.

Why This Matters for the Philippines

For Philippine companies, government agencies, banks, business process outsourcing firms, healthcare providers, and educational institutions, a project like asago could eventually make AI governance more practical.

Many local organizations are beginning to adopt generative AI tools, automated customer-service agents, AI-powered analytics, and decision-support systems. However, governance policies are often separated from the technical teams responsible for building and deploying these systems.

An open-source framework that converts policy requirements into deployable controls could help Philippine organizations establish clearer safeguards while reducing dependence on expensive proprietary compliance platforms.

However, local adoption would still require policies that reflect Philippine laws, languages, cultural contexts, cybersecurity requirements, and data-protection standards, including the Data Privacy Act of 2012.

The success of asago will depend on whether it can move beyond policy mapping and perform reliably inside complex, real-world AI deployments.

For now, it represents an ambitious attempt to turn responsible AI principles from written promises into controls that engineers can actually deploy, monitor, and audit.