It is true that artificial intelligence is evolving fast. Every day brings a new application for AI, a new approach to using AI, or a new AI system capable of fundamentally changing our lives and work routines. But the faster the innovations are coming, the more difficult it becomes to ensure the safety, ethics, and compliance of AI systems.
Typically, the difference between having AI governance policy in place and the actual implementation of such policy in an AI system is very large. Policies are created by people in human language, which consists of shoulds and musts. But code does not allow for any ambiguities or flexibility. It is always very precise and binary. The conversion of policies into production ready code was done manually before.
As such, Red Hat, NVIDIA, IBM, and several other leading tech companies and universities decided to create an open-source project aimed at automating this task. They named the project asago (AI Safety And Governance Orchestration).
In this blog post, we will explain what this project does, why it is so important and innovative, and what impact it might have on the future of responsible AI deployment.
What exactly is the Asago Project?
Consider asago as a link between your organization’s AI governance policies on one hand, which could be based on the EU AI Act, NIST AI RMF framework, or best practices from within the organization itself, and on the other hand, your AI applications deployed on Kubernetes or hybrid cloud infrastructures. The traditional process for linking the two sides used to involve collaboration between lawyers, compliance experts, and software engineers to implement policy-driven manual checks and script-based controls for months at a stretch.
As ago solved this problem by offering an automated, open-source workflow that takes care of this process. The tool is currently in its early phases of development and is available at GitHub under the Apache License 2.0. It is truly a community led project with contributions coming in from organizations such as Red Hat, NVIDIA, IBM Research, Microsoft, Brave Software, MIT Lincoln Laboratory, the Alan Turing Institute, and many more. The objective? Reduce the deployment time for AI systems to days from months.
How Asago Works: The Four-Stage Workflow
Asago is unique in its workflow approach that consists of four stages. Let’s look at each of them to understand how Asago converts your policy into code.
Stage 1: Risk Mapping
The process starts with uploading your AI governance policy to Asago. This software reads the document and maps it to industry standards such as
- NIST AI RMF (National Institute of Standards and Technology AI Risk Management Framework)
- OWASP LLM Top 10 (OWASP’s top security risks for large language models)
- EU AI Act
In this phase, a “risk profile” is created for your AI application. It helps you understand the aspects of your policy that relate to different parts of your AI application.
Stage 2: Risk Assessment
As soon as the risk assessment is done, Asago takes care of testing. The software comes up with test cases that specifically test those behaviors that are listed in your risk assessment.
For instance, if your requirement states that the AI Assistant should never generate any biased response, Asago will come up with some test cases that will specifically check whether the AI is biased or not.
Stage 3: Risk Mitigation
In light of the test results, Asago provides the necessary recommendations for protection and mitigation. This is where the system makes suggestions about what needs to be done in order to mitigate the risk it detected.
However, this is an important aspect because the tool does not only point out the necessity to use the filter; it also provides a traceable justification for the recommendation it made in relation to the initial policy requirement.
Stage 4: Production Deployment
It’s the point at which all the hard work pays off. As ago takes all the risk assessments and risk mitigation suggestions and turns them into declarative configuration files for deployment onto the following platforms:
- Kubernetes
- Terraform
- Ansible
The advantage here is that instead of receiving an assessment document, you receive code that will make your AI system compliant the second you deploy it. The configurations are agnostic to the infrastructure, allowing you to deploy the system to whichever environment you choose.
The Problem Asago Solves: Policy vs. Practice
In order to fully understand the significance of Asago, it is necessary to examine the challenge that it seeks to solve. The current IT landscape is one full of challenges. In the last decade, most firms have been striving towards becoming more agile through digital modernization and the adoption of hybrid clouds. Now, AI workloads are being introduced to the environment.
The Manual Compliance Nightmare
It is a complete horror to manually implement policies in this kind of environment because you will need to do the following:
- Host cross-functional meetings in which compliance officers educate engineers about their responsibilities.
- Perform code reviews by hand in order to ensure there is no violation of policy.
- Document everything that is needed in case of auditing.
- Perform remediation when needed.
Such an approach is a waste of time and increases the possibility of human error. According to Red Hat, both sophistication and frequency of attacks keep increasing, and on average, a data breach costs $4.45 million, which is 15% higher than three years ago.
Policy as Code: The Smarter Way
The solution lies not in reducing the pace of adopting AI but in adopting smart practices. Policy as Code (PaC) is the best practice that ensures compliance enforcement in automated ways. Unlike manual verification, PaC involves the implementation of policies in development and deployment pipelines.
Imagine that you are constructing a building. Using a manual approach means that an inspector will inspect every nail hammered in the wall. With the help of Policy as Code, this approach means building the requirements of the inspector in the hammer itself.
Asago is the future application of this idea to AI governance.
The AI Audit Trail: Your “Single Source of Truth”
Another amazing feature of Asago is that it offers an end-to-end audit trail. Everything that happens in the workflow, including the uploading of policy and the deployment in production, is recorded.
In other words, you can take any control that is currently in your production environment and trace it back to the exact requirement in the policy that created it. This is a revolutionary tool for compliance officers, who no longer need to spend weeks collecting evidence. All they need is a unified tracing interface, which explains how the compliance was achieved.
As Red Hat puts it, this is “continuous verification” of the enterprise AI portfolio.
Why This Matters for AI Safety
The Asago project is timely because as organizations transition from using artificial intelligence as a tool to using artificial intelligence as an autonomous agent, there is a need for boundaries in its usage. This is because these types of artificial intelligences run on their own.
The Challenge of Autonomous Agents
Autonomous AI agents are capable of taking decisions, making moves, and interacting with systems without any direct human supervision. If not governed correctly, they may:
- Violate privacy policies.
- Take biased/harmful decisions.
- Fall victim to exploitation by hackers.
- Behave in a manner that conflicts with the values of the organization.
Asago attempts to solve this issue by making sure that all AI agents, whether autonomous or not, are put in place with appropriate controls in place.
Collaboration is Key
It is essential to note the fact that Asago is an open-source project, and it plays a key role in the success of Asago. AI safety cannot be ensured by any particular organization alone. Asago uses technology firms, academic organizations, and government institutions to benefit from diverse skills.
According to Sarah Bird, Chief Product Officer of Responsible AI at Microsoft, “Many of the most difficult AI safety and security issues have yet to be resolved, and no one organization can do it on their own. Open, broadly adopted standards can lead to a more consistent governance model within the ecosystem.”
How Can You Get Involved?
The Asago project is still at the formative stage, which means it is an opportune moment to get involved. The code is available on GitHub, and the project is actively looking for contributions from software developers, academics, and enterprise early adopters.
Here’s how you can contribute:
- Explore the code and documentation through the GitHub repository.
- Be part of the community and contribute your thoughts and requirements.
- Contribute code and work towards creating the four-stage workflow process.
- Contribute feedback based on the AI governance requirements of your organization.
- Contribute towards the development of global standards by adding varied perspectives.
It should be noted that the project specifically calls for contribution from various global jurisdictions, ensuring that Asago caters to different regulatory perspectives.
The Bigger Picture: Responsible AI in Practice
The Asago project can be considered one of the key ways to implement responsible AI. This is an admission that it is not sufficient to have good intentions; there is a need for mechanisms that will ensure safety, ethicality, and compliance at the time when AI is being developed and deployed.
The way AI should evolve in the future is innovation that is not only rapid but also reliable and safe. And Asago is exactly the tool that helps to build this future.
Conclusion
First of all, the significance of the Asago project lies not only in the fact that it is a new open-source solution. This tool represents an important step towards a more efficient approach to implementing AI governance. Automation of the process of translating policies into production code is crucial because this process is now one of the most significant obstacles on the way to implementing AI safely and responsibly.
The fact that some of the major companies, including Red Hat, NVIDIA, and IBM, are backing this project demonstrates its value and importance in the context of the current development of AI and its use cases. Moreover, the community-driven, open-source nature of this project promises that best practices in the sphere will be shared with the community.
This is particularly interesting in terms of the democratization of safe and ethical implementation of AI because small organizations will be able to implement AI solutions in a way that will be consistent with compliance requirements. It becomes especially relevant when AI becomes more and more autonomous. Learn More
Frequently Asked Questions (FAQ)
1. What does “asago” mean?
Asago means AI Safety and Governance Orchestration. This name describes its aim of orchestrating all stages of AI governance from policy interpretation to deployment.
2. Is Asago free to use?
As Asago is open-source software, you are able to use it for free. All you have to do is to agree with the license terms (Apache License 2.0).
3. Which frameworks are supported by Asago?
Currently, Asago is able to map policies according to several key frameworks: NIST AI RMF, OWASP LLM Top 10, and the EU AI Act.
4. Is it necessary for me to be an expert in compliance to use Asago?
No, it’s not. Although being aware of some basic concepts related to AI governance is helpful, asago is aimed at being used both by specialists and those who aren’t well-versed in the topic. In other words, all the mapping and translating are done by the system itself.
5. What kind of infrastructure should I have to run Asago?
Asago creates configuration files compatible with Kubernetes, Terraform, and Ansible. Therefore, it is completely infrastructure-agnostic and can run in any modern deployment environments.
Explore Our Cybersecurity Category. And if you are reading it up to here, leave a sweet comment to motivate us to write blog everyday.
