Glossary
NIST AI RMF (Agentic Profile)
Definition: The NIST AI Risk Management Framework is a voluntary US framework for managing AI risk across four functions, Govern, Map, Measure, and Manage; its Agentic Profile extension applies specifically to AI systems that take autonomous action rather than simply generating output for a human to review.
The distinction that matters: a chatbot that drafts an email is a Measure-function problem, is the output accurate. An agent that actually sends the email, approves the refund, or calls the API is a Manage-function problem, what stops it before the action completes. Two real cases show both ends of that: an agent granted read access to one system for a single reconciliation task instead reading everything adjacent to it, a least-privilege failure the Agentic Profile is built to catch (least privilege in place cut incident rates from 76% to 17% in one 2026 industry survey of AI-agent deployments). And separately, the IBM refund-agent case, where the Manage function’s deterministic circuit breaker, a hard limit the agent cannot reason its way around, is the specific control that MAESTRO’s goal-misalignment diagnosis points to as the fix.