Frameworks
- NIST SP 800-53 Rev. 5 and its baselines, generated from NIST's own published OSCAL content.
- NIST AI Risk Management Framework.
- Kendrake generative AI overlay.
Requirements are mapped to each component of the system.
Kendrake AI Assurance
Authorization readiness for AI systems that keep changing.
An authorization readiness platform for AI-enabled systems. It tells the people responsible for an AI system exactly what a change does to its authorization evidence, and which evidence it leaves alone.
The walkthrough runs on HARBORLIGHT, a fictional AI system.
The problem
AI systems change constantly: retrained models, new prompts, swapped providers, new data sources, agents given new permissions. Every change raises the same question for the authorization team: which of our hundreds of pieces of evidence are still valid?
Today that answer is a spreadsheet, a meeting and a guess. Teams either redo everything (slow and expensive) or redo too little (risk to the authorization).
How it works
Keep the system model
Components, models, prompt pipelines, agent tools, data sources, data flows and the boundary.
Work out which requirements apply
NIST SP 800-53 Rev. 5 with its baselines, the NIST AI Risk Management Framework, and Kendrake's generative AI overlay.
Track the evidence each component owes
Including AI evaluation results, graded against their own plans.
Disposition every piece of evidence when the system changes
Kendrake Delta says carry forward, revalidate, or send to a person to review, with the rule that decided it.
Let people decide
Assessors and owners make the decisions. Every decision, signature and change sits in a tamper-evident audit trail.
Produce the package
Findings, risks and POA&M flow out as OSCAL (SSP, assessment results, POA&M) and an eMASS-ready POA&M file.
Use AI assistance where it helps
Optional AI assistance drafts narratives and maps documents to requirements, with citations. A named person accepts every suggestion.
Kendrake Delta
Delta is the change-impact engine. Give it a change and it gives every piece of evidence a disposition, with the rule that decided it.
- Carry forward, revalidate, or send to a person to review.
- Deterministic and replayable: the same change under the same rule pack gives a byte-identical result.
- Checked against 40 change scenarios, 20 of them written by an independent author who never saw the rules.
- Rule packs are versioned and cryptographically signed. Requirements are data, not code.
Evidence and AI evaluations
Each component carries the evidence it owes. AI evaluation results are graded against their own plans, so a run is judged by the plan it was meant to meet.
Decisions and audit trail
Assessors and owners decide. Every decision, signature and change sits in a hash-chained, tamper-evident audit log.
Separation of duties is built in: the person who uploads evidence cannot judge it, and the system owner cannot sign their own package.
OSCAL and eMASS outputs
Findings, risks and POA&M flow out as OSCAL: the SSP, assessment results and POA&M. Output is validated against NIST's OSCAL 1.1.2 schemas.
An eMASS-ready POA&M file comes with it.
AI assistance, human acceptance
Optional AI assistance drafts narratives and maps documents to requirements, with citations.
It never decides a status, and nothing changes until a named person accepts it.
Security and deployment
Built for regulated hosting. It runs in the customer's own cloud or data center.
- Runs in containers on Azure, Kubernetes or a customer's own environment.
- Tenant isolation enforced in the database.
- Encrypted evidence storage.
- Hash-chained audit log.
- Signed rule packs.
- More than 500 automated tests, and an independent adversarial security review with every high finding fixed.
Accessibility
Tested against WCAG 2.1 AA in light and dark themes.
Decision support
Kendrake AI Assurance computes readiness and supports the people who decide. Authorization decisions remain with the authorizing official.
See Kendrake Delta on a fictional system.
A 20-minute walkthrough on HARBORLIGHT, a fictional AI system: a model retrain previewed before it is saved, what Delta reopens and why, and the package an assessor signs.