Red Hat has announced asago (AI Safety And Governance Orchestration), a new open-source community project aimed at solving one of the emerging problems when artificial intelligence moves from testing to production: turning security, compliance, and governance policies into technical controls that can actually be applied to AI models and agents.
Key points of asago in 20 seconds
- Red Hat promotes asago as an open-source project to automate governance and security of AI systems.
- The system aims to connect policies and regulations with risk assessments, testing, guardrails, and deployable controls.
- It considers standards such as NIST AI RMF, OWASP LLM Top 10, and the European AI Regulation.
- It will be capable of generating declarative configurations for Kubernetes, Terraform, and Ansible.
- Initial participants include Microsoft, NVIDIA, IBM Research, Brave, and The Alan Turing Institute.
The proposal comes as many organizations start facing a less visible problem than choosing a language model. A company may have a policy that specifies what data an AI application can process, what actions an agent can perform, or what risks need assessment before deploying a system. The challenging work begins with translating these rules into infrastructure, configurations, and verifiable controls.
This is where Red Hat aims to position asago.
From Written Policy to Deployed Control in Kubernetes
The idea behind asago is relatively straightforward to explain, though technically ambitious: create a chain linking a governance obligation with the control that ends up running in production.
The project envisions four stages.
The first is risk mapping. asago will analyze governance policies provided by an organization and relate their requirements to existing frameworks and references. Red Hat explicitly mentions the NIST AI Risk Management Framework (AI RMF), OWASP LLM Top 10, and the European AI Regulation, also utilizing IBM’s AI Risk Atlas.
The result should be a risk profile that can later be used by engineering teams.
Next comes assessment. Instead of just running a set of generic benchmarks, asago intends to generate scenario-based tests tailored to the use case and check for potentially dangerous behaviors.
The third phase is mitigation. Based on testing results, the project will recommend appropriate controls and guardrails, while also maintaining information about why each measure was introduced.
The final stage brings these controls into production.
According to Red Hat, asago is designed to generate declarative configurations compatible with Kubernetes, Terraform, and Ansible, enabling the integration of AI policies into practices already used by many infrastructure teams through DevOps, GitOps, and Infrastructure as Code (IaC).
This aspect might turn out to be one of the most compelling features for system administrators, platform teams, and cloud managers.
Governance would cease to be solely a document reviewed before approving an application. Some of those rules could become versioned, reproducible, and auditable configurations.
A kind of Policy as Code applied to artificial intelligence
Although Red Hat does not describe asago simply as a Policy as Code tool, the parallel helps to understand the problem it aims to address.
In modern infrastructure, it’s common to express through code which resources should be deployed, which configurations are allowed, or what policies a cluster must follow.
AI introduces an additional layer.
For example, an organization might set policies that a particular agent should not access certain resources, that a model must pass specific evaluations before deployment, or that an application needs specific controls against certain risks.
The challenge is maintaining the relationship among all these components.
asago aims to keep a continuous audit trail from the original policy through the testing performed and the controls applied during execution. An auditor could identify which requirement justified a specific control and which evaluation verified it.
This becomes even more crucial with the advent of AI agents.
A traditional chatbot might simply generate text. An agent can receive tools, query corporate systems, use APIs, modify information, or initiate processes. The more capabilities delegated to the system, the more important it is to control not just which model is used, but what it can do, under what conditions, and how its activity is recorded.
Red Hat has been working for months specifically on this issue. The company also participates alongside NVIDIA in the Open Secure AI Alliance, an initiative focused on developing open-source tools to enhance the security of models, agents, and other AI chain components.
Kubernetes, Terraform, and Ansible in AI Governance
For technical teams, one significant difference with asago is its aim to connect compliance with existing infrastructure tools.
Red Hat states that the project will generate configurations for Kubernetes, Terraform, and Ansible, regardless of whether applications run on cloud, hybrid cloud, or on-premises infrastructure.
This would allow integrating AI controls into the same lifecycle used to manage the rest of the platform.
A policy could be transformed into a declarative configuration, stored in Git, undergo a review process, and later be deployed automatically. If the original requirement changes, there would be a reference to determine which controls need updating.
This doesn’t mean that asago will automatically convert all legislation into fully compliant infrastructure. Legal interpretation, risk analysis, and organizational decisions remain necessary for compliance.
The project aims to automate another part of the process: translating those decisions into the technical controls needed for implementation and documentation.
It’s also important to note that asago is still in its early stages. Red Hat describes it as a developing community initiative, so many of the capabilities announced are technical goals rather than a finished enterprise product.
The code is published under Apache License 2.0, and developers, researchers, and organizations can participate in its development.
Red Hat Aims to Turn AI Governance into Infrastructure
The initial list of participants demonstrates the scope Red Hat envisions for the project.
Alongside Red Hat are Brave Software, EvalEval, IBM Research, Interdisciplinary Transformation University Austria, Microsoft, MIT Lincoln Laboratory, North Carolina State University, NVIDIA, and The Alan Turing Institute, among others.
The collaboration isn’t accidental. AI governance is shifting from being solely a regulatory or model development issue.
Within enterprise applications, security teams, developers, data scientists, Kubernetes administrators, platform teams, compliance specialists, and auditors all play a role. Each group uses different tools and languages.
asago seeks to create a common layer among them.
If progress is made in this direction, the interesting aspect won’t just be automating guardrails. It will be tracing the full journey of a rule: from a corporate policy or regulatory requirement to the control in operation over a production AI system.
This aligns with another shift in systems management. Infrastructure as Code defined servers, networks, and services via code. GitOps extended this to the continuous operation of platforms. The expanding deployment of enterprise AI raises a new question: if infrastructure is managed as code, why not do the same with the policies governing AI systems?
asago is one of Red Hat’s earliest attempts, and that of the broader tech community, to build this open layer.
It remains to be seen how far it can go in real-world implementations.
Frequently Asked Questions
What is asago?
asago stands for AI Safety And Governance Orchestration. It is an open-source community project led by Red Hat to connect AI governance policies with risk assessments, mitigation measures, and deployable controls in production.
Can asago help with the European AI Regulation?
The project considers the European AI Regulation among the references that can be used during risk mapping, alongside the NIST AI RMF and OWASP LLM Top 10. However, using asago does not automatically guarantee compliance with the regulation itself.
Does asago work with Kubernetes and Terraform?
Red Hat states that asago will generate declarative configurations for Kubernetes, Terraform, and Ansible, facilitating integration with cloud, hybrid, and on-premises infrastructures.
Is asago ready for production use?
Currently, the project is in a community-building phase. Its repository is open for developers, researchers, and organizations interested in participating, but it should not be mistaken for a mature enterprise product from Red Hat yet.
