A toggle is not a Measure program

Buyers still ask for “NIST AI security” as a switch. A prior paper mapped the AI RMF suite and located secure and resilient as one of seven trustworthiness characteristics. Maps do not stop a mutating tool call.

This essay is a tour of a pattern paper: the workspace trust layer — policy plus evidence for tool-using generative agents. It is aligned to security practice under the AI RMF. It is not a claim that Safety, fairness, or explainability shipped in the same toggle.

Four claims

Prompt is not the layer. Policy text in an agent runner is advisory. Load-bearing controls are a toolset strip, a pre-tool gate (unioned with plan mode), admission, and optional provider guardrails. If the model is told not to disable the layer and a shell tool still fires, the layer failed.

Coverage is a first-class artifact. When the layer is on, a coverage strip states what is enforced (secure_resilient), what is only partial in strict mode (privacy), and what is off (fairness, explainability). NIST Safe is a neighboring characteristic — life, health, property, environment — and is not silently absorbed into “trust.”

Measure is aspect-tagged events, not operator logs. Denials, asks, and policy changes are written in the same request as the decision, tagged by aspect and decision, without prompt bodies. Settings → Reports is the CISO surface. Grafana is not.

Modes are profiles, not severity sliders. standard is the parent secure and resilient posture for a genai-agent system. strict is closer to the Cyber AI Profile “Secure” row: fewer writes, fail-closed memory behavior, more events. Complements inform the deny list; they are not a second product.

What the layer is

One workspace-authoritative policy. Owner/Admin enable it. Members see a badge and cannot opt out per session. Custom instructions cannot clear it. Every session and durable run in that workspace inherits the same gates.

A worked minute

Admin enables standard and reads the coverage strip. A member asks for a shell command. The gate denies. Chat shows a short reason. An event lands as aspect=tool, decision=block. Admin opens Reports and filters Tools. Fairness is still listed as not measured. That last sentence is the point.

Failure modes to refuse

• Prompt-only “compliance” packs with no gate and no events
• Logs-only evidence the customer Admin cannot query
• Advertising all seven characteristics because a tool gate shipped
• Merging ISO/IEC 42001, the EU AI Act, or Safe into the same switch
• Treating strict mode as “more NIST” rather than a different Secure-row posture

Why this pattern

One characteristic, enforced and counted, is more trustworthy than a full-RMF badge. Used with the suite map — and with the discipline not to absorb Safety into Security — the trust layer is Govern / Map / Measure / Manage for agents without certification theatre.

For the full argument, mapping table, and mode comparison, read the paper.

@online{violet2026trustlayer,
  author = {Haigh, John},
  title = {The Workspace Trust Layer: Enforcing One Characteristic of the AI RMF for Tool-Using Agents},
  date = {2026-09-13},
  year = {2026},
  url = {https://www.violetai.ca/en/research/trust-layer/paper},
}