The framework
A Responsible AI Framework built on the standards your auditors already trust
We don't invent a proprietary model. We mirror the GAO AI Accountability Framework — the IG community's own standard — operationalize it with the NIST AI Risk Management Framework, and design every control to meet-or-exceed OMB M-25-21 while honoring the OIG's independence.
Independent by design
USPS is exempt from the FAR and the OMB AI memoranda do not legally bind an independent Inspector General. We treat M-25-21 as a floor to meet-or-exceed — and design the framework around the OIG’s statutory independence, its law-enforcement-sensitive data, and its agentic-AI trajectory, mirroring GAO-21-519SP so the OIG can audit its own AI to the same bar it holds others to.
Governing the agents RISC is building right now
RISC has built agent prototypes in LangChain, LangGraph, CrewAI, and AutoGen, with none yet in production, and has not finalized how those agents are credentialed, whether through Entra user-delegated permissions in CoPilot Studio or managed identities and service principals. That open question is the heart of responsible agentic AI, and it is where this framework starts: action allowlists, human-approval gates, agent identity and least privilege, and defensible accountability for autonomous decisions, built for the prototype-to-production crossing RISC is at today.
The backbone · GAO-21-519SP
Four accountability principles
This is the framework the OIG would use to audit anyone else’s AI. We build the OIG’s own program to the same bar — so it can be audited to it.
Governance
Who is accountable for the AI?
Senior accountability, defined roles, AI policies, and stakeholder engagement from inception.
Data
Is the data appropriate?
Quality, representativeness, lineage, PII handling, and documented training/test data.
Performance
Does it work as intended?
Testing across subgroups, accuracy/reliability/fairness metrics, and pre-deployment validation.
Monitoring
Does it hold over time?
Post-deployment monitoring, drift detection, incident logging, and periodic re-evaluation.
The operating system · NIST AI RMF
Four functions, wired to the platform
Risk-aware culture, policies, approval gates, accountability — the cross-cutting function.
Demonstrated by: AI governance board, risk appetite, escalation, Enhanced TLP
Context, stakeholders, impacts and data lineage for each AI system.
Demonstrated by: Use-case intake, AI inventory, impact analysis
Analyze and track AI risk with quantitative + qualitative methods.
Demonstrated by: Bias/fairness testing, XAI, drift detection, red-teaming
Prioritize, treat, and respond — including incidents and residual risk.
Demonstrated by: Risk registry, incident playbooks, monitoring logs
Built for the environment RISC runs
We integrate into your stack. We do not replace it.
Confirmed from the OIG’s own solicitation documents, the framework is designed for the systems RISC already operates.
Azure + Microsoft Entra
Deployed inside the OIG tenant, authenticated through Entra and honoring existing RBAC. No HSG-hosted system, and law-enforcement-sensitive data never leaves OIG control.
Databricks Lakehouse
The AI inventory and risk registry read from the model estate, and drift monitoring runs on the inference tables RISC already operates.
AskSage API + Microsoft AI Foundry
The platform you can operate here runs on Claude for the demo; in production every model call routes through the OIG's own sanctioned gateways, AskSage (including its API) and Microsoft AI Foundry, with no external model key introduced.
Power BI
Governance KPIs and drift dashboards land in the OIG's existing BI layer, not a separate tool to learn.
NIST 800-53 · FedRAMP · AS-805-H
The framework aligns to the OIG's existing authorization regime, and our staff onboard at the MBI level required for system access.
Seven workstreams
The SOW, organized
Ethics & Integrity Controls
Bias-mitigation protocols, explainability guidelines, fairness-assessment procedures, and checkpoint gates wired into AI release.
People, Culture & Training
Role-based playbooks, Golden Templates, an integrated Prompt Library, and a workforce upskilling dashboard.
Risk Assessment & Mitigation
A living AI Risk Registry, documented validation checks and monitoring procedures, and audit-ready evidence logs.
AI Strategy & Use-Case Intake
Standardized intake forms, evaluation criteria, a decision log, and a centralized inventory of approved AI use cases.
Performance Measurement & Drift Monitoring
AI KPIs, live performance dashboards, drift-detection mechanisms, and ROI tracking across relevant dimensions.
AI Governance Enhancements
A standing AI Inventory, the Enhanced Traffic-Light Protocol for data classification, and updated data-governance, privacy, transparency and compliance policy.
Authorities referenced