AI agent governance for code: how 05 maps to NIST AI RMF and ISO 42001
05 holds AI coding agents to what they declared: a plan sealed before they start, checks run on the exact code, a signed record of what they did, and a person's approval bound to exact content. Here is how that maps to the guidance compliance teams ask about. It is our own reading, not a certification.
Scope and strength, first
Scope. 05 governs AI agents that change software. It does not govern AI systems that make decisions about people, such as eligibility or hiring, which is what much of the NIST AI RMF and Canada's Directive on Automated Decision-Making are about. Where guidance is about those systems, it does not apply to 05, and we say so rather than stretch a fit.
Strength. On a developer's machine, 05's controls are advisory: an agent running as you can get around them. The strong form is the CI gate, with checks signed by a runner key the agent never sees and a required check on the merge. The ratings below assume the CI gate is on where it matters. See what 05 enforces, and how strongly.
TBS Guide on the Use of Agentic AI
The Government of Canada's guide for agentic AI, and the one closest to what 05 does.
| The guide asks for | What 05 does | Rating |
|---|---|---|
| Actions logged where the agent cannot change them | A hash-chained action log, sealed by signed receipts as the work happens and countersigned by the CI runner key. The brief says how strongly it is sealed. An agent running unsandboxed as you could rewrite unpushed seals, and 05 says so. | partly met |
| Tool calls: name, time, outcome | Each event records the tool, the time, the files touched and the hook's decision. Contents and parameter values are never recorded. | partly met |
| Logged approvals | Approvals, rejections and break-glass bypasses are signed and bound to the exact tree or plan and the policy in force. | met |
| Clear agent IDs | Each declaration records the agent, its session and, when the hook gives it, the model. | partly met |
| A named human accountable for each agent | The owner is the holder of an approver key, confirmed by that key's signed approval. Delegates are not modelled. | partly met |
| Confirmation before state-changing actions | Protected paths and risky areas need a person's signed approval; the gate holds the change at push and in CI. | met |
| Bounded autonomy | A declared scope reserves an area; edits outside it, to protected paths or into another agent's area are flagged or blocked by policy. | partly met |
| A kill switch outside the agent | Not provided. The agent's own controls stop it. | not met |
| Reversibility | Every change is in git, the brief gives the undo command, and landing is fast-forward only. | met |
NIST AI Risk Management Framework
Mapped to the framework's four functions.
| Function | What 05 does | Rating |
|---|---|---|
| Govern | Policy as code read from a change's base, an organisation floor that only tightens, named owners and approvers, signed approvals and break-glass. | partly met |
| Map | Each change's declared plan and scope, with risk derived from what it touches. Not system-level context or impacts on people. | partly met |
| Measure | Checks proved on the exact tree and signed, weakened tests caught, claims checked against evidence. No model evaluation or fairness testing. | partly met |
| Manage | Findings with stable codes and next steps, risky changes held for a person, undo for every change. No incident response. | partly met |
ISO/IEC 42001 (AI management system)
05 produces evidence for a management system; it is not one.
| Topic | What 05 does | Rating |
|---|---|---|
| Roles, responsibilities and authorities | Owner and approver roles; machine keys cannot approve; the policy names trusted keys and their roles. | partly met |
| Documented information | Signed, offline-verifiable receipts and sealed logs, kept in your own git hosting. | partly met |
| Operational planning and control | Declared plans, derived risk, deterministic gates, an organisation floor. | partly met |
| Event logging | The sealed action log. | partly met |
| Monitoring and internal audit | Evidence an auditor can verify without your machine. No audit programme or management review. | partly met |
| Impact assessment, data quality, suppliers | Not covered. | not met |
What 05 does not do
No register or inventory of AI systems, no assessment of AI systems against policy, no data, model or fairness monitoring, and no kill switch for agents. Those belong to governance platforms. 05's signed receipts are evidence that such platforms and auditors can verify for themselves, without access to your machine.
The full mapping, including the Directive on Automated Decision-Making, is in the repository as docs/compliance-mapping.md.
Keep reading
Try 05 on your own repositories
The source, install steps and docs are on GitHub. Questions, or want to tell us which agent and Git host you use? Email us. No forms, no cookies.