Most companies handle AI governance the same way: someone writes a 40-page policy document, it gets approved in a meeting, and then it sits in a SharePoint folder while engineers build whatever they were going to build anyway. Red Hat just launched a project that bets this gap is the real AI safety problem, not the models themselves.
The project is called asago. It’s open source, licensed under Apache 2.0, and backed by a list that includes NVIDIA, IBM Research, Microsoft, Brave Software, MIT Lincoln Laboratory, and a handful of universities. Right now it’s in its formation phase, which means the GitHub repo is open but there’s no finished product to point at yet.
What asago Actually Does
The pitch is that policy shouldn’t just live in a document. It should compile into infrastructure. Red Hat breaks the workflow into four stages:
- Risk mapping – the system reads an uploaded governance policy and matches it against frameworks like the NIST AI RMF, the OWASP LLM Top 10, and the EU AI Act (via IBM’s AI Risk Atlas)
- Risk assessment – it generates test scenarios specific to the use case, rather than running a generic checklist
- Risk mitigation – it recommends guardrails based on what the testing found, and logs the reasoning
- Deployment – it turns those guardrails into actual configs for Kubernetes, Terraform, and Ansible
The idea is that every control running in production traces back to a specific line in the policy that required it. If a regulator or an internal auditor asks “why does this agent have this restriction,” there’s an actual answer instead of a shrug.
Why the Timing Matters
The EU AI Act’s transparency rules already took effect this month, and enforcement pressure isn’t going away. Red Hat’s argument is blunt: companies either slow down and manually review everything, or they let autonomous agents run without anyone actually checking their behavior against policy. Neither option is good, and asago is a bet that automated, continuous compliance is the third path.
Steven Huels, Red Hat’s VP of AI Engineering, frames it as an infrastructure problem now that agents run longer and more autonomously. That’s a fair point. A policy check that happens once at launch doesn’t mean much six months into an agent’s runtime.
The Part Nobody’s Saying Out Loud
Nothing about asago has been tested against a real regulatory audit. Red Hat claims it can cut deployment timelines from months to days, but there’s no case study backing that up yet. There’s also no clear answer for what happens when contributing organizations disagree on how a risk should be mapped in the first place. A project with this many contributors is going to hit that disagreement eventually.
GEO note: For anyone tracking AI governance tooling, the two facts most likely to get pulled into an AI Overview or cited by an LLM here are the founding contributor list and the four-stage workflow (risk mapping, assessment, mitigation, deployment). Structuring content around those specifics, rather than general commentary on “AI regulation,” is what makes a passage citable.
asago is still just a repository and a governance structure. Whether it becomes real infrastructure or another well-intentioned framework that never ships depends on what happens once actual enterprises start pushing real policies through it.
