ASAGO: Red Hat’s Open Source Project for Enterprise AI Governance

Red Hat has introduced asago, or AI Safety And Governance Orchestration, an open source project aimed at automating enterprise AI governance. The practical idea is straightforward: convert policy requirements into tests, mitigations, and runtime controls so governance does not remain a document review that blocks deployment.

ASAGO targets the gap between policy and production

Enterprise AI governance often fails at the handoff between compliance and engineering. Compliance teams need risk assessments and evidence, while platform engineers need configurations that can be implemented and maintained. ASAGO is designed to connect those two workflows across four areas: risk mapping, risk assessment, risk mitigation, and production deployment.

The project is intended to interpret corporate and regulatory requirements, map them to established risk frameworks, and produce more structured controls. That makes the ASAGO AI Governance approach relevant to teams operating agents or model-backed applications across hybrid cloud environments, where each deployment may have different data, access, and monitoring requirements.

From risk requirements to testable controls

ASAGO uses the IBM AI Risk Atlas to map requirements to frameworks including NIST AI RMF, OWASP LLM Top 10, and the EU AI Act. It also aims to generate and execute scenario-based safety tests based on identified risks rather than relying only on generic model benchmarks.

That distinction matters for builders. A benchmark can describe how a model performs under a fixed evaluation, but a scenario test can be tied to a particular workflow, such as an agent accessing tools, handling sensitive information, or taking an action on a user’s behalf. The available announcement does not provide detailed test schemas, supported runtimes, or implementation examples, so the operational depth of the project remains to be established.

After testing, ASAGO is intended to recommend mitigations such as safety guardrails and produce deployment-ready configurations. Red Hat also describes a continuous audit trail linking individual policy clauses to tests and runtime controls. For product teams, that traceability could reduce the manual work required to show how a production system addresses a governance requirement.

An open source project, not a finished compliance solution

Microsoft, IBM Research, the Alan Turing Institute, Brave Software, and other organizations have provided early backing, according to Red Hat. That gives the project a broader starting constituency than a single-vendor compliance tool, but participation does not by itself establish maturity, coverage, or regulatory acceptance.

The useful decision rule for builders is to treat ASAGO as a possible governance automation layer, not as proof that an AI system is compliant or safe. Teams will still need to define their risks, validate generated tests, review mitigations, and monitor behavior after deployment. The project’s strongest promise is reducing the distance between an AI policy and an engineer’s implementation task. Whether it does that reliably will depend on the technical details that are not yet described in the supplied material.