How we recommend aligning your private AI with the NIST AI Risk Management Framework.

# The policy file IS the enforcement — the document is generated from it
policy:
  version: 1.4
  owner: "COO"
  review_cycle: quarterly
  renders_to: /var/hermes/ai-policy.md   # the readable version
guardrails:
  mode: enforced          # enforced | advisory
  approvals: sensitive     # every | sensitive | none

# Every role is owned by a person, and scopes what the AI may do
roles:
  - name: legal-reader
    owner: "j.doe@firm.example"     # accountable human
    may: [read_file, search_docs]
  - name: ops-editor
    owner: "m.ruiz@firm.example"
    may: [read_file, write_file]
    approvals: every              # stricter than the default
require_owner: true                 # unowned role = refuses to load

# Post-turn verification, surfaced to the user — not silently logged
guardrails:
  reality_check: true
  surface_warnings: user      # user | log-only
feedback:
  flag_action: enabled          # one keystroke files an incident
  incidents: /var/hermes/incidents/

# Local model, pinned by digest; no external inference path at all
model:
  source: local
  name: qwen3-35b
  digest: sha256:9f2c4b…      # pinned — a change needs approval
network:
  egress: deny                  # default-deny, not default-allow
  allow: []                   # no model API, no telemetry endpoint

# Declared purpose, enforced as scope
deployment:
  purpose: "Draft and review internal legal documents"
  setting: "12-person firm, on-premises, no client PII export"
  in_scope:     [draft, summarize, search_internal]
  out_of_scope: [client_advice, external_publishing, hiring_decisions]
  on_out_of_scope: refuse_and_log

# Generated from live config — cannot drift from what is running
system_card:
  task: "retrieval-grounded drafting and summarization"
  method: "local LLM + local document index; no fine-tuning on client data"
  knowledge_cutoff: "2025-10"
  cannot: ["access the internet",
           "act without an approval for file changes",
           "see documents outside the granted role scope"]

# Capability = allow-list. Absent means unavailable, not merely discouraged.
tools:
  read_file:   {benefit: "find precedent fast",     roles: [legal-reader, ops-editor]}
  search_docs: {benefit: "answer from our own files", roles: [legal-reader, ops-editor]}
  write_file:  {benefit: "produce the first draft",  roles: [ops-editor], approval: required}
default: deny

# Every reachable component carries a risk note and an owner
components:
  - service: private-ai
    risk: "generates text that may be wrong or over-confident"
    control: reality_check + approvals
    owner: "COO"
  - service: docs-index
    risk: "contains client-confidential matter files"
    control: role scope + Ziti dial policy
    owner: "Managing Partner"
  - service: tool-runner
    risk: "performs actions with side effects"
    control: approval gate (every)
    owner: "COO"
inventory_check: strict   # unmapped service = reported gap

# Metrics computed locally from the audit log — nothing leaves the box
metrics:
  - {id: refusal_rate,       source: audit, window: 30d}
  - {id: approval_hit_rate,  source: audit, window: 30d}
  - {id: reality_check_rate, source: audit, window: 30d}
  - {id: grounded_rate,      source: audit, window: 30d}
report_to: /var/hermes/metrics/   # local file, not a cloud endpoint

# Evaluation gates the change — it does not merely describe it
eval:
  suite: /var/hermes/eval/firm-cases.yaml   # your documents, your tasks
  run_on: [model_change, guardrail_change, index_rebuild]
  thresholds:
    grounded_rate:   ">= 0.90"
    unsafe_refusal:  ">= 0.98"   # refuses what it should refuse
    regression_vs_last: "<= 0.02"
  on_fail: block_rollout

# Each risk names the metric that watches it and the level that trips
risks:
  - id: R1
    desc: "AI states something it did not do"
    watched_by: reality_check_rate
    trips_above: 0.01
    owner: COO
  - id: R2
    desc: "answers not grounded in our documents"
    watched_by: grounded_rate
    trips_below: 0.90
    owner: COO
  - id: R3
    desc: "scope creep into out-of-scope tasks"
    watched_by: refusal_rate
    trips_above: 0.10
    owner: "Managing Partner"

# Severity chooses the control strength — high risk gets a hard stop
responses:
  - {risk: R1, severity: high,   action: block}     # refuse to return the turn
  - {risk: R2, severity: medium, action: approve}   # pause for a human
  - {risk: R3, severity: low,    action: warn}      # advisory only
unhandled_risk: block   # a risk with no response fails closed

# Ungoverned operation is not a degraded mode — it is a stopped one
failure:
  mode: closed              # no guardrails => no service
  on_config_unreadable: refuse_all
kill_switch:
  command: "hermes stop --hard"   # drops Ziti bind + unloads model
decommission:
  index: wipe
  audit_log: "retain 7y"
  model: remove

# A model change is a governed change — never a silent one
supply_chain:
  pin: strict                # digest must match the manifest
  allow_unsigned: false
  change_requires: [approval, eval_pass]
  manifest: /etc/hermes/manifest.lock

# Monthly report generated on the box, from the record itself
reporting:
  cadence: monthly
  path: /var/hermes/reports/
  includes: [metrics, risk_status, incidents, approvals, config_changes]
  distribute_to: ["COO", "Managing Partner"]   # the comms plan
audit:
  enabled: true
  path: /var/hermes/audit.log        # stays on the appliance