Laurent Giraid has spent the better part of the last decade navigating the complex intersection of cutting-edge technology and digital ethics. As a seasoned technologist with a focus on machine learning and natural language processing, he has watched the industry oscillate between breakneck innovation and the sudden, often jarring realization that these systems require guardrails. He understands that for many enterprises, the “move fast and break things” era has been replaced by a “move fast but don’t get sued” reality, especially with the looming implementation of the EU AI Act. In our conversation, Giraid explores the asago project—a collaborative, open-source initiative led by Red Hat, NVIDIA, and IBM—that promises to bridge the cavernous gap between high-level corporate policy and the actual deployment of AI agents in production environments. We discuss the transition from manual, tedious compliance reviews to automated, audit-ready workflows that aim to turn abstract governance into functional, declarative code.
The industry seems to be reaching a breaking point where organizations must choose between stifling their own innovation through slow manual reviews or risking the deployment of ungoverned AI agents. How does the asago project change this dynamic for a modern engineering team?
The tension you’re describing is very real and, frankly, quite exhausting for teams on the ground. Right now, most companies are stuck in a bottleneck where every single AI model or agent has to pass through a gauntlet of manual cross-referencing against internal policies and international regulations. It’s a process that can take months, and by the time you’re cleared for launch, the market has often moved on. What Red Hat and its partners are doing with asago is creating a way to stop viewing governance as a speed bump and start seeing it as a paved road. By automating the workflow that connects these fragmented steps, they are offering a path where agents can run in production with their behavior constantly checked against policy in real-time. This isn’t just about speed; it’s about the peace of mind that comes from knowing you aren’t letting “wild” agents operate without any oversight. It transforms the “innovation versus safety” trade-off into a singular, unified engineering pipeline.
Could you walk us through the specific technical journey a policy takes within this framework, from the moment a text-based regulation is uploaded to the point where it becomes a functioning control?
The process is actually quite elegant and structured across four distinct stages to ensure nothing falls through the cracks. It starts with risk mapping, where the framework reads the uploaded policy and automatically matches those requirements against established industry standards like the NIST AI Risk Management Framework, the OWASP LLM Top 10, or the EU AI Act via IBM’s AI Risk Atlas. Once that risk profile is generated, the system moves into a specialized risk assessment phase. Instead of just running through a generic, one-size-fits-all checklist, asago generates scenarios specifically tailored to that use case to probe for the exact harmful behaviors flagged during mapping. From there, we enter risk mitigation, where the system recommends specific guardrails and, crucially, builds a rationale trail to justify those choices to any future human reviewer. Finally, it orchestrates these controls into deployment-ready configurations for Kubernetes or hybrid cloud environments. It’s a complete transformation of policy into declarative code that can be managed just like any other part of the software stack.
With a roster of contributors that includes rivals like Microsoft and IBM, alongside academic giants like MIT and the Alan Turing Institute, what does this level of collaboration tell us about the current state of AI safety?
It tells us that the industry has collectively realized that AI safety is a “wicked problem” that no single vendor can solve in a vacuum. When you see Microsoft, IBM, and NVIDIA sitting at the same table under an Apache License 2.0, it’s a signal that safety is being treated as a foundational infrastructure requirement rather than a competitive feature. There is a shared understanding that if the public or regulators lose trust in AI because of a few high-profile, ungoverned failures, the entire ecosystem suffers. The inclusion of academic voices from places like North Carolina State University and Austria’s Interdisciplinary Transformation University adds a layer of objective rigor that you might not get from a purely commercial endeavor. They are framing AI safety as an engineering problem that requires a diverse range of viewpoints from global jurisdictions. This collaborative effort is about building a universal “safety language” that works across different clouds and different countries.
The concept of an “audit-trail-as-a-product” is central to this project. Why is the ability to trace a live control back to a specific policy clause so revolutionary for enterprise compliance?
In the traditional model, compliance is often a one-off certification—you get a stamp of approval at the start, and then you hope nothing changes as the system runs. But AI agents are dynamic; they interact with data and users in ways that can evolve. The “audit-trail-as-a-product” approach moves us toward a model of continuous enterprise utility. Every single active control in a live deployment is tied directly to a specific test, and that test is tied back to the exact policy line that justified its existence. If a regulator walks into your office and asks why a certain guardrail is in place, you don’t have to go digging through old emails or PDF reports. You can literally trace the logic through a single, continuous trail from the running code back to the EU AI Act or your internal corporate charter. This level of transparency is what turns a “black box” deployment into a transparent, auditable asset that can survive the highest levels of institutional scrutiny.
Red Hat claims that asago can cut deployment timelines from months to days by using infrastructure-agnostic outputs. How does using tools like Kubernetes, Terraform, and Ansible achieve this level of efficiency?
The real magic happens when you remove the manual infrastructure coding that usually sits between a “recommendation” and a “running control.” Normally, after a compliance team tells you what needs to be done, an engineer has to figure out how to write the specific code to enforce that in their particular cloud environment. Asago skips that manual step by generating declarative configurations for tools like Kubernetes, Terraform, and Ansible. These are the languages that modern cloud infrastructure already speaks. Because these outputs are infrastructure-agnostic, a safety posture you define for one cloud environment can be applied to another without needing a total re-engineering effort. You’re essentially treating AI safety as “configuration-as-code,” which allows you to move at the speed of DevOps. When you can automate the link between policy and production, you eliminate those weeks of back-and-forth between the legal team and the engineering department.
Given that the project is still in its formation phase and hasn’t been production-tested in a live regulatory audit yet, what are the primary challenges or disputes you expect to see as it moves toward maturity?
The road ahead is certainly going to be bumpy because we are essentially trying to code morality and law into software. One major challenge will be how the community resolves disputes over risk-mapping standards—different organizations may have very different interpretations of what a “high-risk” scenario looks like under the EU AI Act. There is also the reality that we haven’t seen a “days, not months” claim hold up under the pressure of a real-world audit yet. We need to see how these automated rationales actually hold up when a human regulator starts poking holes in them. Furthermore, as the project exists primarily as a GitHub repository right now, the transition from an experimental community project to a battle-tested enterprise product will require a lot of rigorous, real-world stress testing. The lack of a concrete customer case study means we are still in the “trust but verify” stage of this technology’s lifecycle, and the contributors will need to prove that this automation doesn’t lead to a “checkbox” mentality that ignores nuanced risks.
What is your forecast for the future of automated AI governance?
I believe that within the next three to five years, manual AI policy review will become an obsolete practice for any organization operating at scale. We are moving toward a future where “Governance-as-Code” is the default standard, and frameworks like asago will serve as the backbone for a global, interoperable safety layer. As autonomous agents become more integrated into our financial, medical, and legal systems, the demand for real-time, auditable guardrails will only intensify. We will likely see a shift where regulators themselves begin to provide “compliance APIs” that plug directly into these types of open-source workflows. The companies that embrace this automation now will not only move faster but will also be the only ones capable of managing the sheer complexity of the multi-jurisdictional regulatory landscape that is currently forming. Safety will no longer be an afterthought; it will be the very infrastructure that makes AI innovation possible in a civilized society.
