Asago is an open source Red Hat project that automates AI governance from policy to production, delivering auditable, traceable workflows and safer, production-ready AI systems.

Contributors include Alquimia AI, the EvalEval coalition, the Interdisciplinary Transformation University Austria, and other industry, academic, and government partners.

The framework maps governance policies to risk frameworks such as the NIST AI RMF, OWASP LLM Top 10, and the EU AI Act via the IBM AI Risk Atlas, then generates scenario-based tests, recommends guardrails, and orchestrates controls for deployment environments like hybrid cloud and Kubernetes.

A risk assessment component creates and executes use-case specific safety testing scenarios targeting identified risks.

Risk mitigation provides recommended guardrails and an auditable rationale for review.

There is rising concern about AI safety and agent-related security incidents, underscoring the need for robust guardrails as AI agents scale.

The initiative aims to reduce delays and errors from manual policy interpretation and cross-team handoffs, enabling auditors to trace active production controls to exact policy clauses with supporting evidence.

In the second stage, asago will generate and run safety tests tailored to specific use cases, propose mitigations and guardrails, and document the rationale for these decisions.

The initiative addresses the gap between policy and production, seeking to prevent delays in innovation and reduce shadow deployments by providing a single open standard for compliance teams, data scientists, and infrastructure admins.

It also responds to regulatory developments like the EU AI Act by offering a unified open standard that aligns policy with production engineering to prevent stalled innovation.

Asago aims to cut deployment time from months to days and provide a single audit trail for policy officers, developers, engineers, and auditors.

Red Hat emphasizes the need for clear operational guardrails as organizations move from pilots to autonomous agents, framing governance as critical infrastructure.