Control Library

Governance → Control Library lists the controls in the AI governance frameworks FYAI ships — NIST AI Risk Management Framework 1.0 and ISO/IEC 42001:2023 — and gives each one a status computed from evidence: policy decisions, conformance runs, the risk registry, attestations, and facts about individual agents, teams and functions. A status is never just asserted by a document, and a control that nothing evidences shows as a gap rather than a blank.

Action	Role needed
View frameworks, controls, statuses and evidence	Viewer and above
Load the shipped catalogues, Refresh catalogues	Admin
Bind a control profile, add, edit or remove entity bindings	Admin

Load the catalogues

A new project has no controls until the catalogues are loaded. If the page says No controls yet:

1. As a project Admin, click Load the shipped catalogues.
2. The page confirms how many frameworks and controls were loaded and how many bindings were added.

Loading is safe to repeat. Once loaded, Refresh catalogues re-applies the shipped catalogues to pick up FYAI's updates; it never touches a binding you authored or edited.

Some controls are bound to platform evidence when loaded. Many are organisational — they can only ever be evidenced manually by a named owner — and some are deliberately left unbound because no honest platform evidence exists for them. Those show as Not covered.

Read the library

Choose a Framework, a Window (Last 30 days, Last quarter or Last year) and optionally a Status. Filters are kept in the page URL.

Coverage

Three counts summarise the framework for the window — never a single percentage:

• Automatically evidenced — controls whose status comes from platform evidence (Operating, Degraded or No evidence).
• Manual — controls evidenced only by a document or an assertion with a named owner.
• Not covered — controls nothing binds to evidence.

If no policy decisions at all were recorded in the window, a warning says every automated status is measuring nothing — usually because decision recording isn't running in the environment. If allow decisions are sampled, the page says statuses rest on a floor rather than a total.

Statuses

Controls are grouped by the framework's own structure (NIST functions, ISO Annex A sections). Each row shows the Control ID, Title, Status and what it's Evidenced by.

Status	Meaning
Operating	Evidence in this window shows the control ran and held.
Degraded	The control was reached and didn't hold — a fail-open, a timeout, or an unavailable engine.
No evidence	Nothing in this window evidences the control. That may mean nothing attempted what it refuses, so read it beside the decision count.
Not covered	Nothing binds this control to evidence. It can never reach a passing state, and that's a finding.
Manual	Evidenced by a document or an assertion with a named owner, not by platform enforcement.

When a control has several bindings, its status is the worst of its automated bindings (Degraded, then No evidence, then Operating). A control with only manual bindings is Manual. A sampled chip means its evidence came from sampled decisions; review due means a manual review date has passed.

Evidenced by shows the number of bindings, "N on specific entities" if the only bindings are written against individual agents, teams or functions, or nothing.

Control detail

Click a control to open it:

• The obligation — the requirement. For NIST controls this is FYAI's own summary, not NIST's published text. ISO/IEC 42001 text is copyrighted and isn't reproduced: you see the identifier and control name, and should read the obligation in your licensed copy.
• What evidences it — one card per binding, with its own status and evidence. Policy-decision bindings have Open these decisions, which opens the Policy decisions trail filtered to that reason code and window. Conformance bindings have Open the conformance runs.
• Evidence about one entity — visible to Admins only (others see "Bindings are read-only for your role"). See below.

Evidence kinds

Evidence	Label	Status rule
Policy decisions	Policy decisions	Degraded if any matching decision is one where the control didn't hold; Operating if any matching decisions exist in the window; otherwise No evidence.
Conformance case	Conformance case	Operating if the case passed in the window; Degraded if it couldn't run; No evidence if it failed or didn't run in the window.
Risk registry ratio	Risk registry	One of two measures: the proportion of agents, teams and functions with a reviewed risk classification, or the proportion with a named risk owner. Operating at 100%; Degraded below that; No evidence at 1% or less.
Attestation	Attestation	Operating if signed attestations exist for the subject type and the attestation chain verifies; Degraded if the chain doesn't verify; otherwise No evidence.
Manual	Manual	Always Manual, with an owner, a review-due date and notes.
Risk review of one entity	Risk review	Whether the entity's risk classification is set, reviewed and current. Checks: Owner named, No pin against tier (Degraded if an approval pin works against the entity's risk tier).
Evaluation of one entity	Evaluation gate	Agents and teams only. No evidence if there are no test cases, any are failing or never run; Degraded if results are stale; otherwise Operating.
Topology of one entity	Topology assessment	From the entity's topology assessment. Check: Declared operations — the external parties it reaches are the operations its tools declare, and none it reaches directly.
Identity of one entity	Identity	Whether the agent has a provisioned gateway identity. Check: Kill switch — whether a kill switch is available for it.

Only policy-decision evidence can be narrowed to one entity. Conformance cases, registry ratios and attestations are estate-wide; they're labelled that way on entity pages rather than presented as if someone tested that agent.

Bind evidence to a specific entity

Admins can write bindings that apply to one agent, team or function — for example, "this high-risk agent must have a named owner and passing evaluations".

One binding

1. Open a control and, under Evidence about one entity, click Add entity binding.
2. Choose the Kind (agent, team or function) and the Entity.
3. Choose the Evidence: Risk review, Evaluation gate, Topology assessment or Identity.
4. If offered, choose a Check, or Whole predicate to evaluate everything.
5. Add Notes if useful and click Save binding.

Existing entity bindings are listed with edit and remove buttons.

A control profile

A control profile is a named set of entity bindings applied in one step. The shipped catalogues include High-risk agent baseline, for any agent rated high or critical: a reviewed rating with a named owner and no pin against its tier, passing and current evaluations, a clean topology with declared operations, and a provisioned identity with a kill switch. You may also see Platform blueprint baseline, which applies only to FYAI's published blueprints.

1. Click Bind a control profile at the top of the library (or Bind a profile on an entity's Controls tab).
2. Choose the Profile — the dialog says what it applies to — and, from the library, the Kind and Entity.
3. Click Bind profile. The page reports how many bindings were added, already in place, or removed.

Binding the same profile again converges rather than duplicating.

The Controls tab on agents, teams and functions

Every agent, team and function has a Controls tab answering "is this thing governed?" with the same controls and evaluator, narrowed to that entity:

• A Window selector and the number of policy decisions about the entity in that window. If there were none, a note explains that "no evidence" means the control wasn't exercised, not that it failed.
• The Control profiles bound to it. Admins can Bind a profile and remove a profile from its chip.
• Counts by status.
• About this agent (or team, function) — controls with evidence about this entity.
• Estate-wide evidence — controls whose evidence wasn't measured against this entity in particular.
• If any controls in your frameworks are bound to no evidence at all, a warning with Open the library. That's a gap in the library, not a finding about this entity, so those controls aren't listed on the tab.

Related

• Policy
• Assurance pack — includes control coverage per framework
• Governance API — attestations, which some controls are bound to