Markovian Protocol / NIST AI RMF and OMB M-24-10

Evidence that holds up under the NIST AI RMF.

The NIST AI Risk Management Framework asks organizations to document how they govern AI and to keep the evidence. OMB M-24-10 asks federal agencies to inventory their AI and maintain records of it. In an audit, the question is simple: which model processed which data, under which policy, and when. That answer is only as good as the record behind it.

The requirement

Document the governance, and keep the evidence

The NIST AI Risk Management Framework (AI 100-1) is a voluntary framework built on four functions: Govern, Map, Measure, and Manage. Across them, an organization is expected to document its AI governance and retain the records that demonstrate it, from policy version history and reviewer identities under Govern, to the monitoring and outcome records under Measure and Manage. OMB Memorandum M-24-10 directs federal agencies to maintain AI use-case inventories and minimum risk practices, consistent with the framework.

None of this is satisfied by a claim. It is satisfied by evidence, and evidence is only worth what its integrity is worth.

The gap

Evidence you control is evidence you could have edited

Governance records, decision logs, and use-case inventories live in the organization's own systems. An auditor, or an agency inspector general, is asked to accept them as accurate and contemporaneous. But a record kept in a store you control can be backfilled or revised, and nothing in the record itself proves otherwise. The hardest evidentiary bar, showing the record has not changed since it was written, is exactly where operator-controlled records are weakest.

The mechanism

Anchor the evidence to a log outside your control

Each governance or decision record is hash-chained, and the head of the chain is written as a leaf into a public transparency log at log.markovianprotocol.com, an append-only log outside the organization's control. Seven independent witnesses, including Geomys and Google's transparency.dev witnesses, cosign the log checkpoint hourly, and checkpoints are anchored to Bitcoin via OpenTimestamps. A reviewer recomputes the chain from the records, which needs nobody, and checks inclusion of the head in the witnessed log from public endpoints. Once the checkpoint is anchored to Bitcoin, the record is checkable against the Bitcoin blockchain, independent of Markovian.

Edit any historical record and the chain breaks. This does not write your governance for you, it turns the evidence you already keep into evidence that was demonstrably not created after the fact, and that a third party can check without trusting you.

What it covers

What the anchor provides, and what stays yours

NIST AI RMF and OMB M-24-10

Governing, mapping, measuring, managingOrganization, your program

Producing the documentation and inventoriesOrganization

RetentionOrganization

Evidence not altered, not backfilledHash chain, head in the witnessed transparency log

Which model, which data, which policy, whenBound into the record and time-anchored

Independent check for an auditor or IGRecompute locally, check inclusion in the public log

Scope

The NIST AI RMF is a voluntary framework, and OMB M-24-10 binds federal agencies. Markovian is neither a governance program nor the framework itself, and this is not legal advice. What Markovian provides is narrow: it makes the evidence behind your AI governance tamper-evident and independently verifiable, so it holds up when someone asks whether it was written when you say it was.

Talk to us See it work