By Sixty-four percent of enterprises have AI deployed in production. Only 26% have governance frameworks keeping pace. That gap is not an accident — it’s the predictable result of asking legal teams to write policy documents and then asking engineers to manually translate them into guardrails, one slow, expensive cycle at a time. Red Hat’s newly open-sourced asago (AI Safety And Governance Orchestration) takes aim at that exact problem: upload your governance policy, and the pipeline outputs the Kubernetes configurations to enforce it.
What asago Actually Does
The project runs four stages. First, it parses your organization’s AI governance policy and maps each requirement to established frameworks — the NIST AI Risk Management Framework, the OWASP LLM Top 10 2026, and the EU AI Act — using IBM’s AI Risk Atlas as the ontology layer. That gives you a structured risk inventory for your specific use case, not a generic checklist.
Second, asago generates and executes safety tests tailored to those identified risks. The tests are use-case-specific, not the generic benchmark suite most governance tools rely on. It probes the actual behaviors — prompt injection, excessive agency, hallucination under adversarial inputs — that are likely to matter for your deployment.
Third, it recommends guardrails and records the full rationale: which policy clause triggered which test, which test found which risk, which control addresses it. That audit trail is exactly what EU AI Act auditors want to see and what most enterprise deployments currently cannot produce.
Fourth, it outputs deployment-ready configurations: Kubernetes custom resources, ConfigMaps, Terraform modules, Ansible playbooks. Not a PDF report. Not a compliance dashboard. Infrastructure artifacts that a platform engineer can actually apply to a cluster.
Why This Week
The timing is not coincidental. The EU AI Act’s high-risk AI system obligations came into force on August 2, 2026 — six days before asago launched. Penalties reach €35 million or 7% of global annual revenue, higher than GDPR’s caps. OWASP dropped its LLM Top 10 2026 on August 6, formalizing the threat model that asago’s testing stage is built to cover.
The numbers behind the urgency are not comfortable. Eighty-eight percent of enterprises reported an AI agent security incident in the past year. In an independent 2026 audit of enterprise AI agent deployments, 14 of 16 lacked the per-tool, per-tenant audit log granularity required for EU AI Act high-risk systems. Manual AI governance implementations typically take 12 to 18 months and cost $500,000 to $1.5 million for the first production-ready system. Red Hat claims asago brings that to “days” — a number that needs case studies to back it, but the direction is right.
Honest Status: This Is Not Production-Ready
asago is in project formation phase. The GitHub repository is open; a working pipeline does not exist yet. The announcement is an architecture proposal and a community call, not a shipping product.
That’s worth saying plainly because the partner list — IBM Research, NVIDIA, Microsoft, MIT Lincoln Laboratory, NC State University, The Alan Turing Institute — can make a formation-phase project sound like finished software. It isn’t. The real test is whether those partners contribute working code rather than just attaching their logos to a press release. Watch the GitHub commit velocity over the next 90 days.
There’s also a substantive design question. Gartner warned in May that applying uniform governance across all AI agents will lead to failure. Governance requirements for a content summarization agent and an autonomous code-deploying agent are not the same. Whether asago’s pipeline handles that differentiation — or defaults to uniform policy application — is an open question the project hasn’t fully addressed yet.
Why Existing Tools Don’t Fill This Gap
The current enterprise AI governance market — IBM watsonx.governance, ModelOp, Vanta, Scrut — does compliance tracking and reporting. These tools answer “are we compliant?” They don’t answer “here are the Kubernetes CRDs to become compliant.” That’s the gap asago is targeting: infrastructure-native output that speaks platform engineer, not compliance officer.
Apache-licensed, policy-parsed, and Kubernetes-native. If it ships a working pipeline, asago will be the first open-source tool that makes AI governance reproducible and machine-auditable at the infrastructure layer. That’s worth following — even if right now it’s more manifesto than product.
The repository is available on GitHub. If you’re deploying AI agents at scale and haven’t started your governance pipeline yet, asago is the kind of project you want to star and revisit in Q4.
