Agent identity
Passport planning records identify the AI Worker, human owner, purpose, lifecycle state, approved scope, data boundary, and review expectations.
Defense & Government
CMMC evidence readiness for governed AI workers.
Defense and government programs need more than AI inventory. They need clear human ownership, scoped authority, review gates, and evidence records that can help reconstruct how AI-supported work was reviewed, constrained, and escalated.
Why this belongs in Solutions
CMMC is an evidence problem as much as a control-mapping problem.
The DoD CMMC program and NIST SP 800-171 place attention on protecting Federal Contract Information and Controlled Unclassified Information in nonfederal systems. For AI workers, the practical planning question is: who owns the worker, what may it access or do, when must a human review, and what evidence exists for the decision?
Review gates
Toll Gate planning records define when access, data movement, external communication, workflow state change, or high-impact output should be blocked, limited, or escalated.
Evidence trail
Stamp and Evidence Record planning helps teams preserve review decisions, source references, limitations, missing evidence, and follow-up actions without storing raw secrets or regulated content in public flows.
This page is a readiness orientation. It does not provide legal advice, CMMC certification, DoD approval, FedRAMP status, assessment results, security authorization, audit opinion, or production authorization.
Evidence questions
What a governed AI Worker record should help answer.
- Which human owner is accountable for the AI Worker purpose, scope, and lifecycle?
- What Federal Contract Information, Controlled Unclassified Information, regulated data, or sensitive operational context is in scope or explicitly out of scope?
- Which tools, APIs, connectors, systems, or destinations may the AI Worker request access to?
- Which actions require human review before the work proceeds?
- What evidence shows that a requested action was allowed, denied, blocked, limited, escalated, or deferred?
- What must be suspended, revoked, remediated, or reviewed again when evidence, ownership, scope, or authority changes?
Planning path
Use CMMC as the industry entry point, then move to review-ready artifacts.
1. Identify the AI Worker surface
List candidate AI Workers, owners, systems touched, data classes, model/provider context, and external communication paths.
2. Draft Passport boundaries
Capture purpose, approved support activities, prohibited actions, human review expectations, lifecycle posture, and evidence needs.
3. Map review gates
Define where Toll Gates should block, limit, require evidence, or require human review before sensitive action proceeds.
4. Prepare evidence package
Organize Stamps, Evidence Records, review notes, source references, redaction state, and missing-evidence items for customer-owner review.