What FedRAMP expects.
What an AI Actor brings.
Federal civilian agencies adopting AI in consequential decisions need cloud services that meet the Federal Risk and Authorization Management Program baseline. The record an agent produces about itself is structurally insufficient under the audit and accountability controls FedRAMP expects. That gap is what an AI Actor exists to close, federal-side as well.
A short framing
FedRAMP, briefly.
The Federal Risk and Authorization Management Program is the standardised federal-government approach to assessing cloud services. Established by OMB Memorandum M-11-29 in 2011 and codified by the FedRAMP Authorization Act in 2022, it provides a single, consistent baseline of security controls that cloud service providers (CSPs) implement and a single authorisation path agencies reuse rather than each running their own assessment.
FedRAMP has three impact-level baselines aligned to FIPS 199: Low, Moderate, and High. The baselines are defined as profiles of NIST SP 800-53 controls, with Moderate the most common authorisation level for federal-civilian SaaS systems handling Controlled Unclassified Information (CUI).
A CSP can pursue two authorisation paths. A Provisional ATO (P-ATO) from the FedRAMP Joint Authorization Board (JAB, composed of CIOs from DoD, DHS, and GSA) authorises the service for government-wide use. An Agency ATO is granted by a sponsoring agency for use within that agency, and can be reused by other agencies through the FedRAMP marketplace. Both paths require working with a Third-Party Assessment Organisation (3PAO) to produce a Security Assessment Report.
AI services used in federal decisions sit inside the same framework. OMB Memorandum M-24-10 directs federal agencies to inventory their AI use cases and apply enhanced safeguards for AI affecting rights or safety — including, explicitly, audit-trail and explainability obligations. The agent's own logs do not satisfy those obligations.
Relevant control families
AU and AC, first-class.
FedRAMP's audit-and-accountability and access-control families are the ones the Actor was designed to serve.
AU — Audit and Accountability
NIST SP 800-53 AU-2 (event logging), AU-3 (content of audit records), AU-6 (audit review, analysis, and reporting), AU-9 (protection of audit information), AU-10 (non-repudiation), and AU-12 (audit record generation) collectively describe the surface the Witness, Historian, and Custodian records were built for. Hash-chained, append-only records satisfy the integrity and non-repudiation expectations directly.
AC — Access Control
AC-2 (account management), AC-3 (access enforcement), AC-5 (separation of duties), and AC-6 (least privilege) map to the workspace permission model and the auditor read-only role offered at the Team and Scale tiers. Custodian records every access to the records themselves, satisfying AC-2(4) automated audit actions and AU-2 audit events tied to access.
SI — System and Information Integrity
SI-4 (system monitoring) and SI-7 (software, firmware, and information integrity) align with the hash-chain record format and the Tops parallel ledger that watches Trustvice's own infrastructure operations on each workspace.
Roadmap posture
What the FedRAMP-aligned workspace will offer.
The list below describes the eventual shape of the FedRAMP-aligned Trustvice deployment. None of these items are generally available today. The page does not state a timeframe; it states a destination.
FedRAMP Moderate as the target baseline.
The Moderate impact level is the most common procurement floor for federal-civilian SaaS handling CUI. Trustvice's roadmap targets Moderate as the first authorisation. High is not currently on the roadmap; Low is below the practical floor for most agency use cases.
Authorisation path: Agency ATO first.
An Agency ATO with a sponsoring civilian agency is faster to reach than a JAB P-ATO and is reusable across the federal marketplace. The Trustvice roadmap pursues an Agency ATO path as the first authorisation, with JAB P-ATO as an option once federal customer volume justifies it.
NIST SP 800-53 control mapping.
A formal control implementation summary mapping every applicable AU, AC, SI, IA, CM, and SC control to the specific Trustvice technical or procedural implementation. The deliverable is the System Security Plan (SSP) submitted to the sponsoring 3PAO.
FIPS 140-validated cryptography end-to-end.
All cryptography in the FedRAMP-aligned deployment path will use FIPS 140-2 or FIPS 140-3 validated modules. The hash-chain record format already uses primitives compatible with this profile; the deployment path enforces validated implementations of them.
Deployment in a FedRAMP-authorised cloud.
The FedRAMP-aligned Trustvice workspace deploys inside a FedRAMP-authorised hosting environment rather than the standard commercial Cloudflare D1 / Amazon Web Services RDS path. Subprocessor list, regions, and CSP authorisation packages are documented and made available to authorising-agency reviewers.
Continuous monitoring & ConMon reporting.
FedRAMP requires monthly continuous-monitoring deliverables — vulnerability scans, plan-of-action items, incident-response artefacts — submitted to the sponsoring agency. The Custodian and Tops records reduce the effort of producing those deliverables because the underlying activity log is the same data the agency reviewer already needs.
Current status — honest version
Trustvice is not currently FedRAMP-authorised at any impact level. The standard commercial workspace runs on the public Cloudflare and Amazon Web Services RDS footprint and is not appropriate for federal CUI handling. Agencies evaluating Trustvice for federal AI use cases today should plan around a future Agency-ATO deployment path, not the current commercial path. The page above describes the destination, not the present.
Stay in the loop
Be the first to know when it opens.
Leave your email and we will reach out when the FedRAMP-aligned workspace tier becomes generally available. Double opt-in — you will receive a confirmation email before being added to the notification list, and no other marketing will be sent to this address.
This page is informational and does not represent a current FedRAMP authorisation. The page describes Trustvice's roadmap posture and how the Actor architecture maps to FedRAMP control families. Agencies should consult their own authorising official and the FedRAMP marketplace before making procurement decisions. Legal.
Trustvice 360Declare the rules. Have every run checked.
Agents, evidence, governance, commerce and disclosure are all in Trustvice 360. Sign up free and open every suite from one dashboard.
