Framework preset sources and credit
This page credits the source of the framework presets, gives each framework’s notice, and lists the fields the API returns for them. To use a preset, see Start from a framework preset.
Credit
Section titled “Credit”OpenLatch drafts Intent Policies from the agent-execution content of the FINOS AI Governance Framework, and you ratify them.
Drawn from the FINOS AI Governance Framework (Copyright 2025 FINOS, CC BY 4.0, provided as is), adapted by OpenLatch. Not affiliated with or endorsed by FINOS.
| Link | Address |
|---|---|
| Framework | air-governance-framework.finos.org |
| GitHub | github.com/finos/ai-governance-framework |
| License | Creative Commons Attribution 4.0 International |
OpenLatch changed the material: it selected the content that bears on an agent’s actions, wrote each Intent Policy as a sentence in its own words, and attached the framework items it relates to.
A refresh of a framework preset follows the FINOS catalog, not the framework’s own text. The source of a framework preset names the catalog commit it was written from, and an AIP keeps the citation it was ratified with. Start from a framework preset says what a change reaches.
Notice for each framework
Section titled “Notice for each framework”| Framework preset | Notice |
|---|---|
| Agent Threat Rules | Agent Threat Rules is MIT licensed by its contributors. |
| EU AI Act | None |
| FFIEC IT Handbook | None |
| IOSCO Supervisory Toolkit | None |
| ISO/IEC 42001:2023 | Not affiliated with or endorsed by ISO or IEC. Using this preset is not certification. |
| NIST AI 600-1 | None |
| NIST SP 800-53 Rev. 5 | None |
| OWASP Machine Learning Security Top Ten | Not affiliated with or endorsed by the OWASP Foundation. |
| OWASP Top 10 for Agentic Applications | Not affiliated with or endorsed by the OWASP Foundation. |
| OWASP Top 10 for LLM Applications | Not affiliated with or endorsed by the OWASP Foundation. |
For ISO/IEC 42001:2023, the Framework items column shows each control’s number with a short topic in OpenLatch’s own words.
Fields in the API
Section titled “Fields in the API”The public API returns these fields on GET /api/public/v1/policy-presets, which needs the presets:read scope. They are additive: no existing field changes.
| Field | Where | What it holds |
|---|---|---|
framework | Each preset | Set on a framework preset, null on every other |
source | In framework | The framework’s name and links, its license, the pinned commit and its date |
notice | In framework | The notice from the table above, or null |
default_selected | Each preset | False for a framework preset |
citation | Each rule | What the rule cites, null outside a framework preset |
items | In citation | The framework items the rule serves: key, label and url |
entries | In citation | The FINOS mitigations the rule is written from, each with id, title and url, and the risk it was reached through in via |
Draft and AIP reads carry the citation too:
| Field | Where | What it holds |
|---|---|---|
citation | Each intent policy of a draft or an AIP | The citation the intent policy kept, with source_commit, source_date, source_sentence and license_url |
edited | In citation | True while the sentence differs from source_sentence |
mode_advice | A draft | The Monitor line for a draft newly made from a framework preset, null otherwise |
from_framework_preset | A draft | True when an intent policy of the draft holds a citation |
Treat label, title and url as third-party text. OpenLatch writes citation itself: no request sets it.