Federal AI Identity Governance
Applying identity governance to the M-25-21 AI Use Case Inventory — a standalone kit and an FMP-governed path
Federal AI Identity Governance
Federal agencies have deployed over 1,800 AI systems under OMB M-25-21 — and almost none of those systems are governed at the identity layer. No organizational placement. No owned credential. No lifecycle process. This kit closes that gap.
It is runnable two ways:
- a manual path — a standalone agency runbook that applies M-25-21 identity governance without any external control plane; and
- a the Federal Modernization Program-governed path — the same outcome, with every AI system’s identity record bound to the drift engine and the ATO reciprocity model.
Invoke-AIInventoryScan.ps1 scans your agency’s OMB inventory extract for identity governance gaps and produces a prioritized findings report. No external dependencies; runs anywhere PowerShell 7 is available.
The OMB 2025 Federal AI Use Case Inventory has no fields for identity governance: no service account, no credential tier, no owner, no organizational placement. This kit adds that layer — making the invisible identity surface visible before it becomes a breach surface.
What the kit does
| Phase | What runs | Output |
|---|---|---|
| 1 — Inventory | Download or load OMB CSV; parse all deployed and pilot entries | Structured record set |
| 2 — Scan | Detect six identity governance gaps per M-25-21 obligations | Findings list with severity (P1 / P2) and drift class |
| 3 — Report | Produce a prioritized HTML or CSV findings report | Actionable gap list, ATO cross-walk, shadow AI candidates |
| 4 — Remediate (governed) | Owner assignment, ATO reciprocity lookup | Updated identity records in the Federal Modernization Program registry |
Who this is for
Agency identity governance teams running a M-25-21 compliance program who need to verify that their inventoried AI systems have identity governance coverage.
Federal ISSO/AO staff reviewing ATO packages for AI systems who need to confirm that the credential lifecycle is documented.
OMB/OFCIO program staff evaluating whether the 2026 inventory schema should add identity governance fields. This kit demonstrates what those fields would enable.
Background reading
The Federal AI Governance — Submission Readiness Brief names this kit as the path to operationalizing the DRIFT-COMPLIANCE::ai-agentic-ungoverned P1 finding.
The normative specifications are:
- the program decision — Federal AI Use Case Governance
- FMP_196 — AI System Identity Record
Deployment options
The kit ships as open-source Python and PowerShell. No managed service or external control plane is required to run it.
Standalone (any agency, no the Federal Modernization Program dependency): Run Invoke-AIInventoryScan.ps1 against your OMB inventory extract. All six finding types are produced without connecting to any external system.
Governed (the Federal Modernization Program adopters): The ai-inventory-governance adapter slot (adapter-registry.yaml) binds scanner output to the drift engine and the the program decision ATO reciprocity model. See governed path for activation steps.