The Five Laws of AI Governance
NIST SP 800-53 Rev 5.2.0 Alignment

Supportive Relationship Mapping — the Five Laws of AI Governance to NIST SP 800-53 Rev 5.2.0

Submitted to the NIST OLIR Program · Supportive Relationship Mapping · Reference Version 1.0.0 · Developer AAM Cyber · NIST OLIR Catalog

Reference document: The Five Laws of AI Governance

Five Laws (reference document) NIST AI RMF 1.0 NIST SP 800-53 Rev 5.2.0 NIST CSF 2.0

The Five Laws of AI Governance

The reference document states the Laws in two registers. Both are canonical. The Prohibition register, the memorable form, is given below. The Charter register, the full normative statement, is quoted verbatim in each relationship further down and is what the submitted mapping carries.

Prohibition Register

Law I — Independent Measure. A system shall not measure itself.
Its own scorecard is not evidence. The grade has to come from outside the thing being graded.

Law II — Binding at Dispatch. A system shall not be governed after the fact.
The rules have to hold at the moment it acts. Checking afterward is cleanup, not control.

Law III — External Witness. A system shall not witness itself.
The record of what it did cannot be held by the thing that did it. It is kept outside, append-only, and tamper-evident.

Law IV — Separated Authority. A system shall not certify itself.
No one passes their own audit. The judge cannot also be the builder — and a judge drawn from the same architecture as the builder inherits the same blind spots. Independence is not a different instance. It is a different species.

Law V — Revocable Authority. A system shall not outlive its off-switch.
You must always be able to stop it. And that power cannot weaken as the system grows stronger.

Canonical text, both registers: /standard/five-laws/ · DOI 10.5281/zenodo.21271750 · CC BY 4.0

Key Facts

• What: Supportive Relationship Mapping relating the Five Laws of AI Governance to NIST SP 800-53 Rev 5.2.0 (NIST SP 800-53 Rev 5.2.0).
• Who: AAM Cyber, Informative Reference Developer. Pharns Genece, Reference Document Author.
• Scope: 11 relationships across 11 controls and control enhancements, using all five Laws as reference elements.
• Coverage: Relationships fall in the AU, CA, SA, AC, CM, and IR families.
• Relationship type: Supportive. Every relationship is supports with the property example of.
• Comprehensive: Yes. All five Laws are related to at least one focal element. Per NIST IR 8278Ar1 Section 3.1.12, this field measures coverage of the Reference Document.
• Status: Catalogued in the NIST OLIR Program as a Draft Informative Reference on 2026-10-06, in a 30-day public review. Submitted 2026-09-30. Reference Version 1.0.0. Draft is not Final.

Reference document

Genece, P. (2026). The Five Laws of AI Governance (v1.0.1). Zenodo. https://doi.org/10.5281/zenodo.21271750 · CC BY 4.0 · ORCID 0009-0009-0791-4124

Focal document: NIST SP 800-53 Rev 5.2.0

Change Log: View full version history

How to Read This Page

Each entry below records one relationship between a Law and a focal element.

• Focal element — the identifier and verbatim text of the NIST SP 800-53 Rev 5.2.0 element.
• Law — the reference element, quoted verbatim from the Charter register of the published paper.
• Type — supports. Per NIST IR 8477 Section 4.2, one concept supports another when it can be applied, alone or with other concepts, to achieve it in whole or in part.
• Property — example of. The Law is one way of achieving the focal outcome. The outcome can also be achieved without applying the Law.

No equivalence is asserted in any relationship.

Elements Not Related

The Laws are five statements about how a system's conduct is measured, bound, recorded, certified, and halted. Most of SP 800-53 addresses matters outside that scope, so a relationship is recorded only where a control statement names one of those five properties. AU-09(01) is a deliberate exclusion: it specifies hardware-enforced write-once media, and Law III states append-only as a property of the record without naming a medium.

Recording no relationship is a statement about the scope of this mapping. It is not a statement about the focal document.

OLIR Catalog Status

This Supportive Relationship Mapping was submitted to the NIST OLIR Program on 2026-09-30, alongside companion mappings of the same reference document to NIST AI RMF 1.0 and NIST CSF 2.0.

AAM Cyber holds three Final Informative References for a separate reference document, the SDOS Runtime Governance Framework, against these same three focal documents.

Maintenance

This document is maintained by AAM Cyber. Version history for the doctrine and every mapping derived from it is at /standard/five-laws/changelog/.

Subsequent updates will be issued when: (1) the NIST OLIR Program issues screening feedback requiring revision, (2) NIST SP 800-53 Rev 5.2.0 releases a revision requiring mapping review, or (3) a new relationship is identified, which per NIST IR 8278Ar1 Section 3.1.9 is a minor version.

Contact

AAM Cyber aamcyber.com

Questions about this mapping: [email protected]

Relationships (11)

Every relationship is type supports with the property example of. Each Law is one way of achieving the focal outcome in whole or in part; the outcomes can be achieved by other means. No equivalence is asserted.

Focal element	Law	Type	Property
AC-03	Law II — Binding at Dispatch	supports	example of
AU-09	Law III — External Witness	supports	example of
AU-09(02)	Law III — External Witness	supports	example of
AU-09(03)	Law III — External Witness	supports	example of
AU-09(04)	Law III — External Witness	supports	example of
AU-11	Law III — External Witness	supports	example of
CA-02(01)	Law IV — Separated Authority	supports	example of
CA-07(01)	Law I — Independent Measure	supports	example of
CM-07(05)	Law II — Binding at Dispatch	supports	example of
IR-04(05)	Law V — Revocable Authority	supports	example of
SA-11(03)	Law IV — Separated Authority	supports	example of

Relationship detail

AC-03 → Law II — Binding at Dispatch

Focal element. Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Law (Charter register). A system may not be governed only in retrospect. Authority must constrain the action before the action occurs; observation after the fact is incident response, not prevention. Absence of a valid governance signal is a denial, not a permission.

Relationship. AC-03 describes an outcome in which approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies. Law II describes one way of achieving that outcome: authority constrains the action before the action occurs, and the absence of a valid governance signal resolves to a denial rather than a permission. Enforcement can also be arranged in other ways.

AU-09 → Law III — External Witness

Focal element. a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; andb. Alert [Assignment: organization-defined personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.

Law (Charter register). A system may not be the custodian of the record of its own conduct. That record must be produced and held by infrastructure outside the system's control — append-only, tamper-evident, and retained beyond the system's own lifecycle.

Relationship. AU-09 describes an outcome in which audit information and audit logging tools are protected from unauthorized access, modification, and deletion. Law III describes one way of achieving that outcome in part: the record of the system's conduct is produced and held by infrastructure outside the control of the system being recorded, and is append-only and tamper-evident. Other approaches to protecting audit information exist.

AU-09(02) → Law III — External Witness

Focal element. Store audit records [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited.

Law (Charter register). A system may not be the custodian of the record of its own conduct. That record must be produced and held by infrastructure outside the system's control — append-only, tamper-evident, and retained beyond the system's own lifecycle.

Relationship. AU-09(02) describes an outcome in which audit records are stored in a repository that is part of a physically different system or system component than the system being audited. Law III describes one way of achieving that outcome in part: the record of the system's conduct is produced and held by infrastructure outside that system's control. Separation of the custodian from the system being recorded can also be achieved by other means.

AU-09(03) → Law III — External Witness

Focal element. Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.

Law (Charter register). A system may not be the custodian of the record of its own conduct. That record must be produced and held by infrastructure outside the system's control — append-only, tamper-evident, and retained beyond the system's own lifecycle.

Relationship. AU-09(03) describes an outcome in which cryptographic mechanisms protect the integrity of audit information and audit tools. Law III describes one way of achieving that outcome in part: the record of the system's conduct is tamper-evident. Cryptographic integrity protection is one means of making a record tamper-evident.

AU-09(04) → Law III — External Witness

Focal element. Authorize access to management of audit logging functionality to only [Assignment: organization-defined subset of privileged users or roles].

Law (Charter register). A system may not be the custodian of the record of its own conduct. That record must be produced and held by infrastructure outside the system's control — append-only, tamper-evident, and retained beyond the system's own lifecycle.

Relationship. AU-09(04) describes an outcome in which access to management of audit logging functionality is authorized only to a designated subset of privileged users, because individuals who are also the subject of an audit by that system may affect the reliability of the audit information. Law III describes one way of achieving that outcome: the record is produced and held by infrastructure outside the control of the system whose conduct it records. No equivalence is asserted.

AU-11 → Law III — External Witness

Focal element. Retain audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Law (Charter register). A system may not be the custodian of the record of its own conduct. That record must be produced and held by infrastructure outside the system's control — append-only, tamper-evident, and retained beyond the system's own lifecycle.

Relationship. AU-11 describes an outcome in which audit records are retained for an organization-defined time period to support after-the-fact investigations and to meet retention requirements. Law III describes one way of achieving that outcome in part: the record of the system's conduct is retained beyond the system's own lifecycle. Retention beyond the lifecycle does not by itself establish the organization-defined time period AU-11 calls for.

CA-02(01) → Law IV — Separated Authority

Focal element. Employ independent assessors or assessment teams to conduct control assessments.

Law (Charter register). No party may certify itself. The power to measure must be separable from the act of building — published criteria, verifiable evidence chains — and the one who builds it first does not own the standard. A judge drawn from the same architecture as the builder inherits the same blind spots. Independence is not a different instance. It is a different species.

Relationship. CA-02(01) describes an outcome in which independent assessors or assessment teams conduct control assessments. Law IV describes one way of achieving that outcome: the power to measure is separable from the act of building, supported by published criteria and verifiable evidence chains. Independence can also be established by other means.

CA-07(01) → Law I — Independent Measure

Focal element. Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.

Law (Charter register). A system may not produce the measure of its own conduct. The scale of what it was authorized to do versus what it did must be computed outside the system at runtime, by something the system does not control.

Relationship. CA-07(01) describes an outcome in which independent assessors or assessment teams monitor the controls in the system on an ongoing basis. Law I describes one way of achieving that outcome in part: the scale of what the system was authorized to do versus what it did is computed outside the system at runtime, by something the system does not control. Law I does not by itself establish that the assessors are employed in the manner CA-07(01) describes.

CM-07(05) → Law II — Binding at Dispatch

Focal element. a. Identify [Assignment: organization-defined software programs authorized to execute on the system];b. Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; andc. Review and update the list of authorized software programs [Assignment: organization-defined frequency].

Law (Charter register). A system may not be governed only in retrospect. Authority must constrain the action before the action occurs; observation after the fact is incident response, not prevention. Absence of a valid governance signal is a denial, not a permission.

Relationship. CM-07(05) describes an outcome in which a deny-all, permit-by-exception policy allows the execution of authorized software programs on the system. Law II describes one way of achieving that outcome in part: the absence of a valid governance signal is a denial rather than a permission, evaluated before the action occurs. Law II does not supply the identification and review activities CM-07(05) also describes.

IR-04(05) → Law V — Revocable Authority

Focal element. Implement a configurable capability to automatically disable the system if [Assignment: organization-defined security violations] are detected.

Law (Charter register). A system may not outlive its off-switch. The power to halt or revoke must remain live, external, and superior to the system at all times, and must not erode as the system's capability grows.

Relationship. IR-04(05) describes an outcome in which a configurable capability automatically disables the system when organization-defined security violations are detected. Law V describes one way of achieving that outcome in part: the power to halt remains live, external, and superior to the system at all times, so that the capability is not defeated by the system it governs. Law V does not supply the configurability or the organization-defined triggers that IR-04(05) also describes.

SA-11(03) → Law IV — Separated Authority

Focal element. a. Require an independent agent satisfying [Assignment: organization-defined independence criteria] to verify the correct implementation of the developer security and privacy assessment plans and the evidence produced during testing and evaluation; andb. Verify that the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.

Law (Charter register). No party may certify itself. The power to measure must be separable from the act of building — published criteria, verifiable evidence chains — and the one who builds it first does not own the standard. A judge drawn from the same architecture as the builder inherits the same blind spots. Independence is not a different instance. It is a different species.

Relationship. SA-11(03) describes an outcome in which an independent agent verifies the correct implementation of the developer's assessment plans and the evidence produced during testing and evaluation. Law IV describes one way of achieving that outcome: the power to measure is separable from the act of building, supported by published criteria and verifiable evidence chains. Other arrangements for independent verification exist.

---

NIST OLIR catalog inclusion is an informative reference, not a NIST endorsement.

Reference Document Element Descriptions are quoted verbatim from the Charter register of the published paper. The canonical text is at aamcyber.com/standard/five-laws/.