validation/ai-validation-checklists

1{"id": "VAL-MODEL-001", "system_type": "model", "validation_area": "task_performance", "check": "Does the model meet the minimum quality required for its intended task?", "expected_evidence": "Task-specific evaluation set, baseline model, evaluation report", "metric": "Primary task metric", "threshold_guidance": "Define a use-case-specific minimum and compare against an approved baseline.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "Hugging Face — Choosing a metric", "source_url": "https://huggingface.co/docs/evaluate/en/choosing_a_metric", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}2{"id": "VAL-MODEL-002", "system_type": "model", "validation_area": "robustness", "check": "Does model performance remain acceptably stable under realistic prompt or input variation?", "expected_evidence": "Perturbation suite, repeated runs, robustness report", "metric": "Performance delta under perturbation", "threshold_guidance": "Define the maximum acceptable degradation for representative variations.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}3{"id": "VAL-MODEL-003", "system_type": "model", "validation_area": "calibration", "check": "Are confidence signals or uncertainty indicators meaningfully aligned with observed correctness where they are used?", "expected_evidence": "Calibration dataset, confidence outputs, reliability analysis", "metric": "Calibration error / selective accuracy", "threshold_guidance": "Set a calibration target appropriate to the decision context; do not use confidence without validation.", "severity": "medium", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}4{"id": "VAL-MODEL-004", "system_type": "model", "validation_area": "failure_modes", "check": "Are known high-impact failure modes documented and reproducible in testing?", "expected_evidence": "Failure catalog, test prompts, incident examples, model card", "metric": "Failure reproduction coverage", "threshold_guidance": "All identified high-impact failure modes should have at least one reproducible test.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI RMF: Generative AI Profile (NIST AI 600-1)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}5{"id": "VAL-MODEL-005", "system_type": "model", "validation_area": "bias_fairness", "check": "Has performance been evaluated across relevant groups, languages, domains or other meaningful slices?", "expected_evidence": "Slice definitions, evaluation results, disparity analysis", "metric": "Worst-slice performance / disparity", "threshold_guidance": "Define acceptable disparity based on context, impact and population; document unsupported slices.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}6{"id": "VAL-MODEL-006", "system_type": "model", "validation_area": "safety", "check": "Does the model resist known harmful or disallowed behavior within the intended deployment context?", "expected_evidence": "Safety test suite, red-team results, refusal/behavior logs", "metric": "Safety violation rate", "threshold_guidance": "Set scenario-specific limits; critical prohibited behaviors may require zero tolerated occurrences in the test set.", "severity": "critical", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI RMF: Generative AI Profile (NIST AI 600-1)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}7{"id": "VAL-MODEL-007", "system_type": "model", "validation_area": "versioning", "check": "Can every deployed model instance be traced to an exact model, revision and configuration?", "expected_evidence": "Model registry record, commit/revision ID, deployment manifest", "metric": "Traceability coverage", "threshold_guidance": "100% of production deployments should map to an exact approved model revision.", "severity": "high", "lifecycle_stage": "deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST SP 800-218A — Secure Software Development Practices for Generative AI", "source_url": "https://www.nist.gov/publications/secure-software-development-practices-generative-ai-and-dual-use-foundation-models-ssdf", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}8{"id": "VAL-MODEL-008", "system_type": "model", "validation_area": "regression", "check": "Are model updates regression-tested against previously approved capabilities and risks?", "expected_evidence": "Regression suite, prior baseline, change log", "metric": "Regression pass rate / metric deltas", "threshold_guidance": "No release should proceed with unexplained high-impact regressions.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}9{"id": "VAL-MODEL-009", "system_type": "model", "validation_area": "resource_behavior", "check": "Are latency, throughput and memory behavior measured under representative load?", "expected_evidence": "Load-test results, hardware profile, serving logs", "metric": "p95 latency / throughput / memory", "threshold_guidance": "Define operational SLOs for the intended environment and validate under expected concurrency.", "severity": "medium", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}10{"id": "VAL-MODEL-010", "system_type": "model", "validation_area": "documentation", "check": "Are intended use, limitations, evaluation scope and unsupported conditions documented?", "expected_evidence": "Model card, validation report, risk documentation", "metric": "Documentation completeness", "threshold_guidance": "All deployment-critical limitations and validation boundaries should be documented before release.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "manual", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}11{"id": "VAL-AGENT-001", "system_type": "agent", "validation_area": "goal_completion", "check": "Does the agent complete representative end-to-end tasks successfully?", "expected_evidence": "Scenario suite, traces, final outcomes", "metric": "Task success rate", "threshold_guidance": "Set a minimum task success rate per workflow and risk level.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}12{"id": "VAL-AGENT-002", "system_type": "agent", "validation_area": "tool_selection", "check": "Does the agent select only appropriate and permitted tools for each task?", "expected_evidence": "Tool-call traces, policy definitions, scenario tests", "metric": "Tool selection accuracy / policy violation rate", "threshold_guidance": "Unauthorized or explicitly disallowed tool selection should be zero in the validation suite.", "severity": "critical", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}13{"id": "VAL-AGENT-003", "system_type": "agent", "validation_area": "permissions", "check": "Are agent actions constrained by least-privilege permissions?", "expected_evidence": "Permission matrix, service-account scopes, execution logs", "metric": "Unauthorized action rate", "threshold_guidance": "Zero successful actions outside the agent's approved permission scope.", "severity": "critical", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}14{"id": "VAL-AGENT-004", "system_type": "agent", "validation_area": "trajectory", "check": "Can important agent decisions, tool calls and observations be reconstructed from traces?", "expected_evidence": "Structured traces, tool logs, timestamps, model/version metadata", "metric": "Trace completeness", "threshold_guidance": "100% of high-impact actions should have reconstructable decision and execution evidence.", "severity": "high", "lifecycle_stage": "deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}15{"id": "VAL-AGENT-005", "system_type": "agent", "validation_area": "recovery", "check": "Does the agent recover safely from tool failures, unavailable dependencies and malformed results?", "expected_evidence": "Fault-injection scenarios, traces, recovery outcomes", "metric": "Safe recovery rate", "threshold_guidance": "Define acceptable recovery behavior; no unsafe fallback actions in critical scenarios.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}16{"id": "VAL-AGENT-006", "system_type": "agent", "validation_area": "termination", "check": "Does the agent stop when its goal is reached or when configured limits are exceeded?", "expected_evidence": "Loop tests, max-step settings, execution logs", "metric": "Unbounded-loop rate / excess-step rate", "threshold_guidance": "Zero unbounded executions; enforce hard runtime, step or cost limits.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}17{"id": "VAL-AGENT-007", "system_type": "agent", "validation_area": "human_oversight", "check": "Are high-impact actions escalated for human approval where required?", "expected_evidence": "Approval policy, approval logs, action traces", "metric": "Approval bypass rate", "threshold_guidance": "Zero execution of actions that policy marks as requiring approval without recorded approval.", "severity": "critical", "lifecycle_stage": "deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}18{"id": "VAL-AGENT-008", "system_type": "agent", "validation_area": "prompt_injection", "check": "Does the agent resist instructions in untrusted content that attempt to override system or tool-use policies?", "expected_evidence": "Injection test corpus, retrieval/tool scenarios, traces", "metric": "Injection success rate", "threshold_guidance": "Set a strict threshold based on impact; privileged action compromise should be zero in the test suite.", "severity": "critical", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}19{"id": "VAL-AGENT-009", "system_type": "agent", "validation_area": "cost_control", "check": "Are token, tool, compute and external-service costs bounded and observable?", "expected_evidence": "Budgets, cost telemetry, run logs", "metric": "Cost per successful task / budget breach rate", "threshold_guidance": "Define workflow budgets and require zero uncontrolled budget overruns.", "severity": "medium", "lifecycle_stage": "deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}20{"id": "VAL-AGENT-010", "system_type": "agent", "validation_area": "delegation", "check": "In multi-agent systems, are delegation boundaries and responsibility transfers explicit and traceable?", "expected_evidence": "Agent graph, delegation events, scopes, traces", "metric": "Delegation trace coverage", "threshold_guidance": "All inter-agent delegation affecting high-impact actions should be attributable and reconstructable.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}21{"id": "VAL-RAG-001", "system_type": "rag", "validation_area": "retrieval_relevance", "check": "Does retrieval return information relevant to the user question or task?", "expected_evidence": "Query set, retrieved passages, relevance judgments", "metric": "Recall@k / nDCG / precision@k", "threshold_guidance": "Choose a retrieval metric and target based on corpus size and downstream task.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "Hugging Face — Choosing a metric", "source_url": "https://huggingface.co/docs/evaluate/en/choosing_a_metric", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}22{"id": "VAL-RAG-002", "system_type": "rag", "validation_area": "grounding", "check": "Are generated factual claims supported by retrieved evidence when grounding is required?", "expected_evidence": "Answers, retrieved context, claim-evidence labels", "metric": "Grounding error rate / supported-claim rate", "threshold_guidance": "Define a maximum unsupported-claim rate; stricter thresholds for high-impact use cases.", "severity": "critical", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI RMF: Generative AI Profile (NIST AI 600-1)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}23{"id": "VAL-RAG-003", "system_type": "rag", "validation_area": "citation_accuracy", "check": "Do citations point to sources that actually support the associated claims?", "expected_evidence": "Generated citations, source documents, citation labels", "metric": "Citation precision", "threshold_guidance": "Set a minimum citation-support rate; critical claims should require directly supporting evidence.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI RMF: Generative AI Profile (NIST AI 600-1)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}24{"id": "VAL-RAG-004", "system_type": "rag", "validation_area": "source_provenance", "check": "Can each indexed document be traced to an approved source and version?", "expected_evidence": "Corpus manifest, source URLs, document hashes, ingestion logs", "metric": "Provenance coverage", "threshold_guidance": "100% of production documents should have source and version metadata.", "severity": "high", "lifecycle_stage": "deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}25{"id": "VAL-RAG-005", "system_type": "rag", "validation_area": "access_control", "check": "Does retrieval enforce document-level access restrictions for the requesting user or agent?", "expected_evidence": "ACLs, test identities, retrieval logs", "metric": "Unauthorized retrieval rate", "threshold_guidance": "Zero retrieval of documents outside the requester's approved access scope.", "severity": "critical", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}26{"id": "VAL-RAG-006", "system_type": "rag", "validation_area": "staleness", "check": "Are time-sensitive documents refreshed or retired according to defined freshness rules?", "expected_evidence": "Document timestamps, refresh policy, index audit", "metric": "Stale-document rate", "threshold_guidance": "Define freshness windows per source class and alert on expired content.", "severity": "medium", "lifecycle_stage": "monitoring", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}27{"id": "VAL-RAG-007", "system_type": "rag", "validation_area": "poisoning", "check": "Can malicious or manipulated documents alter retrieval or generation in unsafe ways?", "expected_evidence": "Poisoned-document test set, ingestion controls, RAG traces", "metric": "Poisoning attack success rate", "threshold_guidance": "High-impact poisoning scenarios should not cause policy-violating actions or unsupported trusted claims.", "severity": "critical", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}28{"id": "VAL-RAG-008", "system_type": "rag", "validation_area": "context_overflow", "check": "Does the system preserve important evidence when retrieved context exceeds the model context budget?", "expected_evidence": "Long-context scenarios, selected chunks, outputs", "metric": "Critical-evidence retention rate", "threshold_guidance": "Define critical-evidence retention expectations for long or crowded contexts.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI RMF: Generative AI Profile (NIST AI 600-1)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}29{"id": "VAL-RAG-009", "system_type": "rag", "validation_area": "retrieval_failure", "check": "Does the system fail safely when no relevant evidence is available?", "expected_evidence": "No-answer scenarios, outputs, fallback logs", "metric": "Appropriate abstention rate", "threshold_guidance": "Require abstention or explicit uncertainty where evidence is insufficient for high-impact claims.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI RMF: Generative AI Profile (NIST AI 600-1)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}30{"id": "VAL-RAG-010", "system_type": "rag", "validation_area": "chunking_indexing", "check": "Are chunking, embedding and indexing choices validated for the target corpus and query types?", "expected_evidence": "Ablation tests, retrieval benchmarks, index configuration", "metric": "Retrieval quality delta", "threshold_guidance": "Compare configurations on representative queries; document chosen trade-offs.", "severity": "medium", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "Hugging Face Evaluate", "source_url": "https://huggingface.co/docs/evaluate/index", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}31{"id": "VAL-TOOL-001", "system_type": "tool", "validation_area": "schema_validation", "check": "Are tool arguments validated against an explicit schema before execution?", "expected_evidence": "Tool schema, invalid-input tests, execution logs", "metric": "Invalid-call rejection rate", "threshold_guidance": "100% of schema-invalid privileged calls should be rejected before execution.", "severity": "critical", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}32{"id": "VAL-TOOL-002", "system_type": "tool", "validation_area": "output_validation", "check": "Are tool outputs treated as untrusted input and validated before downstream use?", "expected_evidence": "Output validation rules, malformed-output tests, traces", "metric": "Unsafe output propagation rate", "threshold_guidance": "Zero propagation of known-invalid structured outputs into privileged actions.", "severity": "critical", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}33{"id": "VAL-TOOL-003", "system_type": "tool", "validation_area": "side_effects", "check": "Are side-effecting tools clearly distinguished from read-only tools?", "expected_evidence": "Tool registry, capability labels, permission rules", "metric": "Capability labeling coverage", "threshold_guidance": "100% of production tools should declare whether they can create external side effects.", "severity": "high", "lifecycle_stage": "design", "automation_level": "manual", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}34{"id": "VAL-TOOL-004", "system_type": "tool", "validation_area": "idempotency", "check": "Are retry behaviors safe for tools that may create duplicate or irreversible effects?", "expected_evidence": "Retry policy, idempotency keys, fault-injection tests", "metric": "Duplicate side-effect rate", "threshold_guidance": "Zero duplicate critical transactions in retry/failure scenarios.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}35{"id": "VAL-TOOL-005", "system_type": "tool", "validation_area": "authentication", "check": "Are tool credentials and service identities scoped, rotated and protected?", "expected_evidence": "Credential inventory, secret-management config, access logs", "metric": "Credential policy coverage", "threshold_guidance": "100% of production tool integrations should use approved credential management.", "severity": "critical", "lifecycle_stage": "deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST SP 800-218A — Secure Software Development Practices for Generative AI", "source_url": "https://www.nist.gov/publications/secure-software-development-practices-generative-ai-and-dual-use-foundation-models-ssdf", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}36{"id": "VAL-TOOL-006", "system_type": "tool", "validation_area": "rate_limits", "check": "Are execution frequency and resource limits defined for costly or sensitive tools?", "expected_evidence": "Rate-limit config, stress tests, alerts", "metric": "Rate-limit enforcement rate", "threshold_guidance": "Zero successful bypasses of configured hard limits in the validation suite.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}37{"id": "VAL-TOOL-007", "system_type": "tool", "validation_area": "error_handling", "check": "Are tool errors explicit enough for the agent to avoid unsafe assumptions?", "expected_evidence": "Error taxonomy, simulated failures, traces", "metric": "Unsafe continuation after error", "threshold_guidance": "High-impact tool failures should trigger safe fallback, stop or escalation behavior.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}38{"id": "VAL-TOOL-008", "system_type": "tool", "validation_area": "auditability", "check": "Are tool calls logged with identity, arguments, result status and timestamp?", "expected_evidence": "Execution logs, trace IDs, audit schema", "metric": "Audit log completeness", "threshold_guidance": "100% of high-impact tool executions should have complete audit records.", "severity": "high", "lifecycle_stage": "deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}39{"id": "VAL-DATA-001", "system_type": "data", "validation_area": "provenance", "check": "Can training, fine-tuning and evaluation data be traced to known sources and processing steps?", "expected_evidence": "Dataset card, manifests, lineage records, processing logs", "metric": "Provenance coverage", "threshold_guidance": "Define required lineage fields and target complete coverage for production-critical datasets.", "severity": "high", "lifecycle_stage": "design", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}40{"id": "VAL-DATA-002", "system_type": "data", "validation_area": "quality", "check": "Have missing values, duplicates, corrupt records and label errors been measured?", "expected_evidence": "Data-quality report, validation scripts, sample review", "metric": "Error rate by defect type", "threshold_guidance": "Set dataset-specific quality thresholds and investigate outliers before use.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "Hugging Face Evaluate", "source_url": "https://huggingface.co/docs/evaluate/index", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}41{"id": "VAL-DATA-003", "system_type": "data", "validation_area": "representativeness", "check": "Does the dataset cover the populations, domains and conditions relevant to intended use?", "expected_evidence": "Coverage analysis, slice statistics, domain comparison", "metric": "Coverage by target slice", "threshold_guidance": "Document known gaps and avoid claims for materially underrepresented conditions.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}42{"id": "VAL-DATA-004", "system_type": "data", "validation_area": "leakage", "check": "Has overlap between training data and evaluation/test data been checked where it could bias results?", "expected_evidence": "Deduplication/overlap analysis, split manifest", "metric": "Train-test overlap rate", "threshold_guidance": "Define a maximum allowed overlap; benchmark contamination should be investigated and reported.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI RMF: Generative AI Profile (NIST AI 600-1)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}43{"id": "VAL-DATA-005", "system_type": "data", "validation_area": "sensitive_information", "check": "Is sensitive or restricted information identified and handled according to policy?", "expected_evidence": "Data classification, DLP scan, access controls", "metric": "Unapproved sensitive-record rate", "threshold_guidance": "Zero knowingly unapproved sensitive records in datasets not authorized to contain them.", "severity": "critical", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}44{"id": "VAL-DATA-006", "system_type": "data", "validation_area": "poisoning_integrity", "check": "Are ingestion and update pipelines protected against unauthorized or malicious data changes?", "expected_evidence": "Access controls, hashes, provenance, anomaly checks", "metric": "Unauthorized modification rate", "threshold_guidance": "Zero unauthorized modifications to approved production data sources.", "severity": "critical", "lifecycle_stage": "deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}45{"id": "VAL-DATA-007", "system_type": "data", "validation_area": "label_consistency", "check": "Where labels or human judgments are used, has agreement and consistency been measured?", "expected_evidence": "Annotation guidelines, multiple annotations, adjudication logs", "metric": "Inter-annotator agreement", "threshold_guidance": "Set an agreement target appropriate to the task and document subjective/ambiguous categories.", "severity": "medium", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "Hugging Face — Choosing a metric", "source_url": "https://huggingface.co/docs/evaluate/en/choosing_a_metric", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}46{"id": "VAL-DATA-008", "system_type": "data", "validation_area": "drift", "check": "Are changes in production input distributions monitored against the validated data profile?", "expected_evidence": "Reference distribution, production telemetry, drift report", "metric": "Population/data drift metric", "threshold_guidance": "Define alert thresholds by feature or embedding distribution and revalidate after material drift.", "severity": "high", "lifecycle_stage": "monitoring", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}47{"id": "VAL-MM-001", "system_type": "multimodal", "validation_area": "cross_modal_consistency", "check": "Do text, image, audio or video outputs remain consistent when modalities describe the same underlying fact?", "expected_evidence": "Paired multimodal test set, consistency labels", "metric": "Cross-modal consistency rate", "threshold_guidance": "Set a minimum consistency target on representative paired examples.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI RMF: Generative AI Profile (NIST AI 600-1)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}48{"id": "VAL-MM-002", "system_type": "multimodal", "validation_area": "image_grounding", "check": "When answering about an image, are claims supported by visible content rather than unsupported assumptions?", "expected_evidence": "Images, questions, region/claim annotations, outputs", "metric": "Visual grounding error rate", "threshold_guidance": "Define a maximum unsupported visual-claim rate for the intended task.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI RMF: Generative AI Profile (NIST AI 600-1)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}49{"id": "VAL-MM-003", "system_type": "multimodal", "validation_area": "audio_transcription", "check": "If speech recognition is used, is transcription quality measured across relevant accents, noise and domains?", "expected_evidence": "Audio benchmark, transcripts, slice labels", "metric": "WER / slice WER", "threshold_guidance": "Set use-case-specific WER targets and examine worst-performing slices.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "Hugging Face — Choosing a metric", "source_url": "https://huggingface.co/docs/evaluate/en/choosing_a_metric", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}50{"id": "VAL-MM-004", "system_type": "multimodal", "validation_area": "modality_injection", "check": "Can malicious instructions embedded in images, documents or audio override system policies?", "expected_evidence": "Adversarial multimodal inputs, traces, outputs", "metric": "Cross-modal injection success rate", "threshold_guidance": "Privileged policy compromise should be zero in the validation suite.", "severity": "critical", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "OWASP Top 10 for LLM Applications 2025", "source_url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}51{"id": "VAL-MM-005", "system_type": "multimodal", "validation_area": "missing_modality", "check": "Does the system fail safely when a required modality is missing, unreadable or corrupted?", "expected_evidence": "Corrupted/missing input scenarios, outputs", "metric": "Safe failure rate", "threshold_guidance": "All required-modality failures should produce explicit error, abstention or fallback behavior.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}52{"id": "VAL-MM-006", "system_type": "multimodal", "validation_area": "format_robustness", "check": "Is behavior stable across common encoding, resolution, compression or sampling variations?", "expected_evidence": "Perturbed media set, outputs", "metric": "Performance delta by transformation", "threshold_guidance": "Define acceptable degradation for supported media transformations.", "severity": "medium", "lifecycle_stage": "pre-deployment", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}53{"id": "VAL-MM-007", "system_type": "multimodal", "validation_area": "synthetic_content", "check": "Are workflows that depend on content authenticity explicit about limitations of detecting or interpreting synthetic media?", "expected_evidence": "Product documentation, provenance signals, evaluation set", "metric": "Detection/attribution performance", "threshold_guidance": "Do not make unsupported authenticity guarantees; validate claims on representative data.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI RMF: Generative AI Profile (NIST AI 600-1)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}54{"id": "VAL-MM-008", "system_type": "multimodal", "validation_area": "privacy", "check": "Are faces, voices, documents or other sensitive media handled according to access and retention policy?", "expected_evidence": "Data-flow map, retention policy, access logs", "metric": "Policy violation rate", "threshold_guidance": "Zero processing or retention outside approved policy for sensitive multimodal data.", "severity": "critical", "lifecycle_stage": "deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}55{"id": "VAL-SYS-001", "system_type": "system", "validation_area": "intended_use", "check": "Is the intended use, user population and deployment context explicitly defined?", "expected_evidence": "System card, requirements, use-case documentation", "metric": "Scope completeness", "threshold_guidance": "Define intended use and material out-of-scope uses before validation begins.", "severity": "high", "lifecycle_stage": "design", "automation_level": "manual", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}56{"id": "VAL-SYS-002", "system_type": "system", "validation_area": "risk_ownership", "check": "Are owners assigned for model, data, security, validation and operational risks?", "expected_evidence": "RACI/ownership matrix, governance records", "metric": "Ownership coverage", "threshold_guidance": "Every high-impact risk and control should have a named accountable owner.", "severity": "high", "lifecycle_stage": "design", "automation_level": "manual", "source_type": "framework-inspired", "source_name": "ISO/IEC 42001:2023 — AI management systems", "source_url": "https://www.iso.org/standard/42001", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}57{"id": "VAL-SYS-003", "system_type": "system", "validation_area": "change_management", "check": "Do material changes to models, prompts, tools, data or policies trigger revalidation?", "expected_evidence": "Change policy, release records, revalidation logs", "metric": "Revalidation trigger coverage", "threshold_guidance": "100% of predefined material changes should trigger the required revalidation workflow.", "severity": "high", "lifecycle_stage": "deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "ISO/IEC 42001:2023 — AI management systems", "source_url": "https://www.iso.org/standard/42001", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}58{"id": "VAL-SYS-004", "system_type": "system", "validation_area": "incident_response", "check": "Can AI incidents be detected, triaged, investigated and linked to model/system evidence?", "expected_evidence": "Incident playbook, logging, drills, postmortems", "metric": "Detection-to-triage time / evidence completeness", "threshold_guidance": "Define incident SLOs and require complete evidence for high-impact events.", "severity": "critical", "lifecycle_stage": "deployment", "automation_level": "semi-automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}59{"id": "VAL-SYS-005", "system_type": "system", "validation_area": "monitoring", "check": "Are production metrics linked to the assumptions and thresholds used during validation?", "expected_evidence": "Validation report, dashboards, alert rules", "metric": "Monitoring coverage", "threshold_guidance": "Monitor every production-critical validation criterion that can materially drift over time.", "severity": "high", "lifecycle_stage": "monitoring", "automation_level": "automated", "source_type": "framework-inspired", "source_name": "NIST AI Risk Management Framework (AI RMF 1.0)", "source_url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}60{"id": "VAL-SYS-006", "system_type": "system", "validation_area": "validation_documentation", "check": "Is there a reproducible validation record covering scope, methods, datasets, metrics, results, limitations and approval?", "expected_evidence": "Validation report, test artifacts, sign-off record", "metric": "Documentation completeness", "threshold_guidance": "No production approval without a traceable validation record and documented residual risks.", "severity": "high", "lifecycle_stage": "pre-deployment", "automation_level": "manual", "source_type": "framework-inspired", "source_name": "Hugging Face Evaluate", "source_url": "https://huggingface.co/docs/evaluate/index", "notes": "Practical validation check authored for this dataset; not a verbatim requirement from the cited source."}61