Where Risk Mapping Ends and Assurance Begins

Google's Secure AI Framework (SAIF) has become one of the most widely used starting points for reasoning about AI-specific risk. It gives practitioners a shared vocabulary for where things can go wrong across an AI architecture — the model, the data, the infrastructure, the application. What SAIF does not claim to be is an accountability framework, an evidence standard, an incident-classification system, or a way to govern what happens when an AI agent's failure produces a physical-world effect.

That gap is not a flaw in SAIF. It is a boundary SAIF's own public materials are candid about. The question is what an organization does on the other side of that boundary — once it has identified a risk, how does it prove, with evidence, that a specific agentic AI system operates within its authorized limits?

ODA3 Institute's newest publication pair, Operational Complementarity Between Google's SAIF and the GAISSF™ Ecosystem, is a practitioner-level answer to that question.

What the report pair covers

The Technical & Compliance Report develops a complementarity method — not a formal or Google-endorsed crosswalk — connecting SAIF's risk framing to four things the GAISSF™ Ecosystem is built to provide:

• Accountable ownership and evidence discipline, via GAISSF™ — who owns a control, and what proves it operates.
• Structured incident recording, via UAIF™ — a way to document a suspected failure that preserves uncertainty instead of collapsing it into premature conclusions.
• Governed response, via AI-IRF™ — preparation, containment, recovery, and validated learning once an incident is underway.
• Physical-effect assurance, via PAI-SF™ — for the growing category of agentic systems that can perceive, recommend, or execute a real-world physical action.

Beyond the framework relationships, the report proposes a concrete accountability model for agentic AI (the difference between an assistant that drafts text and an agent that can move money, change a production system, or control a device is treated as the first design question, not an afterthought), a Control Data Dictionary for evidence-sufficiency, a minimum agent test set, and a bounded 90-day pilot plan for testing the method on a single material workload before any broader claim is made.

The Executive Brief distills this into board-level terms: what it means for the business, the governance decision it supports, and — deliberately — what remains uncertain. Neither document claims that SAIF and GAISSF™ certify one another, and neither is sponsored, endorsed, or validated by Google.

Why it matters now

Agentic AI is moving faster than most organizations' assurance practices. A system that can invoke tools and hold delegated identity creates a different risk profile than one that only generates text — and "we mapped the risk with SAIF" is a different claim from "we can reconstruct what this agent did and show it stayed inside its authorized boundary." This report pair is written for the organizations that need to close that specific gap, using evidence sources many Google Cloud environments already generate, without waiting for a formal joint standard that does not yet exist.

Read the full pair

The Technical & Compliance Report and its companion Executive Brief are available together as a single publication pair.

Download the Technical & Compliance Report (PDF, 31 pages) Download the Executive Brief (PDF, 5 pages)

Independent analysis by ODA3 Institute. Not sponsored, endorsed, approved, or validated by Google LLC. GAISSF™, UAIF™, AI-IRF™, and PAI-SF™ are frameworks of ODA3 Institute. Google, Google Cloud, and SAIF are referenced descriptively; see the full independence and trademark notice in the paired report.