<!-- LI hook: The ATO is always human. Everything else is negotiable. -->

Three RMF Automation Modes: Copilot, Tiered, and Autopilot

A compliance team of four stares at a spreadsheet listing 43 information systems, each needing re-authorization within the fiscal year. The math is simple and merciless: at an average of 1,200 staff-hours per system authorization, they need 51,600 hours of effort from a team that has 8,320 available. They are understaffed by a factor of six. Two of the four team members are already working on the most politically visible system; the other 42 systems fall further behind with every passing week. The RMF is not hard because it is conceptually complex. It is hard because it is relentless --- and the staffing gap means the organization is perpetually choosing which systems to leave unattended.

AI can absorb enormous portions of that burden. The question is not whether to automate. It is how much autonomy to grant --- and where the human must remain in the loop regardless of capacity pressure.

Why Continuous Authorization Changes the Calculus

The Department of Defense's push toward continuous authorization (cATO) reframes the RMF automation question entirely. Under traditional RMF, authorization is an event: a point-in-time package, an AO signature, a three-year reauthorization cycle. Under cATO, authorization is a state: continuously maintained, continuously evidenced, continuously monitored. The documentation is alive, not archived.

This shift makes manual RMF processing untenable at scale. You cannot continuously maintain 43 authorization packages with four people. You cannot continuously monitor control effectiveness across a portfolio this size with manual processes. The cATO model assumes automation. The only question is what kind.

The RMF Lifecycle: Where the Effort Lives

Before discussing automation modes, it helps to understand where human judgment actually matters across the seven RMF steps.

Prepare. Establish the organizational and system-level context for managing security and privacy risk --- identify key roles, define the authorization boundary, and identify common controls available for inheritance.

Categorize. Determine information types and assign impact levels per FIPS 199. Requires system owner interviews, data flow analysis, and documented decisions.

Select. Choose baseline controls from NIST SP 800-53, tailor to the system, add overlays per organizational policy or framework crosswalks.

Implement. Deploy controls. Write implementation narratives describing how each control is satisfied --- or document compensating controls and planned mitigations.

Assess. Evaluate whether controls are implemented correctly, operating as intended, and producing desired outcomes. Involves automated scanning, manual testing, and independent assessment.

Authorize. The Authorizing Official reviews the security assessment package and makes a risk-based decision to authorize the system for operation.

Monitor. Continuously track security posture. Ingest vulnerability data, reassess controls, update documentation on system changes, and report status.

Each step involves judgment. But the weight of that judgment varies enormously. Drafting an implementation narrative from existing system data is not the same as accepting residual risk. Formatting a POA&M entry is not the same as modifying an authorization boundary. The work spans a spectrum from mechanical to consequential, and an intelligent automation strategy respects that spectrum.

The Contrarian Position: Full Automation Is Wrong

There is a temptation in the compliance automation market to promise "push-button ATOs." It makes good marketing. It makes terrible policy.

The authorize decision --- Step 6 --- is an act of personal accountability. When an Authorizing Official signs an ATO, they accept risk on behalf of the organization. That decision carries legal, operational, and mission implications. It requires understanding the operational context, the threat environment, the organization's risk appetite, and the consequences of failure. A machine cannot bear that accountability, and no system should pretend otherwise. Every vendor promising autonomous authorization is selling something they cannot deliver without violating the fundamental governance principle that accountability requires agency.

Three Modes, One Guarantee

Advisedly's RMF automation engine operates in three configurable modes. Organizations choose the mode matching their risk appetite, policy maturity, and operational tempo. Across all three modes, one rule is hardcoded: the Authorizing Official's decision to grant, deny, or revoke an Authority to Operate is always human. Always.

Copilot Mode: Maximum Control

In Copilot mode, the automation agent proposes every step and a human approves each one before execution. The agent drafts the narrative --- the human accepts or revises. The agent identifies the next control to assess --- the human confirms. The agent suggests a POA&M entry --- the human reviews before it is recorded.

Nothing happens without explicit approval.

This is the slowest mode in throughput but provides the highest oversight. Every action is visible, reviewable, and explicitly authorized before it takes effect.

Best for:

• Organizations new to AI-assisted compliance
• Programs under active audit scrutiny or heightened oversight requirements
• Teams building confidence in automation behavior before loosening controls
• Environments where any unapproved change could have outsized consequences

Copilot mode is not a stepping stone to be discarded. Some organizations --- particularly those in classified or safety-critical environments --- may run in Copilot mode permanently. That is a legitimate posture, and the system supports it indefinitely.

Tiered Mode: Balanced Autonomy

Tiered mode divides the RMF workflow by consequence level. Low-stakes, mechanical steps run automatically. High-stakes, judgment-intensive steps park for human approval.

Steps that run automatically:

• Generating draft implementation narratives from control requirements and system data
• Collecting and organizing evidence artifacts from connected sources
• Formatting security assessment reports and POA&M entries
• Populating fields from system inventories and scan results
• Running scheduled compliance checks and flagging deviations

Steps that park for human approval:

• Accepting or modifying residual risk determinations
• Changing control implementation status
• Modifying authorization boundaries
• Overriding assessment findings
• Any action that alters the system's risk posture

The result: drudgery disappears, decisions remain. The system handles formatting, data gathering, cross-referencing, and report generation. Humans handle judgment calls.

Best for:

• Mature programs automating for the first time
• Organizations accelerating throughput without ceding control over risk decisions
• Teams with well-understood processes but overwhelming documentation volume
• Programs managing multiple systems where mechanical work exceeds staff capacity

Autopilot Mode: Maximum Throughput

Autopilot mode runs the RMF lifecycle within defined policy boundaries. The agent executes autonomously as long as actions fall within the organization's established rules. Only the authorize step and actions the system cannot confidently classify park for human review.

This mode is designed for organizations with mature, well-documented compliance programs that have codified risk decisions into policy. The agent follows those policies. When it encounters an uncovered situation, it stops and asks.

Autopilot is where continuous authorization becomes practical. Instead of periodic re-authorization cycles, the system maintains the authorization package in real time. Controls are continuously assessed, documentation continuously updated, deviations continuously flagged. The AO reviews a living security posture rather than a months-old snapshot.

Best for:

• Organizations pursuing continuous authorization (cATO)
• Programs with well-defined, codified compliance policies
• Environments managing large portfolios at scale
• Teams where manual RMF processing directly impedes mission velocity

Fail Closed on the Unknown

Every automation system encounters situations it was not designed for. A new step type, an unusual control combination, an edge case that does not fit existing categories. How the system handles that moment defines whether it is trustworthy.

The RMF engine fails closed. If a step cannot be confidently classified, it defaults to requiring human approval --- regardless of the active mode. Even in Autopilot, an unrecognized step parks and waits. Unknown steps are surfaced, not suppressed. The operator sees them, evaluates them, and decides. Over time, organizational policy expands to cover new step types. The system never assumes.

Complete Audit Trail

Every step --- whether executed by automation or approved by a human --- generates a complete audit record:

• What action was performed
• Who or what performed it (human operator or automation agent)
• Which automation mode was active
• Whether human approval was required and whether it was given (and by whom)
• Timestamp and context
• Cryptographic enforcement receipt linking the action to the governance decision

This trail is append-only and tamper-protected. It provides evidentiary basis for demonstrating that automation operated within authorized boundaries and that human oversight was maintained where required.

NIST AI RMF Alignment

The acceptance gate pattern --- where certain actions require human approval before execution --- directly satisfies the MANAGE-1.3 requirement in the NIST AI Risk Management Framework. MANAGE-1.3 calls for human oversight mechanisms for AI-assisted decisions. By structuring every mode around explicit acceptance gates, AI governance is a first-class architectural concern rather than an afterthought. The same audit trail that documents RMF compliance also documents AI governance compliance.

Choosing Your Mode

The right mode is not a function of ambition --- it is a function of readiness.

Start with Copilot if your organization is new to RMF, new to AI-assisted workflows, or under heightened scrutiny. Watch the agent's proposals. Develop a sense for where it adds value and where you need judgment. There is no penalty for staying in Copilot as long as needed.

Move to Tiered when you are confident in automation behavior on routine tasks and want to reclaim time spent on mechanical approvals. Tiered is the sweet spot for most organizations: it eliminates documentation toil while keeping humans in the loop for every risk-bearing decision.

Adopt Autopilot when compliance policies are mature, well-documented, and codified to the point where automation can follow them without ambiguity. Autopilot unlocks continuous authorization and lets your team focus on mission-critical security work instead of paperwork cycles.

And regardless of mode: the ATO is yours. The machine does the work. The human makes the call.

Key Takeaways

• The ATO decision is always human --- hardcoded, not configurable. No mode, no policy, no organizational setting can delegate it to automation.
• Three modes (Copilot, Tiered, Autopilot) match different organizational maturity levels. There is no penalty for running in Copilot permanently.
• Tiered mode eliminates documentation drudgery while keeping risk decisions under human control --- the sweet spot for most programs.
• Autopilot mode enables continuous authorization (cATO) for organizations with codified, mature compliance policies.
• The system fails closed: unrecognized steps always park for human approval, even in Autopilot mode.
• Every action generates a tamper-protected, cryptographically receipted audit trail documenting who or what acted and under what governance constraints.

FAQ

Can we mix modes across different information systems?

Yes. Mode selection is per-information-system, not organization-wide. A high-impact system processing classified data might run in Copilot permanently, while a low-impact internal tool runs in Autopilot. This reflects the reality that not every system in a portfolio carries the same risk profile, and the automation posture should be proportional to the consequence level of the system it supports.

What happens if the automation makes a mistake in Tiered or Autopilot mode?

Every automated action generates an audit record with full context, and the system's governance controls bound the blast radius. Low-consequence automated steps (drafting a narrative, formatting a POA&M entry) produce outputs that are visible in the audit trail and reviewable after the fact. If a draft narrative is incorrect, the error surfaces at the next human review point --- it does not cascade into authorization decisions because the authorize step always requires human approval regardless of mode. The fail-closed design means the system never automates actions it cannot confidently classify.

How does this relate to DoD's continuous authorization (cATO) guidance?

Autopilot mode is the operational foundation for cATO. Traditional RMF treats authorization as a point-in-time event with a three-year cycle. cATO treats it as a continuously maintained state. Autopilot keeps the authorization package current in real time --- controls continuously assessed, documentation continuously updated, deviations continuously flagged --- so the AO reviews a living posture rather than a stale snapshot. The system provides the continuous monitoring and evidence that cATO requires; the AO still owns the authorization decision.

Is Copilot mode just a slower version of Tiered mode?

No --- it is architecturally different. In Tiered mode, low-consequence steps execute without human intervention and the human reviews only risk-bearing decisions. In Copilot mode, every step --- including mechanical formatting and data population --- parks for explicit approval. This gives the organization full visibility into what the automation does at every level of granularity. Copilot is not "Tiered with a slow approval workflow." It is a different trust posture appropriate for organizations that have not yet built confidence in the automation's behavior on routine tasks.

What compliance evidence does the audit trail produce for assessors?

The audit trail directly produces evidence for several NIST 800-53 controls: AU-2 (auditable events), AU-3 (content of audit records), AU-6 (audit review and reporting), AU-10 (non-repudiation via cryptographic receipts), and the human oversight dimension of AI governance required by MANAGE-1.3 in the AI RMF. Assessors reviewing the authorization package can verify, action by action, that automation operated within defined boundaries and that human oversight was maintained for every risk-bearing decision. The trail is append-only and tamper-protected --- it cannot be retroactively edited to conceal automation overreach.

How Advisedly Helps

Advisedly's RMF automation engine gives your team all three modes with a single configuration switch per information system. The engine maps to NIST SP 800-53 controls, produces cryptographic enforcement receipts for every action, maintains an append-only audit trail, and integrates with 500+ compliance frameworks for cross-framework control mapping. AI recommends, humans approve --- and the AO decision is never delegated to a machine. Your team reclaims the mechanical hours while retaining full authority over risk decisions. Contact begin@advisedly.ai to see which mode fits your program.