FedRAMP and GovRAMP: Evidence as a Command

Government buyers judge how software is built and tested, not only what it does. We put those controls where every AI agent reads them, and made the evidence a command. FedRAMP and GovRAMP decide whether government can buy a cloud product. FedRAMP covers federal agencies and became law in 2022; GovRAMP, called StateRAMP until 2025, covers states, local governments and schools. FedRAMP and GovRAMP both certify that a named system inside a stated boundary meets a fixed set of security controls from the NIST SP 800-53 catalog and keeps meeting them. Where a buyer requires the authorization, a sale without it at the right level does not happen, and the level follows the data: health, benefits and public-health systems sit at Moderate or High. FedRAMP and GovRAMP both look past the running product to who can change the code, where it is built and tested, what it depends on, and whether the release that ships is the one that was tested, because an attacker who changes the build reaches every customer at once. The Collective's software is written mostly by AI agents, so the agents and the machines they use are part of the system. The Collective put those controls into the rules every agent reads before it writes a line, and into the machinery that runs each build. Every change is tested on machines the Collective owns, releases are built in a single-use container with no secrets, and each release carries a list of its components and a record of where it was built. One command prints a line per control and fails the build on any gap, so the check an assessor would run is the one that blocks a bad merge. Four items of that work are still open, among them code signing for installers and a register of outside suppliers. The Collective's compliance work carries forward to MARA, the planned clinical assistant, which would need these controls and HIPAA before any patient depends on her. Article ART-CLD-012. Originally published at https://www.maxresearchcollective.com/articles/fedramp-and-govramp.html