Industry Vocabulary Reference

Government & Public Sector

Comprehensive enumeration library for the Government & Public Sector vertical. Covers every subdomain where agentic AI is actively deployed as of March 2026: FedRAMP cloud authorisation and NIST SP 800-53 Rev 5 control family compliance monitoring, OMB M-24-10 AI governance for federal agencies, FIPS 140-3 cryptographic module compliance, AI accountability use case classification for high-impact government AI, federal procurement and acquisition AI (FAR/DFARS), benefits eligibility and public services delivery, law enforcement and criminal justice AI governance, immigration adjudication, open government data and FOIA automation, and EU public sector AI governance (EU AI Act Annex III, GDPR Art 22, EU AI Act Art 14). Designed for use as OTel span attributes in an agentic AI SDK and as policy vocabulary in an OPA Rego GRC portal.

Back to industry coverage library

How to use this reference

1. Start with the core file if you need the cross-industry governance baseline.
2. Then move into the vertical file to see the regulated workflow vocabulary, policy surfaces, and implementation pressure unique to this market.
3. Use the OTel attributes and policy paths here as the common language across SDK instrumentation, governance review, and evidence export.

March 2026 deployment context

As of March 2026, agentic AI in government and public sector is deployed across: automated benefits eligibility determination (Social Security, Medicaid, SNAP, unemployment insurance), AI-driven immigration document review and risk scoring (USCIS, CBP), predictive law enforcement tools (crime forecasting, recidivism risk scoring), AI-assisted procurement and contract vehicle management (GSA, DoD), automated FOIA request triage and redaction, AI-powered citizen services chatbots and case routing (VA, SSA, IRS), fraud detection and improper payment prevention (OMB paymentaccuracy.gov), federal cybersecurity threat detection (CISA CDM programme), AI-assisted legislative drafting and regulatory analysis, and open data portal AI (Data.gov, DOGE-related automation). OMB M-24-10 (March 2024) requires every federal agency to: designate a Chief AI Officer (CAIO), conduct annual inventories of all AI use cases, complete minimum risk practices for rights-impacting and safety-impacting AI by December 2024, and publish AI use case inventories. EO 14110 requires agencies with AI use in critical infrastructure or national security to conduct safety evaluations and report to OMB. The EU AI Act Annex III paras 5–7 explicitly classify AI used in public benefits administration, law enforcement, migration, and border control as high-risk.

Risk note: OMB M-24-10 Section 5 establishes minimum risk management practices for 'rights-impacting' and 'safety-impacting' AI — AI that meaningfully impacts the rights, opportunities, or access to critical resources of members of the public, or that could threaten the life or safety of individuals. These practices include: independent assessments before deployment, ongoing monitoring, testing for bias and disparate impact, providing human alternatives and timely human review, and public disclosure. Federal agencies that deploy such AI without completing these practices must pause or halt use. The EU AI Act Article 6(2) and Annex III para 5(a) make AI systems determining access to public benefits and services a high-risk category — applying from August 2, 2026 with a 12-month grace period for systems already in service. The Council of Europe AI Convention (CETS 225), which the US, EU member states, and other signatories opened for signature in September 2024, creates binding human rights obligations for AI across public and private sector applications.

Loading Model

• Mirrored file: 09_vertical_government_public_sector.json
• Kind: vertical

OTel Namespaces

Primary Standards

• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations (2020)
• NIST SP 800-53B — Control Baselines for Information Systems (2020)
• NIST SP 800-37 Rev 2 — Risk Management Framework (RMF) for Information Systems (2018)
• NIST SP 800-171 Rev 3 — Protecting CUI in Nonfederal Systems (2024)
• NIST AI RMF 1.0 — AI Risk Management Framework (2023)
• NIST AI 600-1 — Generative AI Profile (2024)
• FedRAMP Rev 5 — Federal Risk and Authorization Management Program (GSA/OMB, 2023)
• FedRAMP Authorization Playbook — Agency and JAB authorisation processes
• FIPS 140-3 — Security Requirements for Cryptographic Modules (2019)
• FIPS 199 — Standards for Security Categorization of Federal Information and Information Systems
• FIPS 200 — Minimum Security Requirements for Federal Information and Information Systems
• OMB M-24-10 — Advancing Governance, Innovation, and Risk Management for Agency Use of AI (March 2024)
• OMB M-23-22 — Delivering a Digital-First Public Experience (September 2023)
• OMB M-22-09 — Moving the US Government Toward Zero Trust Cybersecurity Principles
• OMB M-21-31 — Improving the Federal Government's Investigative and Remediation Capabilities (log retention)
• EO 14110 — Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (October 2023)
• EO 14028 — Improving the Nation's Cybersecurity (May 2021)
• CISA JCDC AI Cybersecurity Collaboration Playbook (2024)
• FAR Part 12/39 — Federal Acquisition Regulation for IT and AI procurement
• DFARS 252.204-7012 — Safeguarding Covered Defense Information
• EU AI Act (2024/1689) Annex III para 5 — High-risk AI in public services and law enforcement
• EU AI Act (2024/1689) Annex III para 6 — High-risk AI in law enforcement
• EU AI Act (2024/1689) Annex III para 7 — High-risk AI in migration, asylum, border control
• EU GDPR Article 22 — Automated individual decision-making including profiling
• EU NIS2 Directive (2022/2555) — Essential and important entities in public administration
• Council of Europe Framework Convention on AI (CETS 225) — Opened for signature September 2024
• G7 Hiroshima AI Process — Guiding principles for advanced AI systems (2023)
• OECD Principles on AI (2019, updated 2024)
• UN General Assembly Resolution A/RES/78/311 — International AI Governance (March 2024)

Source URLs

• https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
• https://www.fedramp.gov/
• https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management.pdf
• https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence/
• https://csrc.nist.gov/publications/detail/ai/100-1/final
• https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689

Subdomains

Implementation examples

• FedRAMP & Cloud Security Authorisation: Fed RAMPAuthorization Status. OPA policy blocks any AI agentic workflow from routing federal data to a cloud-based AI service whose FedRAMP authorisation status is not 'authorized_agency', 'authorized_jab', or 'authorized_with_conditions'. 'Revoked' status triggers immediate data routing halt and CISO notification. (Fedramp Rev5: FedRAMP Rev 5 — Cloud services processing federal data at Low, Moderate, or High impact levels require FedRAMP authorisation)
• FedRAMP & Cloud Security Authorisation: FIPSSecurity Level. AI agent security posture registry records the FIPS security level of all cryptographic modules used by the agent. OPA policy enforces that AI agents processing CUI must use Level 2 or above. AI agents in physically unprotected field deployments processing classified data require Level 4. (Fips 140 3: FIPS 140-3 — Cryptographic module validation; federal agencies must use validated modules for all cryptographic operations)
• NIST SP 800-53 Control Compliance Monitoring: NISTSPControl Family. AI continuous monitoring agent generates automated evidence for each NIST SP 800-53 control it can assess. Evidence records are tagged with control family and specific control ID (e.g. AC-2, AU-6) for ingestion into eMASS or equivalent agency GRC platform.
• NIST SP 800-53 Control Compliance Monitoring: Continuous Monitoring Frequency. FedRAMP ConMon requires monthly vulnerability scanning, annual penetration testing, and continuous log monitoring. AI compliance agents schedule and execute control assessments at the required frequency and generate evidence with timestamp and frequency classification for the FedRAMP PMO.

Illustrative policy patterns

package government.ai_accountability

rights_impacting_use_cases := {
  "benefits_eligibility_determination",
  "law_enforcement_predictive_policing",
  "law_enforcement_facial_recognition",
  "parole_sentencing_risk_scoring",
  "immigration_adjudication",
  "immigration_border_risk_screening",
  "child_welfare_risk_scoring"
}

blocking_practice_statuses := {
  "not_started",

package government.benefits

adverse_decisions := {
  "initial_eligibility_denied",
  "recertification_denied",
  "benefit_suspension",
  "benefit_termination",
  "overpayment_determination",
  "fraud_referral"
}

deny[msg] {
  input.government_benefits_eligibility_decision_type in adverse_decisions
  not input.human_caseworker_reviewed == true

From enum to evidence

The same vocabulary should carry from instrumentation through review. The OTel attribute names here become emitted metadata, those attributes become policy inputs, and those same labels should still be intelligible when a reviewer opens the decision record later.

import { VeriproofClient, VeriproofSdkOptions, SessionMetadata } from '@veriproof/sdk-core';
import { FedRAMPAuthorizationStatus, FedRAMPAuthorizationStatusMeta, FIPSSecurityLevel, FIPSSecurityLevelMeta, FISMAImpactLevel, FISMAImpactLevelMeta } from '@veriproof/sdk-core/verticals/government-public-sector';

const client = new VeriproofClient(
  VeriproofSdkOptions.createProduction({
    apiKey: process.env.VERIPROOF_API_KEY!,
    applicationId: 'government-public-sector-production',
  }),
);

const session = client
  .startSession('government-public-sector.review')
  .withSessionMetadata(SessionMetadata.forTransaction('txn-1001').withEnvironment('production'))
  .addStep('evaluate_workflow', { output: { status: 'completed' } })
  .withMetadata(FedRAMPAuthorizationStatusMeta.otelAttribute, FedRAMPAuthorizationStatus.in_process)
  .withMetadata(FIPSSecurityLevelMeta.otelAttribute, FIPSSecurityLevel.level_1)
  .withMetadata(FISMAImpactLevelMeta.otelAttribute, FISMAImpactLevel.low)

await session.complete();

• SDK: emit the OTel attribute shown on this page during the decision workflow.
• Policy: reference the matching `opa_policy_path` in governance rules.
• Evidence: surface the same label and value in the portal and exported record so reviewers are not translating between systems.

For a step-by-step getting-started walkthrough specific to this vertical, open the Government & Public Sector SDK quick start. For the full core API reference, continue with TypeScript, Python, or .NET.

Highlighted Enum Categories

This reference page is rendered from the mirrored JSON file inside the docs app, not from a hand-written website model.

If you need the machine-readable asset for offline review, automation, or internal diffing, use the mirrored JSON download above.

Next: open the corresponding SDK reference under SDK documentation and then compare it with the public-site industry page to see how the same vocabulary is framed commercially.