Trustworthy AI Posture (TAIP): A Framework for Continuous AI Assurance of Agentic Systems at Horizontal and Vertical scale

TL;DR

This paper introduces TAIP, a comprehensive framework for continuous, scalable AI assurance that addresses the challenges of dynamic environments and heterogeneous systems by leveraging ontologies and automation.

Contribution

It presents a novel ontology-based approach and a reusable assurance cycle to enable scalable, automated trustworthiness assessment for agentic AI systems.

Findings

Identified a posture readiness gap across frameworks

Demonstrated claim decomposition and evidence binding in a real use case

Enabled scalable trust signal generation at machine speed

Abstract

The emergence of autonomous, high-velocity Agentic AI systems is creating an internal assurance scalability crisis. Point-in-time, document-based audits cannot keep pace with non deterministic behaviour and distributed deployments of agents across rapidly evolving environments. The crisis is dual-scale: vertically, governance and control obligations change faster than frameworks can operationalise them; horizontally, assurance mechanisms fail to scale across complex, heterogeneous systems and evidence sources. Risk-based regulation now requires organisations to demonstrate ongoing control adequacy and effectiveness, yet existing Trustworthy AI Assurance and Audit frameworks remain fragmented and largely manual. Drawing on the evolution of cybersecurity posture management, this paper reframes trustworthiness as a continuously generated signal rather than a static certificate. It contributes 1) A Trustworthy AI Assurance Ontology modelling the end-to-end pathway from regulatory obligation to verifiable evidence 2) An ontology-driven, evidence-gated benchmark of thirteen leading frameworks, revealing a posture readiness gap 3) The Trustworthy AI Posture (TAIP) framework, which operationalises the NIST AI RMF Test,Evaluate,Verify,Validate (TEVV) cycle as reusable AI Assurance Objects. TAIP decouples policy content ('what') from execution semantics ('how'), enabling composable, automatable assurance across jurisdictions and agentic systems. Evidence from heterogeneous tools is normalised and recursively aggregated into posture at claim, system, organisational, and ecosystem levels. A use case mapping Australian AI Guardrails to Microsoft 365 Copilot demonstrates claim decomposition, evidence binding, and posture computation in practice. By standardising execution while allowing policy variation, TAIP enables scalable, machine-speed trust signal generation.