Frame the system
Define intended purpose, context, actors, affected communities, benefits, and plausible harms.
NIST AI RMF WORKING-GROUP SIMULATION
Cedarwell Bank:
The 72-Hour Decision
A regulator is coming. A lending model has changed without approval. Customer harm may already be occurring. Your working group must decide what continues, what is restricted, and what stops.
Training simulation: Cedarwell Bank, its people, vendors, systems, and data are fictional. Laws, standards, and framework references are real.
LEARNING DESIGN
Practice judgment, not vocabulary
Participants use incomplete evidence, competing incentives, and real constraints to apply the NIST AI RMF as an operating discipline.
Interrogate evidence
Separate what is known, inferred, missing, disputed, and time-sensitive.
Make a decision
Connect measurements and risk tolerance to a defensible operating decision.
Leave an audit trail
Record owners, conditions, residual risk, monitoring, escalation, and review dates.
THE CASE
A growth strategy meets an evidence problem
Cedarwell Bank is a privately held U.S. regional bank with a fast-growing digital subsidiary. Its AI portfolio expanded system by system; governance did not.
It is Monday, 8:15 a.m. You have been asked to lead a temporary AI Risk Working Group reporting to Chief Risk Officer Elena Marquez.
On Friday evening, Internal Audit reopened a high-rated model-change finding. The current small-business lending model was promoted three weeks ago without independent validation. Early monitoring suggests a material approval-rate gap, but the data pipeline cannot reproduce the production sample.
At 9:40 p.m., the bank's generative customer assistant gave a borrower an incorrect explanation for a credit decline. The answer contradicted the official adverse-action notice. Customer Operations initially classified the event as a “content quality issue,” not a compliance incident.
On Thursday morning, examiners will meet management for a previously scheduled model-risk review. The CEO wants growth targets protected. The Risk Committee wants an evidence-based recommendation before the meeting.
“Do not give me a maturity score. Tell me what is safe enough to continue, under which conditions, and who is accepting the residual risk.”— Elena Marquez, Chief Risk Officer
CEO: growthCRO: defensibilityCDAO: speedCompliance: obligationsModel Risk: validationCustomers: explanation & appeal
THE PEOPLE
Fourteen people. Competing incentives.
You will deal with these people during the session, directly or through the exhibits. A recommendation that ignores their wants will not survive Thursday.
| Name | Role | What they want | What you should know |
|---|
AI ESTATE
Nine systems. Different contexts. Different evidence.
EVIDENCE ROOM
Read against the grain
The exhibits are deliberately incomplete and occasionally contradictory. The quality of the decision depends on how the team handles uncertainty—not on inventing facts.
RMF WORKBENCH
Build the reasoning chain
Use the four functions as a connected loop. GOVERN is cross-cutting; MAP establishes the context; MEASURE tests the claims; MANAGE turns evidence into action.
DECISION BOARD
Record the operating decision
0 / 3 decisions recorded
For the three priority systems, select a provisional decision and document the minimum rationale. Your work is saved only in this browser.
Ready
MASTERY PORTFOLIO
From workshop output to professional evidence
Twenty-seven artifacts, organized under GOVERN, MAP, MEASURE, and MANAGE. Each should demonstrate judgment, traceability, and practical implementation for a financial-services AI estate — not merely reproduce framework language.
| ID | Portfolio artifact | Primary RMF mapping | Quality signal | Template |
|---|
The portfolio rule
If the artifact could be pasted into any bank without changing the systems, people, evidence, thresholds, or decisions, it is not yet portfolio quality.
COVERAGE MAP
What evidence exists for which RMF outcome
Computed directly from the 27 artifacts above — every subcategory at least one artifact maps to, and how many artifacts back it.
| Subcategory | Artifacts mapped | Depth |
|---|
ARTIFACT BUILDER · PILOT
Build the artifact, don't just read the template
A deterministic, step-by-step guide through one artifact at a time — no generative AI. Cedarwell's worked example stays visible as a reference; the field you fill in is for your own organization. Four of the 27 artifacts are interactive so far.
Step 1 of 3
Ready
Your answers save only in this browser. To hand off to a teammate or pick up on another device, export a workspace file and import it there.
FACILITATOR VIEW
A 120-minute collaborative session
This demo supports a remote or in-person working group of 6–24 participants. It intentionally stops short of publishing a model answer.
Frame the mandate
Assign the team as an advisory working group. Emphasize evidence, decision rights, and the 72-hour clock.
Read and triage
Individuals scan the case and exhibits. Team records facts, inferences, gaps, conflicts, and time-sensitive items.
MAP the context
Breakouts analyze one priority system: purpose, actors, affected groups, harms, benefits, dependencies, and assumptions.
MEASURE the claims
Define the evidence needed to support trustworthiness and determine what can and cannot be concluded now.
MANAGE the decision
Choose continue, restrict, or pause. Add conditions, owner, residual risk, monitoring, and escalation.
Defend and debrief
Teams present. Peers challenge assumptions. Close by identifying reusable portfolio artifacts and learning gaps.
Debrief questions
- Which missing fact could most change your decision?
- Where did business urgency distort evidence standards?
- Who bears the residual risk—and who had a voice?
- What would trigger an automatic restriction or shutdown?
- Which GOVERN weakness allowed the incident to occur?
Facilitator watch-outs
- Do not let teams collapse AI risk into legal compliance alone.
- Challenge “human in the loop” unless authority, competence, time, and override behavior are defined.
- Ask whether aggregate performance hides subgroup harm.
- Require a non-AI alternative to be considered.
- Reward explicit uncertainty; penalize invented evidence.
AUTHORITATIVE SOURCES
Framework foundation
The simulation operationalizes NIST guidance; it is not affiliated with or endorsed by NIST.
NIST AI RMF hubFramework, roadmap, crosswalks, and updates ↗
NIST AI 100-1Artificial Intelligence Risk Management Framework 1.0 ↗
AI RMF PlaybookSuggested actions for Core outcomes ↗
Generative AI ProfileNIST AI 600-1 ↗
Demo v0.0.0 · Prepared for collaborative learning and portfolio development · Framework status should be rechecked before each cohort.