AI Deployment Stops at the Authorization Boundary
A client-ready view of what FedRAMP reuse buys a federal AI service, what stays agency work, and why the evidence packet, not the demo, sets the production date.
It is safe to say yes to a federal AI service only on the near side of the authorization boundary: uses that fit an actively maintained FedRAMP package at or below the right FIPS 199 impact level, with agency-side configuration, monitoring, and evidence owned from day zero, can move now; anything that changes the data class, crosses an impact level, or needs a net-new authorization stays a bounded pilot with a declared route, budget, and expiration.
The deployable line
An actively maintained FedRAMP package at or below the agency's FIPS 199 level carries a presumption of adequacy. Reuse cuts duplicated assessment work.
The agency still authorizes its own system: configuration, identity, integrations, contract terms, and agency-responsible controls, with named owners.
A bounded use can run under a temporary authorization with an explicit expiration and a stated plan to convert to full authorization or terminate.
No existing package fits the data or impact level. Sponsor capacity and funding become the critical path before any production date.
Owner, briefing, proof
Owner
Named authorizing official plus owners for agency-responsible controls, configuration, and continuous-monitoring review.
Briefing
Authorization-route decision brief: reuse, temporary pilot, or net-new, with the FIPS 199 category or DoD impact level named.
Proof
An evidence packet a risk owner can accept: boundary, data flows, controls, configuration, model updates, logs, and incident path.
What leaders should take from it
OMB M-24-15 makes an agency presume an actively maintained package adequate at or below its FIPS 199 level, and it preserves the agency head's FISMA responsibility. The agency still authorizes its own system and intended use.
NIST's Risk Management Framework runs categorization through continuous monitoring as one process, and the reuse presumption holds only while ongoing requirements stay maintained.
FIPS 199 categorization and DoD impact levels IL2 through IL6 can make a technically usable AI service unsuitable for the proposed data or identity path.
GAO reports provider cost estimates of $300,000 to $3.7 million, and agencies describing products delayed or unprocurable when providers would not pursue authorization. These are estimates and reported barriers, not a standard price.
OMB and FedRAMP 20x point toward automated, continuous authorization evidence. The published five-week figure measures agency review and 80% automation is a goal, so plan from the specific service and route, not a program headline.
- "FedRAMP authorization means the agency can deploy the service" is not supported; the agency's own risk decision and monitoring duties remain.
- "FedRAMP takes X months" has no public end-to-end evidence base; plan from the specific service, data class, impact level, and route.
- "Authorization is already mostly automated" overstates FedRAMP 20x; 80% automation is a goal and the higher-impact path remains prospective.
First moves before hiring anyone
Record the FIPS 199 category, the DoD impact level where relevant, data flows, identity path, and prohibited data. This decides whether a usable AI service is usable for this workload.
Do not call all three a pilot. State the evidence already reusable, the agency work left, the temporary-use expiration rule, and who pays for the gaps.
Keep the architecture, data flows, inherited-control matrix, secure configuration, model-update process, logging, incident path, and evidence owner in one maintained packet.
Assign owners for configuration, agency-responsible controls, contract language, package review, logs, vulnerability management, and continuous-monitoring review.
Machine-readable, continuously produced evidence is the design direction. It cuts friction only if the delivery process produces it as the service ships.
Start with one AI use, one data classification, and one authorization route. If the route is unclear, map the intended use against existing packages and impact levels first, and build the evidence packet inside delivery, not as a review after the demo works.
Claim ledger
- FedRAMP publishes audited elapsed-time, cost, rework, or reuse data by impact level for 20x or agency authorizations.
- Final Consolidated Rules or a revised 20x schedule materially changes the Low, Moderate, or High certification paths.
- Agency GRC tools produce and ingest machine-readable OSCAL authorization and monitoring artifacts in routine use.
- Temporary AI pilot authorizations disclose whether they convert to full authorization or terminate at the 12-month limit.
- A published oversight report shows reuse materially reducing, or failing to reduce, agency authorization effort and deployment delay.