Toward a Framework for Behavioral Assurance in AI: Integrating SCAB and PRIS for Risk Mitigation

Artificial intelligence (AI) systems are increasingly integrated into everyday life, influencing education, healthcare, governance, and personal decision-making. Yet, existing security and assurance frameworks, including those from the National Institute of Standards and Technology (NIST) and ISO/IEC, were developed for traditional data-centric threats and remain inadequate for behavioral and cognitive risks posed by generative AI and autonomous agents. This paper introduces the SCAB Protocol (Sovereignty, Coherence, Alignment, Boundaries, Agency, Probity) and the PRIS Protocol (Psychosis Risk Interaction Score) as complementary frameworks to address these risks. SCAB establishes system-level behavioral assurance by embedding six domains of ethical and operational safeguards, while PRIS provides runtime psychosis-risk evaluation of human–AI interactions. The combined framework expands traditional information assurance toward behavioral assurance, offering a dual-layer defense against emergent harms. Drawing on parallels to information assurance models in the Internet of Things (IoT), this paper introduces the concept of Behavioral Assurance Profiles (BAPs) for sector-specific applications. Use cases are presented in education, healthcare, governance, and public safety. The findings underscore the urgency of adopting behavioral assurance as a core principle in AI governance and call for the development of standards and certification regimes akin to cybersecurity frameworks but tailored to cognitive safety.人工智能（AI）系统正日益融入日常生活，对教育、医疗、治理与个人决策产生深远影响。然而，现有安全与保障框架——包括美国国家标准与技术研究院（National Institute of Standards and Technology, NIST）以及国际标准化组织/国际电工委员会（ISO/IEC）制定的框架——均是针对传统以数据为中心的威胁所开发，无法有效应对生成式AI (Generative AI)与自主智能体带来的行为与认知风险。本文提出SCAB协议（主权、一致性、对齐、边界、智能体、正直，对应英文Sovereignty, Coherence, Alignment, Boundaries, Agency, Probity）与PRIS协议（精神病风险交互评分，对应英文Psychosis Risk Interaction Score），作为应对上述风险的补充框架。其中，SCAB协议通过嵌入六大伦理与运行保障维度，构建系统级行为保障体系；PRIS协议则可对人类-AI交互开展运行时精神病风险评估。二者结合的框架将传统信息保障范畴拓展至行为保障领域，可为涌现性危害提供双层防御机制。本文借鉴物联网（Internet of Things, IoT）中的信息保障模型范式，提出面向特定行业应用的行为保障概要（Behavioral Assurance Profiles，简称BAPs）概念，并展示了该框架在教育、医疗、治理与公共安全领域的应用案例。研究结果凸显了将行为保障作为AI治理核心原则的紧迫性，并呼吁构建类似网络安全框架、但专为认知安全打造的标准与认证体系。