Risk Management Framework documentation is the second-largest non-engineering workload on a typical DoW program, behind only test and evaluation. It's also the most automation-amenable workload we touch. The artifacts are templated. The inputs (control catalog, system telemetry, configuration management baseline, vulnerability scans) already exist in machine-readable form. The human review steps are almost entirely verification, not authoring.
The agents are very good at this. The trick is not summarization; it's source-grounded generation tied to control-mapping evidence the human can verify. Every claim the agent makes in an artifact has to cite the underlying scan output, configuration record, or interview transcript. Claims without citations are flagged and don't make it to draft.
On a recent program we collapsed the RMF artifact-generation cycle from a six-week cadence to roughly six days. The savings come from three places. First, the agent never has to wait for an engineer to start a section. Second, structured cross-checks between artifacts (does the SSP claim match the actual configuration?) run automatically. Third, the draft that lands on an engineer's desk is already shaped; they edit and verify rather than compose.
The engineers stay in the loop where they add value. Judgment about the right control implementation. Negotiation with the security control assessor. Decisions on residual risk acceptance. None of that gets delegated. The 80% of the work that was stenography gets delegated.
We treat the agent's outputs the same way we treat any other engineering artifact under CMMI Level 3. The drafts go into the configuration management baseline. Reviewer comments are tracked. Approval is signed. Drift detection runs between releases. This is the boring part of the work, and it is the part that makes the system defensible at acceptance review.