For most of the last two years, the binding constraint on AI for RMF work wasn't model quality; it was context length. ATO packages are large. A typical IL4 system has on the order of 300–500 pages of authoring across SSP, SAR, POA&M, and continuous-monitoring artifacts. Retrieval helped, but retrieval is lossy: you can answer the question the chunks let you answer, not the question the system architect actually has.
Long-context reasoning models, the 1M-token tier, change the workflow. We've started running entire packages through a single inference pass alongside the relevant subsets of NIST SP 800-53 Rev 5 and the system's recent vulnerability scan output. The model can produce a single document that answers questions like 'which AU- and AC-family controls are weakened by the new firewall rule that landed yesterday?' That's a question retrieval RAG handled poorly because the right answer requires reading two artifacts and the control descriptions together.
The practical pattern we've settled on: a planner agent assembles the working set (package + relevant controls + recent telemetry), a reasoning pass produces a draft, and an evaluator agent checks the draft against a structured rubric before it ever reaches an engineer. The engineer reviews the structured output, not the raw model response.
Two things we underestimated. First, prompt caching at this scale matters more than the model. Hitting a fresh 1M-token context every time is prohibitively expensive; the cache hit rate on the static parts of the package (the SSP, the controls) is what makes this economically viable. Second, the evaluator agent is doing more work than the author agent. Our acceptance rate on first-draft RMF artifacts is roughly 60%; the other 40% are caught by the evaluator and routed for revision before a human sees them.
Where this still falls down: anything that requires reading code, especially low-level C/C++ in a sustainment program. Long-context models will read the file and miss the build-time #define that flips the behavior. We treat code-aware RMF questions as a separate workflow with a different toolchain.