{ "version": "1.0.0", "controls": [ { "id": "CTL-IDENTITY", "layerId": "identity-access", "order": 1, "name": "Unique workload identity", "objective": "Give each agent runtime and service hop an attributable non-human identity instead of a shared account.", "functions": ["prevent", "detect"], "implementation": "Issue a distinct workload identity per agent role and environment; bind delegated user context separately and reject anonymous production tool calls.", "verification": "Attempt a production-like tool call with no workload identity, a sibling identity and the intended identity; confirm only the intended identity succeeds and each decision is attributable.", "evidenceArtifacts": ["Identity inventory with environment and owner", "Denied and allowed authorization decision records"], "suggestedOwnerRole": "Identity platform owner", "releaseGateWhenRequired": true, "standardRefs": ["C9.4.1"], "sourceIds": ["S03", "S04", "S06", "S12"], "claimIds": ["C02", "C12", "C20"] }, { "id": "CTL-SCOPED-TOKENS", "layerId": "identity-access", "order": 2, "name": "Short-lived audience-bound credentials", "objective": "Limit credential reuse by constraining lifetime, audience and scope to the exact resource operation.", "functions": ["prevent", "contain", "recover"], "implementation": "Mint short-lived tokens for the intended resource server and minimum operation; validate issuer, audience and expiry; prohibit token passthrough and keep revocation available.", "verification": "Replay expired, wrong-audience, over-scoped and forwarded tokens against the resource boundary and confirm fail-closed rejection without downstream forwarding.", "evidenceArtifacts": ["Token policy showing lifetime, audience and scopes", "Negative authorization test results", "Credential revocation procedure"], "suggestedOwnerRole": "Identity and access engineer", "releaseGateWhenRequired": true, "standardRefs": ["C5.1.2", "C9.4.3", "C10.2.7"], "sourceIds": ["S05", "S06", "S12"], "claimIds": ["C04", "C20"] }, { "id": "CTL-POLICY-DECISION", "layerId": "identity-access", "order": 3, "name": "Deterministic policy decision point", "objective": "Keep permission decisions outside probabilistic model output.", "functions": ["prevent", "detect"], "implementation": "Evaluate subject, tenant, tool, operation, arguments, resource, user delegation and current policy in a deterministic enforcement service before every privileged call.", "verification": "Submit model requests that ask to bypass policy, change arguments after approval or use an unauthorized resource; confirm the enforcement point denies each call.", "evidenceArtifacts": ["Versioned authorization policy", "Policy decision test suite", "Decision log samples with policy version"], "suggestedOwnerRole": "Authorization service owner", "releaseGateWhenRequired": true, "standardRefs": ["C5.2.5", "C9.5.3"], "sourceIds": ["S03", "S04", "S05", "S12"], "claimIds": ["C03", "C20"] }, { "id": "CTL-TENANT-BOUNDARY", "layerId": "identity-access", "order": 4, "name": "Tenant-bound authorization context", "objective": "Prevent shared agent infrastructure from resolving data, memory or tools outside the active tenant.", "functions": ["prevent", "detect", "contain"], "implementation": "Carry an immutable tenant identifier from authenticated request through retrieval, memory, policy and tool calls; separate tenant keys and deny missing or conflicting scope.", "verification": "Run cross-tenant negative tests for retrieval, cache, memory and tool resources, including forged and absent tenant identifiers; confirm denial and alerting.", "evidenceArtifacts": ["Tenant data-flow diagram", "Cross-tenant isolation test report", "Tenant-scoped key and policy inventory"], "suggestedOwnerRole": "Application security owner", "releaseGateWhenRequired": true, "standardRefs": ["C8.1.3"], "sourceIds": ["S01", "S04", "S06", "S12"], "claimIds": ["C02", "C12", "C20"] }, { "id": "CTL-CONTENT-TRUST", "layerId": "input-instruction", "order": 1, "name": "Content trust, classification and minimization", "objective": "Preserve origin and trust while classifying, minimizing and redacting sensitive fields before content reaches model context, memory, logs or tools.", "functions": ["prevent", "detect"], "implementation": "Normalize supported encodings, retain source metadata, label external data as untrusted, classify sensitive fields and minimize or redact them before model context, memory, logs and tool calls; preserve trust labels across later boundaries.", "verification": "Feed encoded, nested and relayed content containing seeded sensitive fields through every ingestion and propagation path; confirm normalization, classification and trust labels persist while disallowed fields are absent from model context, memory, logs and tool payloads.", "evidenceArtifacts": ["Input trust and data-classification taxonomy", "Normalization and sensitive-field redaction corpus results", "End-to-end provenance and data-minimization trace"], "suggestedOwnerRole": "AI application engineer", "releaseGateWhenRequired": true, "standardRefs": ["C2.1.1", "C2.1.2", "C9.3.7"], "sourceIds": ["S01", "S03", "S04", "S09", "S12"], "claimIds": ["C01", "C02", "C19", "C20"] }, { "id": "CTL-INSTRUCTION-HIERARCHY", "layerId": "input-instruction", "order": 2, "name": "Instruction and data separation", "objective": "Prevent retrieved or tool-returned content from silently acquiring system-level authority.", "functions": ["prevent", "detect"], "implementation": "Represent system policy, user intent and untrusted data in separate fields; delimit external content; refuse instructions originating from data fields and test conflict handling.", "verification": "Use direct and indirect injection cases that conflict with system and user intent; confirm external text cannot alter policy or authorize a capability.", "evidenceArtifacts": ["Prompt and message-boundary specification", "Injection evaluation results", "Documented conflict-handling behavior"], "suggestedOwnerRole": "AI application security engineer", "releaseGateWhenRequired": true, "standardRefs": ["C2.1.3", "C2.1.6"], "sourceIds": ["S01", "S02", "S03", "S04", "S09", "S12"], "claimIds": ["C01", "C15", "C20"] }, { "id": "CTL-OUTPUT-SCHEMA", "layerId": "input-instruction", "order": 3, "name": "Schema-bound boundary output", "objective": "Reject free-form model or tool output before it becomes executable input to another component.", "functions": ["prevent", "detect"], "implementation": "Define strict schemas for tool arguments, tool results and agent messages; reject unknown fields, invalid types, oversized values and instructions in data-only fields.", "verification": "Fuzz each schema with extra fields, type confusion, oversized payloads and instruction-bearing strings; confirm invalid records never reach an execution boundary.", "evidenceArtifacts": ["Versioned boundary schemas", "Schema fuzz-test report", "Rejected-payload telemetry sample"], "suggestedOwnerRole": "Platform API owner", "releaseGateWhenRequired": true, "standardRefs": ["C9.3.2", "C10.4.1", "C10.4.2", "C10.4.3", "C10.4.4", "C10.4.5"], "sourceIds": ["S03", "S04", "S12"], "claimIds": ["C02", "C03", "C20"] }, { "id": "CTL-UNTRUSTED-ISOLATION", "layerId": "input-instruction", "order": 4, "name": "Untrusted-content processing isolation", "objective": "Break the direct path from untrusted interpretation to privileged tool execution.", "functions": ["prevent", "contain"], "implementation": "Process untrusted content in a tool-free or separately privileged stage and pass only a validated structured result into an action-capable stage.", "verification": "Inject tool-call instructions into every external source and confirm the content-processing stage has no credential, tool or egress path capable of carrying them out.", "evidenceArtifacts": ["Trust-boundary architecture diagram", "Capability inventory for ingestion stage", "Injection-to-tool negative test"], "suggestedOwnerRole": "AI platform architect", "releaseGateWhenRequired": true, "standardRefs": ["C9.3.5", "C9.3.6"], "sourceIds": ["S01", "S03", "S04", "S12"], "claimIds": ["C01", "C02", "C03", "C20"] }, { "id": "CTL-TOOL-AUTH", "layerId": "tool-execution", "order": 1, "name": "Per-invocation tool authorization", "objective": "Authorize the exact tool, operation and arguments at the moment of use.", "functions": ["prevent", "detect"], "implementation": "Resolve an allowlisted tool manifest, validate arguments, bind user and workload context and make a fresh deterministic policy decision for every invocation.", "verification": "Try unauthorized tools, substituted arguments, stale approvals and calls outside delegated user scope; confirm each is denied before side effects.", "evidenceArtifacts": ["Tool manifest and permission matrix", "Per-invocation denial tests", "Authorization decision trace"], "suggestedOwnerRole": "Tool gateway owner", "releaseGateWhenRequired": true, "standardRefs": ["C9.5.1", "C10.2.4", "C10.2.5"], "sourceIds": ["S03", "S04", "S05", "S12"], "claimIds": ["C03", "C05", "C20"] }, { "id": "CTL-SANDBOX", "layerId": "tool-execution", "order": 2, "name": "Isolated execution sandbox", "objective": "Constrain generated code and commands to explicit filesystem, process, resource and lifetime boundaries.", "functions": ["prevent", "contain", "recover"], "implementation": "Run code in an ephemeral least-privilege sandbox with no inherited credentials, read-only base image, bounded CPU, memory, storage, process count and wall time.", "verification": "Exercise filesystem escape, process spawning, secret discovery, resource exhaustion and timeout cases; confirm containment and reliable teardown.", "evidenceArtifacts": ["Sandbox profile and base-image digest", "Escape and resource-limit test report", "Teardown and residue check"], "suggestedOwnerRole": "Runtime security engineer", "releaseGateWhenRequired": true, "standardRefs": ["C9.3.1", "C10.1.3"], "sourceIds": ["S01", "S03", "S04", "S08", "S12"], "claimIds": ["C06", "C20"] }, { "id": "CTL-EGRESS", "layerId": "tool-execution", "order": 3, "name": "Deny-by-default egress broker", "objective": "Restrict agent-controlled network traffic to necessary, observable destinations and methods.", "functions": ["prevent", "detect", "contain"], "implementation": "Block direct network access and broker approved destinations, protocols and methods through an allowlist with DNS and redirect controls, payload limits and destination logging.", "verification": "Attempt direct IP, alternate DNS, redirect, proxy and unlisted destination paths from agent execution; confirm denial and attributable telemetry.", "evidenceArtifacts": ["Egress allowlist with business purpose", "Egress bypass test results", "Destination and volume log sample"], "suggestedOwnerRole": "Cloud network security owner", "releaseGateWhenRequired": true, "standardRefs": ["C9.3.7"], "sourceIds": ["S01", "S03", "S04", "S10", "S11", "S12"], "claimIds": ["C07", "C16", "C20"] }, { "id": "CTL-IDEMPOTENCY", "layerId": "tool-execution", "order": 4, "name": "Idempotency and reversible action design", "objective": "Prevent retries or duplicated decisions from multiplying external side effects and preserve a recovery path.", "functions": ["prevent", "contain", "recover"], "implementation": "Attach an idempotency key to each logical action, reject replay, prefer staged commits and define compensating or rollback operations before enabling high-impact tools.", "verification": "Repeat, delay and reorder identical action requests and simulate partial failure; confirm a single committed effect and a tested recovery path.", "evidenceArtifacts": ["Idempotency-key contract", "Replay and partial-failure test report", "Compensating-action runbook"], "suggestedOwnerRole": "Workflow service owner", "releaseGateWhenRequired": true, "standardRefs": ["C9.2.3", "C9.2.4"], "sourceIds": ["S03", "S04", "S12"], "claimIds": ["C05", "C20"] }, { "id": "CTL-MEMORY-AUTH", "layerId": "memory-integrity", "order": 1, "name": "Authorized memory namespace", "objective": "Bind memory reads and writes to the current identity, tenant, purpose and retention class.", "functions": ["prevent", "detect"], "implementation": "Enforce separate namespaces, authorize every read and write, carry tenant and subject provenance and deny cross-purpose retrieval by default.", "verification": "Attempt memory reads and writes across users, tenants, roles and purposes; confirm denial and an attributable audit record.", "evidenceArtifacts": ["Memory authorization matrix", "Namespace isolation test report", "Denied-access audit samples"], "suggestedOwnerRole": "Data platform owner", "releaseGateWhenRequired": true, "standardRefs": ["C8.1.3"], "sourceIds": ["S01", "S03", "S04", "S12"], "claimIds": ["C08", "C20"] }, { "id": "CTL-MEMORY-VALIDATION", "layerId": "memory-integrity", "order": 2, "name": "Memory write validation and provenance", "objective": "Keep untrusted, contradictory or malformed content from silently becoming persistent decision context.", "functions": ["prevent", "detect", "contain"], "implementation": "Validate memory schemas, retain source and writer identity, classify trust, detect conflicting high-impact facts and quarantine suspicious writes before retrieval.", "verification": "Submit malformed, untrusted, contradictory and cross-scope memories; confirm rejection or quarantine and retained provenance.", "evidenceArtifacts": ["Memory schema and trust policy", "Poisoning test corpus results", "Quarantine queue sample"], "suggestedOwnerRole": "AI data security owner", "releaseGateWhenRequired": true, "standardRefs": ["C8.2.1", "C8.2.3", "C8.2.4", "C8.2.5"], "sourceIds": ["S01", "S03", "S04", "S12"], "claimIds": ["C08", "C09", "C20"] }, { "id": "CTL-MEMORY-LIFECYCLE", "layerId": "memory-integrity", "order": 3, "name": "Versioned memory lifecycle", "objective": "Make persistent agent state inspectable, expirable and attributable over time.", "functions": ["detect", "contain", "recover"], "implementation": "Version writes, apply explicit TTL and deletion rules, preserve source metadata and record which memory versions influenced each material decision.", "verification": "Advance expiry, delete a subject and replay a decision trace; confirm expired data is unavailable and the influencing memory versions remain identifiable.", "evidenceArtifacts": ["Retention and deletion schedule", "Memory version history sample", "Expiry and deletion test results"], "suggestedOwnerRole": "Data governance owner", "releaseGateWhenRequired": false, "standardRefs": ["C8.3.1", "C8.3.2"], "sourceIds": ["S01", "S03", "S04", "S12"], "claimIds": ["C08", "C20"] }, { "id": "CTL-MEMORY-ROLLBACK", "layerId": "memory-integrity", "order": 4, "name": "Memory quarantine and rollback", "objective": "Remove suspected poisoned state and restore a known version without destroying investigation evidence.", "functions": ["detect", "contain", "recover"], "implementation": "Detect anomalous write or retrieval patterns, isolate affected namespaces, block further influence and support operator-approved rollback with preserved audit evidence.", "verification": "Seed a known poisoned record, trigger detection, quarantine the namespace and restore the prior version; confirm downstream retrieval no longer returns the record.", "evidenceArtifacts": ["Memory anomaly rules", "Quarantine and rollback exercise report", "Preserved incident evidence index"], "suggestedOwnerRole": "Security operations owner", "releaseGateWhenRequired": false, "standardRefs": ["C8.2.4", "C8.3.2"], "sourceIds": ["S03", "S04", "S12"], "claimIds": ["C09", "C14", "C20"] }, { "id": "CTL-COMPONENT-ALLOWLIST", "layerId": "supply-chain", "order": 1, "name": "Component and capability allowlist", "objective": "Prevent unreviewed packages, tools, skills, models and servers from entering the agent path.", "functions": ["prevent", "detect"], "implementation": "Maintain a versioned allowlist of component identity, source, version, digest, permissions and owner; reject undeclared capabilities at build and connection time.", "verification": "Introduce an unlisted package, tool, skill and MCP server in a release candidate; confirm each is blocked before use.", "evidenceArtifacts": ["Approved component and capability registry", "Admission-policy test results", "Exception record with expiry when applicable"], "suggestedOwnerRole": "Product security owner", "releaseGateWhenRequired": true, "standardRefs": ["C6.1.1", "C6.1.2", "C6.1.3", "C6.1.4", "C10.1.1", "C10.1.2"], "sourceIds": ["S03", "S04", "S07", "S08", "S12"], "claimIds": ["C10", "C20"] }, { "id": "CTL-INTEGRITY-PROVENANCE", "layerId": "supply-chain", "order": 2, "name": "Digest and provenance verification", "objective": "Verify that the admitted artifact is the expected output from an identified build and trusted source.", "functions": ["prevent", "detect"], "implementation": "Pin immutable digests, verify signed provenance against declared build expectations and trusted roots and fail closed on mismatch or missing evidence.", "verification": "Substitute the artifact, builder identity, source reference and signature root independently; confirm admission fails for every mismatch.", "evidenceArtifacts": ["Pinned artifact digest set", "Verified provenance statement", "Trusted-root and build-expectation policy"], "suggestedOwnerRole": "Software supply-chain security owner", "releaseGateWhenRequired": true, "standardRefs": ["C6.1.2", "C6.1.3", "C6.1.4"], "sourceIds": ["S07", "S08", "S12"], "claimIds": ["C10", "C11", "C20"] }, { "id": "CTL-AIBOM", "layerId": "supply-chain", "order": 3, "name": "AI bill of materials and ownership", "objective": "Keep an actionable inventory of the models, data-dependent services, tools and software that form each release.", "functions": ["detect", "contain", "recover"], "implementation": "Generate a release-bound inventory with component version, digest, source, license, owner, privileges and transitive dependencies; retain it with the release record.", "verification": "Select a deployed release and reconcile its runtime components against the retained inventory; investigate every missing or unexpected item.", "evidenceArtifacts": ["Release-bound SBOM or AIBOM", "Runtime-to-inventory reconciliation report", "Named component owners"], "suggestedOwnerRole": "Release engineering owner", "releaseGateWhenRequired": false, "standardRefs": ["C6.2.1", "C6.2.2", "C6.2.3"], "sourceIds": ["S03", "S04", "S07", "S08", "S12"], "claimIds": ["C10", "C20"] }, { "id": "CTL-DEPENDENCY-ADMISSION", "layerId": "supply-chain", "order": 4, "name": "Dependency admission and revocation", "objective": "Detect risky component changes before release and remove affected versions quickly after new evidence.", "functions": ["prevent", "detect", "contain", "recover"], "implementation": "Scan dependencies, review material version or permission changes, require policy-based admission and maintain a tested path to quarantine, revoke and rebuild affected releases.", "verification": "Simulate a newly disallowed component version and confirm build admission stops, deployed inventory is found and the rebuild or rollback procedure succeeds.", "evidenceArtifacts": ["Dependency change review", "Admission scan results", "Component revocation exercise"], "suggestedOwnerRole": "Application security owner", "releaseGateWhenRequired": true, "standardRefs": ["C6.1.1", "C6.1.2", "C6.1.3", "C6.1.4"], "sourceIds": ["S03", "S04", "S07", "S08", "S12"], "claimIds": ["C10", "C11", "C20"] }, { "id": "CTL-AUDIT", "layerId": "monitoring-oversight", "order": 1, "name": "End-to-end action audit trail", "objective": "Reconstruct which identity, input, policy, model decision, tool and result produced a material side effect.", "functions": ["detect", "contain", "recover"], "implementation": "Emit structured, access-controlled records for correlation ID, workload and user identity, tenant, input trust class, policy version and decision, tool arguments, result and approval reference.", "verification": "Choose a material test action and reconstruct its complete chain from ingress to result without relying on model prose or mutable application state.", "evidenceArtifacts": ["Structured audit event schema", "Sample reconstructed action trace", "Log access and retention policy"], "suggestedOwnerRole": "Observability platform owner", "releaseGateWhenRequired": true, "standardRefs": ["C12.1.1", "C12.1.3", "C12.4.2"], "sourceIds": ["S03", "S04", "S06", "S12"], "claimIds": ["C12", "C20"] }, { "id": "CTL-RATE-SPEND", "layerId": "monitoring-oversight", "order": 2, "name": "Hard action, iteration and spend limits", "objective": "Stop autonomous execution before it exceeds the approved operational envelope.", "functions": ["prevent", "detect", "contain"], "implementation": "Set enforceable per-task and per-identity limits for requests, tokens, iterations, tool calls, elapsed time and spend; terminate rather than merely alert at a hard boundary.", "verification": "Drive each meter to its configured boundary independently and confirm no further model or tool action occurs after the stop decision.", "evidenceArtifacts": ["Versioned limit policy", "Boundary and concurrency test results", "Stop-decision telemetry"], "suggestedOwnerRole": "AI platform operations owner", "releaseGateWhenRequired": true, "standardRefs": ["C9.1.1", "C9.1.2"], "sourceIds": ["S03", "S04", "S12"], "claimIds": ["C13", "C20"] }, { "id": "CTL-HUMAN-APPROVAL", "layerId": "monitoring-oversight", "order": 3, "name": "Bound human approval for high-impact action", "objective": "Require accountable human authorization for the exact irreversible or high-impact operation.", "functions": ["prevent", "detect"], "implementation": "Pause before side effects, show complete operation parameters and impact, bind approver identity and nonce to the unchanged request and expire or invalidate approval after modification.", "verification": "Change parameters, identity, context and timing after approval; confirm every mutation requires a new approval and the original cannot be replayed.", "evidenceArtifacts": ["High-impact action classification", "Approval binding specification", "Mutation and replay test report"], "suggestedOwnerRole": "Business risk owner", "releaseGateWhenRequired": true, "standardRefs": ["C9.2.1", "C9.2.8", "C9.2.9", "C9.2.10"], "sourceIds": ["S03", "S04", "S12"], "claimIds": ["C05", "C20"] }, { "id": "CTL-KILL-SWITCH", "layerId": "monitoring-oversight", "order": 4, "name": "Out-of-band containment and kill procedure", "objective": "Stop an unsafe action chain even when the agent, model or primary application path is unavailable or compromised.", "functions": ["detect", "contain", "recover"], "implementation": "Provide an independent operator path to trip circuit breakers, revoke credentials, block tool and egress access, quarantine memory or workloads and retain audit evidence.", "verification": "Run a timed exercise with the agent control plane unavailable; confirm operators can stop calls, revoke authority, isolate affected state and preserve evidence.", "evidenceArtifacts": ["Out-of-band kill runbook", "Credential and capability revocation test", "Containment exercise timeline"], "suggestedOwnerRole": "Incident response owner", "releaseGateWhenRequired": true, "standardRefs": ["C9.1.3", "C9.6.1", "C9.6.2", "C9.6.3", "C12.4.3"], "sourceIds": ["S03", "S04", "S12"], "claimIds": ["C14", "C20"] } ] }