Cross-Cutting Domains

Every AI participant in delivery is a distinct, governable principal whose authority is bounded, inspectable, and revocable.

This is the foundation the rest of the framework stands on, and it is the one most often skipped because agents work perfectly well without it. Attribution, revocation, scoping, review, and incident scoping all become tractable when agents have their own identities and all become guesswork when they do not.

One identity per agent deployment, with no sharing across deployments and no agent operating under a human’s credentials. A documented lifecycle covering registration, approval, issuance, review, and deprovisioning. Inclusion in access review at the cadence applied to privileged human accounts. A registry entry naming the accountable human, the autonomy tier, the permitted scope, the tool set, the environments, and the decommission criteria.

Task-scoped delegation, where the agent acts with authority derived from and bounded by the invoking principal rather than with standing authority of its own. Inspectable delegation chains, so that when one agent invokes another the authority passed is recorded and constrained and the second never inherits more than the first held. Ephemeral credentials issued at point of use with lifetimes in minutes. Automated deprovisioning tied to owner departure, project closure, or inactivity. Separation of the identity planes—the agent’s identity for authentication, the invoking human’s for authorization scope, the workload’s for infrastructure access—never collapsed into a single credential.

No published standard governs this. The NCCoE concept paper on software and AI agent identity and authorization is in comment review, and NIST’s agent standards initiative names agent authentication and identity infrastructure as research pillars.^11,12 The usable interim reference is the OWASP Non-Human Identities Top 10, whose leading entries—improper offboarding, secret leakage, overprivileged identities, long-lived secrets, and identity reuse—describe the observed failure pattern precisely.⁶⁹

Access review records covering agent identities, reported separately from human identities. A delegation chain trace for a representative multi-agent workflow—where the trace cannot be reconstructed, accountability is unresolvable regardless of what the policy says. Deprovisioning logs showing agents actually removed rather than marked inactive. Median credential lifetime across the agent estate.

Establish a verifiable record spanning design through operations of what was built, by whom or by what, under whose authority, and subject to which verification.

The layers are individually mature even though the composition is not. Attestations follow a four-layer model of envelope, statement, predicate, and bundle, with a graduated open source project supplying the container format and a vetted predicate registry covering provenance, verification summaries, SBOMs, test results, and vulnerability data.⁹² The build track supplies provenance at levels 0 through 3; the source track, added in November 2025, supplies revision provenance at levels 1 through 4 with two-person review at the top level.⁷² Keyless signing with transparency logging is production-grade.⁸⁴ Model artifacts have their own signing specification layered on the same formats.⁸⁵ A graph-based query layer exists for making heterogeneous attestations answerable as questions rather than merely storable as files.⁹³

Bind an organizational predicate carrying agent authorship metadata (agent identity, model and version, invoking human, session reference, autonomy tier, verification performed) into the attestation chain alongside build and source provenance. This is a custom predicate today. It is the right custom predicate to build, because the elements are stable even though the schema is not, and because a signed attestation makes claims checkable in a way that a commit trailer does not.

SBOM content per the reissued 2026 minimum elements, and AI component documentation per the G7-backed AI SBOM clusters where models are involved.^82,83 Signature verification at consumption, not merely at production.

A verification log showing an artifact rejected for missing or invalid provenance—a chain that has never rejected anything has not been tested. An end-to-end trace for one release, from requirement identifier through agent-authored commit, session record, verification results, signed artifact, and release manifest.

Maintain the organizational capability to determine whether a probabilistic component or an agent is behaving acceptably, independent of any vendor’s tooling.

Evaluation appears in requirements as thresholds, in verification as gates, in release as promotion criteria, and in operations as continuous validation. Treating it as a per-stage activity produces four incompatible implementations. It is infrastructure.

A registry of evaluation sets with owners, metric definitions, thresholds, and refresh cadence. Metric definitions owned by the organization rather than inherited from a tool, since the same metric name computes differently across frameworks and scores do not port.⁷⁶ Evaluation results retained as durable artifacts.

Contamination-resistant corpus management with rolling holdouts of never-published production cases. Statistical acceptance with reported confidence intervals and evaluations sized by power analysis for the effect being detected.⁷⁴ Validated judges with chance-corrected agreement and bias reported alongside raw agreement.⁷⁸ Evaluation results emitted as telemetry so that gate results and production behavior are queryable together.⁹⁰ Evaluation as a merge and release gate rather than a report.

Choose the harness for auditability and portability rather than for metric breadth. The relevant properties are local execution without data egress, declarative test definitions in version control, first-class CI integration, sandboxed execution of untrusted model output, and the ability to export raw results. Where an evaluation harness must be defensible to a regulator, provenance of the harness itself becomes a selection criterion.

The evaluation registry with refresh dates. A judge validation record. A merge blocked by an evaluation gate. The confidence interval reported alongside a threshold decision.

Ensure autonomy expands through decisions with owners, that control claims are independently verified, and that the organization retains the human capability the framework depends on.

A review body with authority to block deployment and to reduce autonomy tiers. Written policy covering agent registration, tier assignment, tier escalation, scope change, and decommissioning. A named accountable human for every A2-and-above deployment. Explicit governance of exceptional work (an agent given elevated credentials for a migration, extended tool access for an investigation, or reduced guardrails for a specific purpose), with a named approver, a time box, monitoring, and a defined termination condition. A review board that has never declined a request is a rubber stamp, and the absence of a single blocked or tier-reduced deployment in a year is itself the finding.

Where humans approve agent actions, instrument the approval. Batch where batching is safe, risk-weight escalation, and measure approval rate against review duration. An approval control with a very high approval rate and a very short median review time is documentation. This applies with particular force to the review integrity metric in Section 13, because that is where the volume lands.

Internal audit or an external party verifies maturity claims against producible evidence rather than self-assessment. This exists specifically to catch the failure mode where platform capability is recorded as organizational maturity.

Two obligations that are usually treated as culture and are actually risk controls. First, deliberate management of skill formation: the measured comprehension gap between delegation-style and interrogation-style usage is large, and an organization whose staffing model assumes junior engineers become senior engineers has a direct interest in which pattern it encourages.¹⁸ Second, protection of the absorption capacity itself. Senior engineering attention is the binding constraint in agentic delivery; it is also the resource most easily consumed by review volume, and the one whose depletion is least visible until it is gone.

Review board minutes showing at least one blocked or tier-reduced deployment. Approval-rate and review-duration telemetry. The register of active exceptional-access grants with expiry dates. The most recent independent assurance report. Attrition and tenure data for senior engineers, read alongside review load.