Definitions and Boundaries

A system that decomposes a goal into steps, selects and invokes tools, and takes actions with delegated authority, with reduced or absent per-step human approval. The defining property is not intelligence but agency: the ability to produce side effects in systems of record.

A system that generates output a human reviews and acts on. Where a copilot gains the ability to execute—running commands, calling APIs, writing to systems—it has become an agent and inherits every control in this framework, regardless of what the vendor calls it.

An orchestrated collection of agents, tools, memory stores, and routing logic. Controls apply at both the individual agent and the system level; cascading failure across agents is its own risk class.

Any capability an agent can invoke that produces an effect outside its own reasoning: an API call, a shell command, a database query, a file write, an MCP server method, a sub-agent invocation.

Any principal that is not a person: service accounts, API keys, workload identities, automation bots, and now agents. Agents are a subclass of NHI with variable, non-deterministic behavior, which is why NHI hygiene sufficient for a cron job is not sufficient here.

The point at which an agent’s decision becomes a side effect. This is the single most important architectural concept in the framework. Controls placed before the action boundary are preventive; controls placed after it are detective; controls placed inside the model are advisory.

The set of systems, data, and credentials reachable by a compromised agent before any control intervenes. Expressed as an actual enumeration, not an adjective.

Any secret available to an agent’s execution context that outlives the task it was issued for. The single highest-leverage thing most organizations can eliminate.