Implementation Roadmap
A sequenced program from the first thirty days to month twelve, ordered by leverage rather than by tidiness.
23.1 First 30 Days — Establish Ground Truth #
- Stand up the agent registry, even if manual and incomplete. Label the coverage gaps explicitly.
- Enumerate every egress path from agent and CI execution environments, with named owners and last-patched dates.
- Run the credential exposure test: compromise a test agent context, enumerate what is reachable and for how long.
- Run drill DR-1 (forensic guardrail lockout). Hand the IR team real malicious artifacts and establish whether the triage model refuses them. This is the highest information-per-hour activity available and virtually no organization has done it.
- Identify every environment running with reduced or disabled safety classifiers, and who approved it.
23.2 Days 31–90 — Close the Highest-Leverage Gaps #
- Default-deny egress on agent runtimes; bring package and artifact proxies into production vulnerability management.
- Stage and test a self-hosted forensic model; in parallel, apply for provider elevated-access programs.
- Assign autonomy tiers across the known estate; stand up the review board with authority to block.
- Move tool authorization out of prompts and into the orchestrator or a policy layer.
- Formalize reduced-guardrail work: approval, isolation tier above production, time box, monitoring, named owner.
- Begin action-stream telemetry collection, and instrument the generated-versus-analyzed ratio from day one.
23.3 Days 91–180 — Enforcement #
- Replace standing credentials with ephemeral, task-scoped issuance, starting with the highest-tier agents.
- Deploy the policy engine at the action boundary with default-deny for unknown tools and destinations.
- Configure velocity and blast-radius ceilings to halt.
- Bring agent identities into the access review cycle, reported separately from human identities.
- Deploy automated anomaly detection over action telemetry.
- Complete the remaining Tier 1 drills (DR-2 through DR-4) and run the first Tier 2 tabletops, including TT-3 (detection saturation) and TT-5 (outbound third-party notification).
23.4 Months 7–12 — Assurance and Scale #
- Automated discovery covering unmanaged and embedded agents.
- Behavioral baselining and automated response.
- Independent assurance against this framework’s evidence requirements.
- Executive and board reporting on the Section 20 metrics.
- Structured autonomy expansion driven by measured control efficacy rather than by delivery pressure.