The Control Domains
Each domain below states its objective, the minimum bar for production, the controls that constitute Level 3, the evidence an auditor should ask for, and the failure modes seen most often in practice. The minimum bar is the domain-wide floor: it applies whether or not any individual control in the table has been reached. The table then tracks each control from its own Level 2 state to its enforced Level 3 state.
Discovery and Inventory
Know every agent operating in or against your environment, who owns it, what it can reach, and when it was last reviewed.
Identity and Authorization
Every agent a distinct, governable principal with an authorization model that is enforceable and auditable.
Credentials and Secrets
Eliminating standing credentials from agent execution contexts — the highest-leverage control in the framework.
Execution Isolation and Network Egress
Bounding what a compromised agent runtime can reach, and enumerating every outbound path.
Tool and Action Authorization
Deterministic allow, deny or escalate at the action boundary, with velocity and blast-radius ceilings that halt.
Data, Memory, and Context Integrity
Provenance labeling, instruction and data separation, and memory writes treated as authorized events.
Supply Chain
Signed and pinned model artifacts, tools and MCP servers, with drift detected rather than discovered.
Observability and Detection
Anomaly detection over the action stream, and the ratio between telemetry generated and telemetry analyzed.
Incident Response and Forensics
A vetted self-hosted forensic model, evidence preserved from ephemeral contexts, and third-party notification rehearsed.
Human Oversight, Governance, and Assurance
Approval design that resists fatigue, independent assurance, and governance of reduced-guardrail work.
Decommissioning and Retirement
Retiring an agent so that nothing it held, wrote, or was trusted by outlives it.