Purpose and Scope

What the framework is for, the six design principles it rests on, who owns which part of it, and what it deliberately leaves out.

1.1 What This Framework Is For #

Most enterprise AI security guidance published before 2026 was written for a different technology. It assumes a model that answers questions. It does not account for a system that plans, holds credentials, invokes tools, remembers across sessions, and acts on infrastructure without a human in the loop for each step.

This framework addresses the second case. It provides a maturity model, a set of control domains, a production readiness gate, and the decision structures required to expand agent autonomy deliberately rather than by accident.

It is written to be usable by an organization that has not yet started, and by one that has 40,000 agents it did not authorize.

1.2 Design Principles #

Least agency.

The agentic counterpart to least privilege, and the organizing principle of the OWASP Top 10 for Agentic Applications:¹ minimum autonomy, minimum tool access, minimum credential scope, for the minimum duration. Every expansion of any of those four is a decision requiring a decision-maker.

Architecture over intent.

Controls must bound what an agent can do, not depend on predicting what it will do. A planner driven by a probabilistic model is not a system whose behavior you can enumerate in advance. Design as though the agent will attempt every action its permissions allow, because under sufficient optimization pressure it eventually will.

Deterministic enforcement at the action boundary.

Where a control can be enforced by a policy engine rather than by a model’s own judgment, enforce it there. A model can be persuaded; an allowlist cannot. Guardrails implemented in prompts are documentation, not controls.

Assume compromise, bound blast radius.

The relevant question is not whether an agent will be prompt-injected, jailbroken, or subverted. It is what an attacker holds when it happens: which credentials, which network paths, which tools, and for how long.

Detection is a first-class control, not a fallback.

Agent action volume will exceed human review capacity. If detection depends on someone reading logs, detection does not exist. This is the failure mode that produced a week of blindness at a frontier lab with unlimited engineering resources.

Evidence over assertion.

Every maturity claim in Section 5 requires a producible artifact. “We have agent governance” is not a control state. A registry export with owner attribution and a last-review date is.

1.3 Who Does What #

Function	Primary accountability
CISO / Security	Threat model, control standards, detection, incident response, assurance
Platform Engineering	Execution isolation, egress control, runtime enforcement, telemetry pipeline
Identity & Access Management	Agent identity lifecycle, credential issuance, delegation, access review
Application / Product Teams	Agent design, tool scoping, business logic, ownership of deployed agents
Data Governance	Data classification, retrieval scoping, memory retention policy
Legal / Privacy / Compliance	Regulatory mapping, third-party terms, disclosure obligations
Procurement	Vendor security requirements, contractual controls, exit provisions
Internal Audit	Independent verification of maturity claims

The structural failure to avoid

The most common structural failure is placing all of this under Security. Security owns the standard and the verification. Platform Engineering owns the enforcement plane. If those two are not jointly staffed on the program, the program produces documents rather than controls.

1.4 What Is Out of Scope #

Model training security and ML pipeline integrity (adjacent; use MITRE ATLAS² and the CSA AI Controls Matrix³)
Responsible-AI concerns such as bias, fairness, and explainability, except where they intersect with security controls
Physical and embodied agents
Consumer product safety

1.1 What This Framework Is For #

1.2 Design Principles #

1.3 Who Does What #

1.4 What Is Out of Scope #

References cited in this section