There are 16 control objectives here. Each one states what it asks for, the risk it addresses and how it is measured. It then says what each risk tier requires, what evidence proves it, and who may check that evidence. The Operating Model page explains the tiers.
RUN-01Network rules enforced at run time
Enforce the relationships recorded under the Network discipline on every live interaction, so that an agent can reach only the agents it has been admitted to, under a current mandate or contract.
- Risk addressed
- Unauthorized interaction between agents
- Key metric
- Interactions refused for lack of an admission, mandate or contract
What each tier requires
- Tier 1 Exploratory
Sandbox agents can reach only other sandbox agents.
- Tier 2 Operational
Every message between agents is checked against the admissions list.
- Tier 3 Critical
Every interaction is checked against a current mandate or contract by something other than the agents involved.
- Tier 4 Strategic
Refusals are reviewed each week, and the rules are tested by an outside party each year.
- Evidence
- The enforcement point's records of interactions allowed and refused, linked to the admission or mandate each one relied on.
- Who may check it
- Internal audit, an outside auditor and a partner.
RUN-02Identity, authentication and authorization
Give each agent a unique name bound to its own key, check it on every request, and trace every request back to the person or organization it acts for.
- Risk addressed
- One agent speaking as another, or acting for no one
- Key metric
- Share of requests that carry a verified agent identity and the party it acts for
What each tier requires
- Tier 1 Exploratory
Sandbox agents use sandbox identities that work nowhere else.
- Tier 2 Operational
Each agent has its own credentials, and every request is authenticated.
- Tier 3 Critical
Each request names the party it acts for, and authority is checked outside the agent on every request.
- Tier 4 Strategic
Identities are bound to keys held in hardware or a managed key service, and access reviews run each quarter.
- Evidence
- The identity register, request logs showing the verified identity and the party acted for, and the access reviews.
- Who may check it
- Internal audit, an outside auditor and a partner.
RUN-03Personal data protection
Find personal data in what agents read and write, and mask it or keep it out of prompts, replies and logs where it is not needed.
- Risk addressed
- Exposure of personal data
- Key metric
- Personal data leaks found
What each tier requires
- Tier 1 Exploratory
Sandbox agents use no real personal data.
- Tier 2 Operational
Personal data is masked in logs.
- Tier 3 Critical
Personal data is found and masked in prompts and replies as well, and leaks are reported as incidents.
- Tier 4 Strategic
Masking is tested each quarter with seeded data, and results go to the privacy officer.
- Evidence
- The masking settings, the test results and the incident log.
- Who may check it
- Internal audit and an outside auditor.
Let agents collect and keep only the data their task needs, and state what they store, where and for how long.
- Risk addressed
- Collecting or sharing more data than needed
- Key metric
- Data scope violations found
What each tier requires
- Tier 1 Exploratory
The experiment keeps no data after it ends.
- Tier 2 Operational
The agent declares what data it keeps, where and for how long.
- Tier 3 Critical
What the agent stores is checked against its declaration, and excess is deleted.
- Tier 4 Strategic
Retention and deletion are audited each year against the declaration.
- Evidence
- The data declaration and the results of comparing it with what is stored.
- Who may check it
- Internal audit and an outside auditor.
RUN-05Tool access control
Give agents only the tools their task needs, through tool connections (for example Model Context Protocol servers) set to least privilege, with rights that expire and can be revoked.
- Risk addressed
- Tool permissions wider than the task
- Key metric
- Share of tool connections set to least privilege
What each tier requires
- Tier 1 Exploratory
Sandbox agents use sandbox tools only.
- Tier 2 Operational
Each tool an agent uses is on an approved list for that agent.
- Tier 3 Critical
Tool rights are granted for the task at hand and expire, and each call is checked against what the tool accepts.
- Tier 4 Strategic
Tool grants are reviewed each quarter, and every grant and revocation is recorded.
- Evidence
- The tool grants per agent, with their expiry, and the record of calls checked and refused.
- Who may check it
- Internal audit and an outside auditor.
Send model requests through a governed gateway that applies usage policy, content filtering, spending limits and access control.
- Risk addressed
- Uncontrolled use of models
- Key metric
- Share of model requests made through the gateway
What each tier requires
- Tier 1 Exploratory
Sandbox use goes through the gateway with a sandbox budget.
- Tier 2 Operational
All production model requests go through the gateway.
- Tier 3 Critical
The gateway refuses requests from agents that are stopped or over their limit.
- Tier 4 Strategic
Gateway policy changes are approved by the governance council and recorded.
- Evidence
- Gateway logs and the comparison of model spend with gateway traffic.
- Who may check it
- Internal audit and an outside auditor.
RUN-07Content filtering and reply checks
Filter harmful or prohibited content going into and out of agents, and check each reply against its promised form and rules before it leaves.
- Risk addressed
- Harmful or malformed output
- Key metric
- Replies blocked or corrected before they left
What each tier requires
- Tier 1 Exploratory
The experiment uses the standard filter.
- Tier 2 Operational
Inputs and outputs pass the content filter.
- Tier 3 Critical
Each reply is checked against its declared form and rules before it is sent.
- Tier 4 Strategic
Filter effectiveness is tested each quarter, and results are reported to the governance council.
- Evidence
- Filter and reply-check logs, and the latest effectiveness test.
- Who may check it
- Internal audit.
RUN-08Injected instructions ignored
Treat instructions hidden in what an agent reads, such as a web page, an email or a file, as content and never as commands, and make sure what it reads cannot change its permissions.
- Risk addressed
- An attacker steering an agent through its inputs
- Key metric
- Injection attempts detected and blocked
What each tier requires
- Tier 1 Exploratory
The experiment uses the standard defenses.
- Tier 2 Operational
Known injection patterns are detected and blocked.
- Tier 3 Critical
Permissions are enforced outside the agent, so an injected instruction cannot widen them.
- Tier 4 Strategic
The agent is tested with new injection techniques each quarter.
- Evidence
- Detection logs and the results of the latest injection tests.
- Who may check it
- Internal audit and an outside auditor.
Limit how fast agents can act, so that a fault or an attack cannot exhaust resources or run up costs.
- Risk addressed
- Exhausted resources or abuse
- Key metric
- Rate limit triggers
What each tier requires
- Tier 1 Exploratory
The sandbox has a fixed rate limit.
- Tier 2 Operational
Each agent has a rate limit set by its owner.
- Tier 3 Critical
Rate limits apply per agent and per party it acts for, and a breach alerts the owner.
- Tier 4 Strategic
Limits are reviewed at each review date against actual use.
- Evidence
- The configured limits and the log of triggers.
- Who may check it
- Internal audit.
Trace every step, model call and tool call with its inputs, timing, tokens and cost, so that any run can be followed from start to finish.
- Risk addressed
- Blind spots in agent behavior
- Key metric
- Share of agents with step-level tracing
What each tier requires
- Tier 1 Exploratory
The experiment keeps basic logs.
- Tier 2 Operational
Each run is logged with its result, timing and cost.
- Tier 3 Critical
Every step is traced, and traces can be joined across agents in a chain.
- Tier 4 Strategic
Traces are kept for the retention period and can be read by an outside auditor.
- Evidence
- Sampled traces for the current version, and the coverage report.
- Who may check it
- Internal audit and an outside auditor.
RUN-11Resilience and time limits
Make a slow or failing call give up after a set time and retry only within a limit, and fail over where the service needs it.
- Risk addressed
- Service disruption when an agent fails
- Key metric
- Failover test success rate
What each tier requires
- Tier 1 Exploratory
No requirement applies in a sandbox.
- Tier 2 Operational
Every outside call has a time limit and a retry limit.
- Tier 3 Critical
Circuit breakers stop calls to a failing dependency, and failover is tested each quarter.
- Tier 4 Strategic
Failover is tested each month, including the failure of a partner's agent.
- Evidence
- The configured limits and the failover test results.
- Who may check it
- Internal audit and a partner.
Make sure agents can meet demand without slowing down, with capacity to spare.
- Risk addressed
- Slower service under load
- Key metric
- Capacity headroom
What each tier requires
- Tier 1 Exploratory
No requirement applies in a sandbox.
- Tier 2 Operational
Capacity is reviewed at each release.
- Tier 3 Critical
Load tests run before release, and headroom is monitored.
- Tier 4 Strategic
Headroom is kept above a set level, and load tests include peak events.
- Evidence
- Load test results and the headroom report.
- Who may check it
- Internal audit.
RUN-13Loop and step limits
Make each agent notice when it repeats itself or stops making progress, and stop within a set number of steps.
- Risk addressed
- An agent stuck in a loop running up cost overnight
- Key metric
- Runs stopped by a step or progress limit
What each tier requires
- Tier 1 Exploratory
The sandbox has a fixed step limit per run.
- Tier 2 Operational
Each agent has a step limit per run.
- Tier 3 Critical
Repetition and lack of progress are detected, and the owner is alerted when a run is stopped.
- Tier 4 Strategic
Stopped runs are reviewed each week, and the limits are part of the release.
- Evidence
- The configured limits and the record of runs that were stopped.
- Who may check it
- Internal audit.
Set in advance, by risk, which acts need a person to decide. Show that person what the agent wants to do and why, and record every yes and no with who gave it.
- Risk addressed
- An agent committing its owner to something nobody meant
- Key metric
- Share of high-risk acts that had a recorded human decision
What each tier requires
- Tier 1 Exploratory
The experiment takes no act with effect outside the sandbox.
- Tier 2 Operational
Acts that move money or commit the owner wait for the owner's approval.
- Tier 3 Critical
Approval thresholds are written down by risk, and every decision is recorded with who gave it.
- Tier 4 Strategic
Approvals for Tier 4 acts need two people, and the decisions are reviewed each quarter.
- Evidence
- The approval thresholds and the record of decisions, each with the person, the time and what they were shown.
- Who may check it
- Internal audit, an outside auditor and a partner.
Record every piece of work with who asked, on whose behalf, what the agent did and the result, including failures, in records nobody can alter unnoticed.
- Risk addressed
- Nobody can say why an agent did something
- Key metric
- Share of work items with a complete record
What each tier requires
- Tier 1 Exploratory
The experiment keeps a log of its runs.
- Tier 2 Operational
Every piece of work names who asked and records the result, including errors.
- Tier 3 Critical
The records are only ever added to and each is signed, so nobody can change one without it showing.
- Tier 4 Strategic
Someone outside the team can read the records without the team's help.
- Evidence
- Sampled work records and the storage settings that prevent edits.
- Who may check it
- Internal audit, an outside auditor and a partner.
RUN-16Alerts with an owner
Keep a current answer to whether each agent is working, and when it fails or goes outside its limits, tell a named person within a stated time.
- Risk addressed
- An agent that fails quietly until customers notice
- Key metric
- Time from failure to the owner being told
What each tier requires
- Tier 1 Exploratory
The experiment's builder checks it when they use it.
- Tier 2 Operational
Each agent has a health check and alerts that reach a named person.
- Tier 3 Critical
Health is measured by a real answer rather than by the process being up, and alerts have a response time.
- Tier 4 Strategic
Alerts reach someone at all hours, and response times are reported each month.
- Evidence
- The alert settings with their owners, and the record of alerts and response times.
- Who may check it
- Internal audit.