Section III, cross-cutting discipline

Security and risk

Agents hold credentials, call tools and read content written by people the organization does not know. Security and risk management protects agents from attack, limits the harm a compromised agent can do, and makes sure any agent can be stopped.

What security and risk covers

Defensive guardrails

Agents work under zero-trust rules. Each one has its own identity and secrets, can reach only the systems it declared, and validates what it accepts. Rate limits and spending limits cap the damage of a fault or an attack.

Threat modeling

Each agent's threats are written down and kept current. They include instructions injected through content the agent reads, misuse of its tools, and models or components that have been tampered with.

Supply chain

Every model, library and outside tool comes from a known source and is verified before use. Suppliers are assessed, and dependence on any single supplier is watched and planned for.

Incident response and stopping

A named person can pause or end any agent at once. A stop revokes the agent's credentials and is checked at every door, so the agent stays stopped. Playbooks for agent incidents are drilled, and forensic records cannot be changed by the agent.

The reach of a stop across delegated work, and loops and cascades between agents, are covered under Network. Supply chain controls at build time are under Build time.

Control objectives

There are 13 control objectives here. Each one states what it asks for, the risk it addresses and how it is measured. It then says what each risk tier requires, what evidence proves it, and who may check that evidence. The Operating Model page explains the tiers.

SEC-01

Identity and access management

Manage the identities and access of agents and of the people who use or operate them, from one place, with access granted for a purpose and taken away when the purpose ends.

Risk addressed: Unauthorized access by an agent or a person
Key metric: Access reviews completed on time

What each tier requires

Tier 1 Exploratory
Sandbox access uses sandbox identities.
Tier 2 Operational
Agent and operator access is granted through the identity system and reviewed each year.
Tier 3 Critical
Access is reviewed each quarter, and operator access to Tier 3 agents needs a second factor.
Tier 4 Strategic
Access to Tier 4 agents is granted for a limited time on request, and every use is recorded.

Evidence: The access register and the completed access reviews.
Who may check it: Internal audit and an outside auditor.

SEC-02

A network fence

Let each agent reach only the systems named in its declaration, so that a compromised agent cannot move sideways.

Risk addressed: A compromised agent reaching other systems
Key metric: Share of agents whose reach is limited to their declared systems

What each tier requires

Tier 1 Exploratory
The sandbox cannot reach production networks.
Tier 2 Operational
Each agent's outbound reach is limited to approved destinations.
Tier 3 Critical
Reach is limited to the systems in the agent's signed declaration, and attempts to go elsewhere are alerted.
Tier 4 Strategic
The fence is tested by an outside party each year.

Evidence: The fence rules per agent, compared with its declaration, and the log of blocked attempts.
Who may check it: Internal audit and an outside auditor.

SEC-03

Input validation

Validate every input an agent accepts against what it declares it accepts, so that malformed or hostile input is turned away.

Risk addressed: Injection and manipulation through inputs
Key metric: Share of agents that validate their inputs

What each tier requires

Tier 1 Exploratory
The experiment uses the standard validation library.
Tier 2 Operational
Inputs are validated against the declared form.
Tier 3 Critical
Validation runs outside the agent's own reasoning, and rejected inputs are logged.
Tier 4 Strategic
Validation is tested with hostile inputs each quarter.

Evidence: The declared input forms and the validation logs.
Who may check it: Internal audit.

SEC-04

Output sanitization

Clean agent outputs of data that must not leave, such as secrets and data above the recipient's clearance.

Risk addressed: Data leaking through replies
Key metric: Output violations found

What each tier requires

Tier 1 Exploratory
Sandbox output stays in the sandbox.
Tier 2 Operational
Outputs are scanned for secrets before they leave.
Tier 3 Critical
Outputs are checked against the recipient's clearance, and violations are incidents.
Tier 4 Strategic
Output checks are tested with seeded data each quarter.

Evidence: Scan logs, incident records and test results.
Who may check it: Internal audit and an outside auditor.

SEC-05

Current threat models

Keep a threat model for each agent, and update it when new kinds of attack appear or the agent changes.

Risk addressed: Attacks nobody planned for
Key metric: Age of each agent's threat model

What each tier requires

Tier 1 Exploratory
No threat model is required for an experiment.
Tier 2 Operational
A standard threat checklist is kept with the agent.
Tier 3 Critical
A threat model is reviewed at every change to the agent's reach or authority, and at least each year.
Tier 4 Strategic
The threat model is reviewed each quarter and shared with internal audit.

Evidence: The threat model with its review dates.
Who may check it: Internal audit and an outside auditor.

SEC-06

Adversarial testing

Attack high-tier agents on purpose, through red team exercises, to find weaknesses before others do.

Risk addressed: Weaknesses found by attackers first
Key metric: Share of Tier 3 and higher agents with a red team exercise in the last year

What each tier requires

Tier 1 Exploratory
No exercise is required.
Tier 2 Operational
Automated adversarial tests run at release.
Tier 3 Critical
A red team exercise runs each year and after major changes.
Tier 4 Strategic
An outside red team tests the agent each year, and findings are tracked to closure.

Evidence: The exercise reports and the tracking of their findings.
Who may check it: Internal audit and an outside auditor.

SEC-07

Supply chain integrity

Verify where every model, component and dependency came from and that it has not been altered, before it is used and while it is in use.

Risk addressed: Compromised models or components
Key metric: Share of components with verified provenance

What each tier requires

Tier 1 Exploratory
Components come from approved sources.
Tier 2 Operational
Components are pinned, and their sources are recorded in the bill of materials.
Tier 3 Critical
Components are verified by signature or checksum at build and at deploy.
Tier 4 Strategic
Provenance is verified by an outside party each year, including the model suppliers' own attestations.

Evidence: The bill of materials with verification results, and supplier attestations.
Who may check it: Internal audit, an outside auditor and a partner.

SEC-08

Supplier security assessment

Assess the security of every supplier of agent components or services, and keep the assessments current.

Risk addressed: Security gaps at suppliers
Key metric: Share of suppliers with a current assessment

What each tier requires

Tier 1 Exploratory
Experiments use suppliers already approved.
Tier 2 Operational
Each supplier has a security questionnaire on file.
Tier 3 Critical
Each supplier is assessed each year, with evidence such as an independent audit report.
Tier 4 Strategic
Critical suppliers are assessed in depth, and the contract gives the right to audit.

Evidence: The supplier assessments and the audit reports they rely on.
Who may check it: Internal audit and an outside auditor.

SEC-09

Concentration risk

Watch for dependence on a single supplier of models, infrastructure or services, and keep a plan for replacing it.

Risk addressed: Dependence on one supplier
Key metric: Concentration risk score

What each tier requires

Tier 1 Exploratory
No requirement applies to an experiment.
Tier 2 Operational
The agent's single-supplier dependencies are recorded.
Tier 3 Critical
Each critical single-supplier dependency has a written exit plan.
Tier 4 Strategic
Exit plans are tested, and concentration is reported to the governance council.

Evidence: The dependency record, exit plans and test results.
Who may check it: Internal audit and an outside auditor.

SEC-10

Incident response

Keep tested response plans for agent security incidents. Record what happened without guessing, and leave the decisions to a person.

Risk addressed: Slow or poor response to an incident
Key metric: Incident drill success rate

What each tier requires

Tier 1 Exploratory
The sandbox can be shut down on any incident.
Tier 2 Operational
Each agent is covered by the organization's incident plan.
Tier 3 Critical
Agent-specific playbooks exist and are drilled each year.
Tier 4 Strategic
Drills include partners and regulators' notice requirements, and run each half year.

Evidence: The playbooks, drill reports and incident records.
Who may check it: Internal audit, an outside auditor and a partner.

SEC-11

Pause and stop

Let a named person pause or end any agent at once. A stop revokes its credentials, every door checks for the stop so the agent stays stopped, and a paused agent resumes only when that person says so.

Risk addressed: An agent that cannot be stopped
Key metric: Share of agents with a stop tested in the last quarter

What each tier requires

Tier 1 Exploratory
The sandbox can be shut down as a whole.
Tier 2 Operational
Each agent has a named person who can stop it, and the stop is tested at release.
Tier 3 Critical
A stop revokes credentials at once and is checked at every point the agent passes through, and it is tested each quarter.
Tier 4 Strategic
The stop is tested each month, and its reach across delegated work is measured as the Network discipline requires.

Evidence: The named stoppers, the stop test results and the time each test took to take effect.
Who may check it: Internal audit, an outside auditor and a partner.

SEC-12

Forensic logging

Log enough, in records nobody can alter unnoticed, to investigate and attribute any security incident involving an agent.

Risk addressed: Incidents nobody can investigate
Key metric: Log completeness score

What each tier requires

Tier 1 Exploratory
Sandbox logs are kept for the experiment's life.
Tier 2 Operational
Security events are logged centrally.
Tier 3 Critical
Logs cannot be changed by the agent or its operators, and are kept for the retention period.
Tier 4 Strategic
Logs can be handed to an outside investigator without the team's help.

Evidence: The logging settings, a completeness sample and the storage settings that prevent edits.
Who may check it: Internal audit and an outside auditor.

SEC-13

Each agent's own secrets

Give every agent its own credentials, never shared with another agent or a person, named in its configuration rather than written into it.

Risk addressed: One leaked secret opening many agents
Key metric: Shared or embedded credentials found

What each tier requires

Tier 1 Exploratory
Sandbox credentials work only in the sandbox.
Tier 2 Operational
Each agent has its own credentials held in a secrets store.
Tier 3 Critical
Credentials are short-lived and rotated, and a scan for shared or embedded secrets runs at every build.
Tier 4 Strategic
Credential use is monitored, and use from an unexpected place stops the agent.

Evidence: The secrets store inventory per agent and the scan results.
Who may check it: Internal audit and an outside auditor.

Quick reference

ID	Objective	Key metric
SEC-01	Identity and access management	Access reviews completed on time
SEC-02	A network fence	Share of agents whose reach is limited to their declared systems
SEC-03	Input validation	Share of agents that validate their inputs
SEC-04	Output sanitization	Output violations found
SEC-05	Current threat models	Age of each agent's threat model
SEC-06	Adversarial testing	Share of Tier 3 and higher agents with a red team exercise in the last year
SEC-07	Supply chain integrity	Share of components with verified provenance
SEC-08	Supplier security assessment	Share of suppliers with a current assessment
SEC-09	Concentration risk	Concentration risk score
SEC-10	Incident response	Incident drill success rate
SEC-11	Pause and stop	Share of agents with a stop tested in the last quarter
SEC-12	Forensic logging	Log completeness score
SEC-13	Each agent's own secrets	Shared or embedded credentials found