Anomaly detection on agent behaviour
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Thirty controls for AI agents, each stated as one requirement and cross-linked to the + Common Requirement that already covers it in OpenCRE. Every control has a stable permalink so an + external standard can cite it without the link rotting.
+Most of what an agent needs is not new. Identity, least privilege, logging, injection handling and + rate limiting are decades old, and OpenCRE already organizes them across ASVS, CWE, ISO 27001, + NIST 800-53, SAMM and the OWASP AI Exchange. So each control below names the Common Requirement it + belongs to rather than restating it.
+Where a control reads new, it is usually the same requirement applied to a different subject: a + non-human principal, a grant derived from another grant, or a platform the relying party does not + control. That distinction is what the OpenCRE links make visible.
+This is a mapping, not a conformance claim. A link to a + Common Requirement says a control belongs to that topic. It is not evidence that anything is + implemented, tested, or deployed.
Where a control is enforced at a specific point in the agent loop, the point is named on the + control itself. Fourteen of the thirty have one. The rest do not have a single point and are left + unmarked rather than forced into one.
+ +The agent presents a credential bound to its own identity, distinct from the identity of the user who invoked it, before any authorization decision is made on its behalf.
+ + +The agent's signing key is bound to its declared identity and held so that possession of the key cannot be separated from the identity it asserts.
+ + +A grant passed to a sub-agent is a subset of the grant it derives from. Delegation depth is bounded and no hop may widen scope.
+ + +The agent declares its purpose and the boundary of its task in a form a policy engine can read, not only a form a person can read.
+ + +The agent declares the tools and scopes it may use before it runs, and that declaration is the upper bound on what it can be granted.
+ + +Every action an agent takes is recorded in a structured form carrying the actor, the action, the target, and the decision that permitted it.
+ + +The action record is signed so that a party who does not trust the operator of the log can still verify who acted and what was decided.
+ + +Normal behaviour for an agent is characterised before it is trusted with unattended work, so departure from it can be recognised.
+ + +Departure from the established baseline is detected during the run rather than reconstructed after it.
+ + +Each policy decision carries the rule that produced it and the inputs it read, so a verdict can be explained without re-running the agent.
+ + +Input reaching the agent is validated against a declared schema before it is used.
+ + +Instructions arriving inside data are treated as data. Content fetched or returned during a run cannot alter the agent's instructions.
+ + +Personal data in the agent's context and output is identified and handled according to its classification rather than passed through.
+ + +Model output is encoded for the interpreter that receives it, so output cannot become an injection in a downstream system.
+ + +What entered the agent's working memory, and from where, is recorded, so a poisoned context can be traced to its source.
+ + +The data sources and sinks an agent may reach are declared in advance and enforced at the call boundary.
+ + +Every tool call is an authorization decision made outside the model against the agent's granted scope, not a decision the model makes about itself.
+ + +The rate at which an agent may act is bounded independently of the rate at which it may infer.
+ + +Transaction value and cumulative spend are bounded per run and per agent, and enforced before the call rather than reconciled after it.
+ + +An agent executes inside a boundary that limits what a compromised or mistaken run can reach.
+ + +Repeating or non-terminating agent loops are broken automatically, and a broken loop does not cascade into the agents depending on it.
+ + +A running agent can be stopped by an operator, and the stop takes effect on work already in flight.
+ + +An agent's session and the authority attached to it can be revoked without waiting for expiry.
+ + +State an agent changed can be identified and reversed, distinctly from restoring a backup of the whole system.
+ + +When the policy engine is unavailable the agent degrades to a defined and safe behaviour rather than to an unenforced one.
+ + +Evidence of what is actually executing is produced by the platform at startup and appraised by a relying party that does not control that platform.
+ + +Evidence records are anchored in an append-only log so a record cannot be rewritten after the fact without detection.
+ + +An agent-to-agent channel establishes what the peer is, not only that the channel is encrypted, before scope is passed across it.
+ + +Authorization is re-evaluated for the life of a grant, and obligations attached to a grant survive the moment it was issued.
+ + +Model weights released into infrastructure the model owner does not control remain under the owner's custody, including against the infrastructure operator.
+ + +Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+Redirecting to the control set.
+