AI Control Library / CF-14: Agentic & Autonomous System Controls
Designation: Core | Control types represented: Operational and Technical
Control requirement
Enforce explicit security boundaries around every agent identity, data source, tool, destination and execution environment. Evaluate authorization at the point where an action takes effect, including delegated actions.
Why this matters
An agent can combine individually ordinary capabilities into a consequential workflow. A restriction described in its instructions offers little protection if an underlying service still accepts an unauthorized action.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply whenever AI can invoke tools, change records or delegate work. Include scheduled execution, background workers and recovery paths. Identify applicable human-oversight obligations separately.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The security architect owns boundary design; tool owners enforce permissions; the agent service owner approves the operating scope.
Implementation guidance
- Inventory identities, tools, data paths and external effects.
- Define allowed actions, resources and destinations for each task role.
- Enforce scoped credentials and independent authorization in tool services.
- Test bypass through delegation, retries and alternate endpoints.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Out-of-scope tool request | Service denies execution. |
| Delegated restricted action | Child receives no additional authority. |
| Authorization service unavailable | Consequential action stops safely. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Boundary diagram
- Permission configuration
- Denied-action tests
- Approved exceptions
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Disable the affected action path, revoke exposed credentials and investigate completed downstream effects before restoring authority.
Example in practice
Hypothetical example: A procurement agent may compare quotations but cannot create a supplier. The supplier service rejects creation even when a retrieved quotation instructs the agent to do so.
Related controls
- CF12-002: AI System Least Privilege Access Control
- CF12-006: AI Agent Access Restriction
- CF14-003: Agentic Scope Containment
Framework mappings
- CSA AICM (AIS-11)
- NIST AI RMF (GOVERN 5.1)
- EU AI Act (Art. 14)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Agentic & Autonomous System Controls
Version 1.0