AI Control Library / CF-14: Agentic & Autonomous System Controls
Designation: Core | Control types represented: Operational and Technical
Control requirement
Authenticate communicating agents, protect message integrity and confidentiality, and authorize the instructions each peer may issue. Treat peer-generated content as untrusted input unless its specific authority is established.
Why this matters
A trusted transport does not make every message an authorized command. Compromised agents and forged task messages can otherwise turn collaboration into privilege escalation.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply wherever agents exchange tasks, findings, tool results or shared state, including third-party peers and message brokers.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The orchestration owner defines peer relationships; identity and platform teams protect channels and service identities.
Implementation guidance
- Register peer identities and permitted communication relationships.
- Bind messages to sender, task, recipient and freshness information.
- Separate informational findings from authorized commands.
- Reject replay, impersonation and unauthorized instruction forwarding.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Forged sender | Message is rejected. |
| Replayed completed-task command | Duplicate execution is prevented. |
| Peer requests elevated action | Receiver checks independent authority. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Peer registry
- Message schemas
- Authentication configuration
- Replay tests
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Isolate the suspect peer, invalidate affected sessions and trace received instructions through downstream actions.
Example in practice
Hypothetical example: A research agent sends an invoice attachment to a payment agent. The receiver can summarize it but requires a separate authorized payment request before transferring funds.
Related controls
- CF14-003: Agentic Scope Containment
- CF14-009: Multi-Agent Orchestration Security
- CF12-S12: AI System Authorization Mechanisms
Framework mappings
- NIST AI RMF (GOVERN 5.1)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Agentic & Autonomous System Controls
Version 1.0