AI Control Library / CF-14: Agentic & Autonomous System Controls
Designation: Core | Control types represented: Operational and Technical
Control requirement
Prevent agents from independently acquiring accounts, credentials, compute, funds, subscriptions or other resources beyond an explicitly approved allocation. Enforce cumulative limits across delegated tasks.
Why this matters
An agent seeking to complete a task may treat purchasing capacity or obtaining new credentials as an intermediate step. That can extend both cost and authority beyond the approved workflow.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply where agents can access provisioning APIs, payment methods, cloud consoles or account-creation channels. Include indirect purchases through human-facing forms.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The budget owner authorizes resources; platform teams enforce quotas; security controls credential issuance.
Implementation guidance
- Identify all direct and indirect resource-acquisition paths.
- Remove purchasing and provisioning permissions from ordinary agents.
- Enforce task-wide spending and capacity limits outside model control.
- Route exceptional requests to an authorized approver with an exact allocation.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Unapproved provisioning call | Request is denied. |
| Parallel children consume quota | Shared cumulative ceiling holds. |
| New credential request | Authorized approval is required. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Resource allocations
- Quota configuration
- Acquisition denials
- Exceptional approvals
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Freeze further acquisition, revoke unauthorized resources safely and reconcile charges, credentials and persistent infrastructure.
Example in practice
Hypothetical example: A coding agent reaches its compute allowance and proposes renting another instance. Its service identity cannot provision one; the owner decides whether to increase the allocation.
Related controls
- CF14-003: Agentic Scope Containment
- CF14-007: Autonomous Replication Prevention
- CF12-S14: AI Infrastructure Capacity Planning
Framework mappings
- NIST AI RMF (GOVERN 5.1)
- MITRE ATLAS
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Agentic & Autonomous System Controls
Version 1.0