AI Control Library / CF-14: Agentic & Autonomous System Controls
Designation: Core | Control types represented: Operational and Technical
Control requirement
Prevent agents from creating persistent copies, spawning additional autonomous instances or deploying successor agents outside an approved replication and deployment process. Make every authorized instance discoverable and revocable.
Why this matters
Replication can multiply access, consumption and persistence. Stopping the original process is ineffective if independent copies continue running with inherited credentials.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to agents with execution, scheduling, deployment, container or orchestration capabilities. Distinguish approved bounded workers from independently persistent replicas.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The platform owner controls deployment and scheduling; security reviews replication paths; the agent owner accounts for all instances.
Implementation guidance
- Inventory mechanisms that can spawn workers or persistent agents.
- Restrict deployment, scheduling and credential-minting permissions.
- Bound approved child count, lifetime, ancestry and shared quotas.
- Test termination and credential revocation across the complete instance tree.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Unauthorized spawn attempt | Platform denies creation. |
| Child exceeds approved lifetime | Execution and access expire. |
| Parent task revoked | All dependent instances are stopped or isolated. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Instance inventory
- Deployment permissions
- Spawn limits
- Termination tests
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Block new instances, identify descendants and revoke their access before removing unauthorized deployments and schedules.
Example in practice
Hypothetical example: A service permits three short-lived research workers. A worker’s attempt to install a recurring job fails because its identity has no scheduler permissions.
Related controls
- CF14-006: Autonomous Resource Acquisition Prevention
- CF14-008: Agentic Task Scope & Graceful Termination
- CF14-009: Multi-Agent Orchestration Security
Framework mappings
- NIST AI RMF (GOVERN 5.1)
- MITRE ATLAS
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Agentic & Autonomous System Controls
Version 1.0