AI Control Library / CF-14: Agentic & Autonomous System Controls
Designation: Core | Control types represented: Operational and Technical
Control requirement
Control multi-agent orchestration through explicit roles, bounded delegation, shared resource accounting and end-to-end task traceability. Prevent conflicting actions, circular delegation and privilege amplification.
Why this matters
Individually constrained agents can create unsafe collective behavior when permissions, retries or budgets accumulate across a workflow. The orchestrator needs authority over the whole execution graph.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply when multiple agents coordinate through a central planner, peer network, shared queue or shared workspace.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The orchestration owner owns collective behavior; service owners enforce action authorization; operations monitors workflow health.
Implementation guidance
- Define agent roles, allowed delegation and ownership of shared state.
- Propagate task identity, scoped authority and cumulative budgets.
- Use coordination controls for duplicate work and conflicting changes.
- Test cycles, compromised peers, retry storms and cancellation propagation.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Circular delegation | Depth or cycle guard terminates the loop. |
| Concurrent conflicting updates | Conflict is resolved before consequential execution. |
| Child requests broader authority | Escalation is denied or separately approved. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Workflow graph
- Role policies
- Coordination tests
- End-to-end traces
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Suspend the affected workflow graph, preserve task lineage and reconcile shared state and external actions before restart.
Example in practice
Hypothetical example: Two agents try to refund the same order. The payment service’s idempotency and task coordination permit one refund and record the duplicate attempt.
Related controls
- CF14-003: Agentic Scope Containment
- CF14-004: Inter-Agent Trust & Communication Security
- CF14-008: Agentic Task Scope & Graceful Termination
Framework mappings
- NIST AI RMF (GOVERN 5.1)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Agentic & Autonomous System Controls
Version 1.0