AI Control Library / CF-14: Agentic & Autonomous System Controls
Designation: Core | Control types represented: Governance and Operational
Control requirement
Assess and classify agentic risk from actual authority, autonomy, deployment context and potential consequences before release and after material change. Identify applicable external requirements and translate findings into deployment conditions.
Why this matters
A model’s general capability says little about the risk of the tools, credentials and decisions connected to it. Adding one consequential action can change the system’s risk profile substantially.
How the control types work together
Governance controls establish applicable binding external rules, laws and regulations. Operational controls translate those obligations into owned activities, review and decisions supported by relevant evidence.
When it applies
Apply to new agents and changes to tools, users, memory, delegation or environment. Where EU AI Act Article 14 applies, assess human-oversight arrangements within that legal scope.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The accountable business owner accepts residual risk; risk and legal specialists determine obligations; security and affected stakeholders assess impacts.
Implementation guidance
- Describe actions, data, dependencies, affected people and failure consequences.
- Evaluate misuse, authority expansion and loss of effective human control.
- Determine applicable classification and required safeguards using documented criteria.
- Approve a deployment envelope and reassessment triggers.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| New high-impact tool | Risk assessment is reopened before enablement. |
| Risk decision sample | Evidence supports classification and safeguards. |
| Material dependency change | Owner evaluates changed exposure. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Risk assessment
- Applicability analysis
- Deployment conditions
- Approval records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Withhold the affected capability or restrict autonomy until the risk decision and required safeguards are supported.
Example in practice
Hypothetical example: A reporting assistant gains authority to alter customer credit limits. The owner reassesses consequences and requires case-specific human approval before enabling the action.
Related controls
- CF14-001: Agentic System Security Boundaries
- CF14-011: Excessive Agency Prevention
- CF07-001: Human Oversight Policy & Procedures
Framework mappings
- NIST AI RMF (GOVERN 5.1)
- EU AI Act (Art. 14)
- MITRE ATLAS
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Agentic & Autonomous System Controls
Version 1.0