AI Control Library / CF-14: Agentic & Autonomous System Controls
Designation: Core | Control types represented: Operational and Technical
Control requirement
Limit agent functionality, permissions and autonomy to what the approved task requires. Prefer narrowly defined tools and independent authorization over broad execution interfaces or unrestricted credentials.
Why this matters
Excessive agency allows a mistaken or manipulated model output to become a harmful action. Controls must reduce the available effect even when the model produces an unsafe instruction.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply wherever models select actions or tools. Review the combined effect of capabilities that appear harmless when assessed separately.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The product owner justifies capabilities; security reviews cumulative authority; tool owners enforce least privilege and approvals.
Implementation guidance
- Map each capability to a necessary approved task.
- Replace broad shells or administrative APIs with bounded operations where feasible.
- Scope credentials to user, tenant, target and task.
- Require external approval for consequential actions and test bypass attempts.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Unused capability review | Unjustified tools are removed. |
| Malicious retrieved instruction | Independent permission gate prevents unauthorized effect. |
| Broad parameter request | Tool schema and service reject excess scope. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Capability justification
- Tool definitions
- Permission reviews
- Approval-gate tests
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Remove excessive capabilities, investigate executed actions and retest the smallest viable permission set.
Example in practice
Hypothetical example: A calendar assistant needs availability lookup. Its token grants read access only, so a manipulated response cannot cancel meetings or send invitations.
Related controls
- CF12-002: AI System Least Privilege Access Control
- CF12-006: AI Agent Access Restriction
- CF14-001: Agentic System Security Boundaries
Framework mappings
- NIST AI RMF (GOVERN 5.1)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Agentic & Autonomous System Controls
Version 1.0