AI Control Library / CF-09: Monitoring & Drift Detection
Designation: Core | Control types represented: Operational and Technical
Control requirement
Monitor agent actions and delegated activity against approved authority, resources and task scope. Correlate proposals, authorization, execution, results and continuing work so responders can investigate and contain actual effects.
Why this matters
A transcript may show what an agent said without revealing what its tools did. Monitoring must follow child workers, schedules and retries rather than treating the parent conversation as the full system.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Agents and multi-agent workflows with tool access, persistent tasks, delegation or consequential external actions.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The agentic service owner defines action monitoring with security, orchestration and operations teams.
Implementation guidance
- Inventory agents, identities, tools, permissions and relevant action or resource budgets, including delegated and scheduled work.
- Capture proportionate action events with correlation, authorization and actual outcome, distinguishing proposed from completed activity.
- Detect material scope violations, unusual sequences and aggregate effects, routing useful context to authorized responders.
- Exercise monitoring and stopping across child workers, queues and retries, verifying evidence of containment and outstanding effects.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Execute a safe delegated test task | Parent, child and tool actions can be correlated. |
| Propose an unauthorized action | The record distinguishes the proposal, enforcement and actual result. |
| Contain a workflow | Monitoring establishes whether continuing work has stopped within the defined boundary. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Agent and action coverage
- Correlation and authorization events
- Detection and containment exercises
- Outstanding-work and response records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate actual or suspected uncontrolled action to security and the service owner. Restrict tool authority, account for delegated work and verify containment before restoring execution.
Example in practice
Hypothetical example: A parent agent stops while a scheduled worker remains active. Action monitoring identifies the outstanding work and confirms that independent tool enforcement blocks further consequential requests.
Related controls
- CF04-008: AI System Logging Scope & Event Definition
- CF07-006: AI System Kill Switch & Emergency Stop
- CF14-009: Multi-Agent Orchestration Security
Framework mappings
- NIST AI RMF (MANAGE 4.1)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Monitoring & Drift Detection
Version 1.0