AI Control Library / CF-14: Agentic & Autonomous System Controls
Designation: Core | Control types represented: Operational and Technical
Control requirement
Classify agent actions by reversibility and consequence. Provide tested rollback or compensating procedures where feasible, and require explicit authorization before actions whose effects cannot be reliably reversed.
Why this matters
Reverting a database record may not undo a payment, disclosure or message already received. Recovery claims must account for external effects and partial completion.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to actions that modify data, spend funds, communicate externally or change infrastructure. Assess sequences as well as individual steps.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The process owner defines acceptable consequences; service owners implement recovery; an authorized person approves irreversible actions.
Implementation guidance
- Catalogue actions and distinguish rollback from compensation.
- Use previews, staged changes and transaction boundaries where supported.
- Bind approval to the exact target, parameters and expiry.
- Exercise recovery after partial failure and external completion.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Reversible action rollback | Prior state is restored and verified. |
| Changed approved parameters | Fresh authorization is required. |
| Partially completed sequence | Unresolved effects are identified and handled. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Action classification
- Approval records
- Rollback tests
- Compensation procedures
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Pause further actions, preserve transaction identifiers and invoke the approved recovery process; escalate effects that remain irreversible.
Example in practice
Hypothetical example: An agent prepares account closures in a staging queue. A person approves the listed accounts, and the service rejects any extra account added after approval.
Related controls
- CF14-001: Agentic System Security Boundaries
- CF14-008: Agentic Task Scope & Graceful Termination
- CF07-001: Human Oversight Policy & Procedures
Framework mappings
- NIST AI RMF (GOVERN 5.1)
- EU AI Act (Art. 14)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Agentic & Autonomous System Controls
Version 1.0