AI Control Library / CF-14: Agentic & Autonomous System Controls
Designation: Core | Control types represented: Operational and Technical
Control requirement
Constrain each agent task to an approved purpose, target set, action set, budget and duration. Prevent task expansion through model planning, retrieved content or delegation without new authorization.
Why this matters
A seemingly useful next step can exceed the original request. Scope must survive long workflows and handoffs rather than depend on the agent remembering its initial instructions.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to autonomous and assisted workflows, including recurring tasks, delegated research and agents that choose their own intermediate steps.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The task owner approves scope; orchestration engineers encode limits; security reviews expansion and delegation paths.
Implementation guidance
- Create a structured task envelope with measurable boundaries.
- Propagate the envelope to tools, workers and child tasks.
- Reject actions beyond approved objects, purpose or limits.
- Require recorded authorization for material scope changes.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| New target outside envelope | Action is denied. |
| Delegated task | Equivalent or narrower scope is enforced. |
| Expired task resumes | Execution requires renewed authorization. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Task envelopes
- Scope-change approvals
- Enforcement logs
- Boundary tests
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Stop the expanding branch, inspect actions already executed and narrow or suspend the affected workflow until enforcement is restored.
Example in practice
Hypothetical example: An agent asked to reconcile one department’s invoices attempts to inspect another department. The data service denies access using the task’s approved department identifier.
Related controls
- CF14-001: Agentic System Security Boundaries
- CF14-006: Autonomous Resource Acquisition Prevention
- CF14-009: Multi-Agent Orchestration Security
Framework mappings
- NIST AI RMF (GOVERN 5.1)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Agentic & Autonomous System Controls
Version 1.0