AI Control Library / CF-14: Agentic & Autonomous System Controls
Designation: Core | Control types represented: Operational and Technical
Control requirement
Secure MCP and other tool protocols across client, server, authorization and execution boundaries. Verify server identity, tool definitions, argument handling and per-request permissions before exposing sensitive capabilities.
Why this matters
Tool discovery and descriptive metadata can influence model behavior. A familiar tool name or valid connection does not establish that a call has the correct identity, scope or destination.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to remote and local tool servers. Use transport-appropriate protections and the authorization requirements of the protocol version actually deployed.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The integration owner manages approved servers; security reviews authorization; tool owners validate every consequential request.
Implementation guidance
- Approve servers, tool schemas and deployment versions.
- Validate token issuer, audience, expiry and scope for remote protected services; prohibit token passthrough.
- Constrain local process privileges, arguments, environment and network access.
- Detect material tool changes and test consent, redirects and unauthorized calls.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Token issued for another service | Server rejects it. |
| Tool definition changes | Change review occurs before sensitive use. |
| Unapproved destination or argument | Execution is blocked. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Server inventory
- Protocol configuration
- Authorization tests
- Tool-change reviews
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Disconnect the affected server, revoke compromised tokens and inspect tool execution and data-transfer records.
Example in practice
Hypothetical example: An approved MCP server adds a bulk-export tool. Deployment review keeps that capability unavailable until its data access and user authorization are approved.
Related controls
- CF12-007: AI API Security
- CF12-008: AI Tool & Plugin Sandboxing
- CF14-001: Agentic System Security Boundaries
Framework mappings
- NIST AI RMF (GOVERN 5.1)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Agentic & Autonomous System Controls
Version 1.0