The links point outward on purpose
Most of what an agent needs is not new. Identity, least privilege, logging, injection handling and rate limiting are decades old, and OpenCRE already organizes them across ASVS, CWE, ISO 27001, NIST 800-53, SAMM and the OWASP AI Exchange. So each control below names the Common Requirement it belongs to rather than restating it.
Where a control reads new, it is usually the same requirement applied to a different subject: a non-human principal, a grant derived from another grant, or a platform the relying party does not control. That distinction is what the OpenCRE links make visible.
This is a mapping, not a conformance claim. A link to a Common Requirement says a control belongs to that topic. It is not evidence that anything is implemented, tested, or deployed.
Thirty controls
Where a control is enforced at a specific point in the agent loop, the point is named on the control itself. Fourteen of the thirty have one. The rest do not have a single point and are left unmarked rather than forced into one.
E1 · Identity and authority
Agent identity credential
agent_startupThe agent presents a credential bound to its own identity, distinct from the identity of the user who invoked it, before any authorization decision is made on its behalf.
Agent key binding and custody
The agent's signing key is bound to its declared identity and held so that possession of the key cannot be separated from the identity it asserts.
Capability attenuation across the delegation chain
pre_tool_callA grant passed to a sub-agent is a subset of the grant it derives from. Delegation depth is bounded and no hop may widen scope.
Declared agent purpose and scope
The agent declares its purpose and the boundary of its task in a form a policy engine can read, not only a form a person can read.
Declared capability manifest
agent_startupThe agent declares the tools and scopes it may use before it runs, and that declaration is the upper bound on what it can be granted.
E2 · Behaviour and accountability
Structured action logging
Every action an agent takes is recorded in a structured form carrying the actor, the action, the target, and the decision that permitted it.
Signed, third-party-verifiable evidence record
The action record is signed so that a party who does not trust the operator of the log can still verify who acted and what was decided.
Behavioural baseline for an agent
Normal behaviour for an agent is characterised before it is trusted with unattended work, so departure from it can be recognised.
Anomaly detection on agent behaviour
Departure from the established baseline is detected during the run rather than reconstructed after it.
Policy verdict rationale
post_model_callEach policy decision carries the rule that produced it and the inputs it read, so a verdict can be explained without re-running the agent.
E3 · Data and content
Schema validation of agent input
inputInput reaching the agent is validated against a declared schema before it is used.
Prompt injection prevention
input post_model_callInstructions arriving inside data are treated as data. Content fetched or returned during a run cannot alter the agent's instructions.
Personal data protection in agent output
outputPersonal data in the agent's context and output is identified and handled according to its classification rather than passed through.
Encoding and injection prevention
outputModel output is encoded for the interpreter that receives it, so output cannot become an injection in a downstream system.
Context provenance for agent working memory
What entered the agent's working memory, and from where, is recorded, so a poisoned context can be traced to its source.
E4 · Scope and resources
Resource allowlist
pre_tool_callThe data sources and sinks an agent may reach are declared in advance and enforced at the call boundary.
Tool authorization decision
pre_tool_callEvery tool call is an authorization decision made outside the model against the agent's granted scope, not a decision the model makes about itself.
Rate limiting on agent actions
The rate at which an agent may act is bounded independently of the rate at which it may infer.
Transaction and spend limits
pre_tool_callTransaction value and cumulative spend are bounded per run and per agent, and enforced before the call rather than reconciled after it.
Blast radius containment for agent execution
An agent executes inside a boundary that limits what a compromised or mistaken run can reach.
E5 · Response and recovery
Circuit breaker on agent loops
post_tool_callRepeating or non-terminating agent loops are broken automatically, and a broken loop does not cascade into the agents depending on it.
Terminate a running agent
agent_shutdownA running agent can be stopped by an operator, and the stop takes effect on work already in flight.
Agent session revocation
An agent's session and the authority attached to it can be revoked without waiting for expiry.
State rollback after an agent action
State an agent changed can be identified and reversed, distinctly from restoring a backup of the whole system.
Graceful degradation on policy engine failure
When the policy engine is unavailable the agent degrades to a defined and safe behaviour rather than to an unenforced one.
A · Attested primitives
Runtime attestation evidence
agent_startupEvidence of what is actually executing is produced by the platform at startup and appraised by a relying party that does not control that platform.
Transparency-log anchoring of evidence
Evidence records are anchored in an append-only log so a record cannot be rewritten after the fact without detection.
Attested agent-to-agent channel
An agent-to-agent channel establishes what the peer is, not only that the channel is encrypted, before scope is passed across it.
Continuous usage control after grant
Authorization is re-evaluated for the life of a grant, and obligations attached to a grant survive the moment it was issued.
Model weight custody against the hosting operator
Model weights released into infrastructure the model owner does not control remain under the owner's custody, including against the infrastructure operator.
What this page does not do
- It does not claim these controls are absent from OpenCRE. Every one of the thirty maps to an existing Common Requirement. None proposes a new one.
- It does not rank the controls or assert a maturity model over them.
- It does not assert that any AgenTrust implementation satisfies any of them. Conformance is tested per specification, not asserted here.
- Two of the controls, continuous usage control and model weight custody, are drawn from specifications that are still in private pre-standardization. Their permalinks resolve here and will point deeper once those specifications are public.