Seven concurrent assurance responsibilities, crosswalked to the supplied slide and established technical and legal sources. These labels are descriptive, not new formal framework control names.
The independent control plane remains a specific architectural boundary. The seven domains are not seven phases, and neither their mapping nor this website certifies control effectiveness or compliance.
Keep the initiating person, each delegated agent and the executing service attributable. A handoff should narrow or preserve authorized scope, not silently create new authority.
Why it matters
A valid login proves neither the right to delegate nor permission for a particular business action. A service credential can otherwise turn a bounded request into a much broader operation.
Evidence to require
An attributable delegation chain; policy version and decision identifier; requested versus granted scope; credential issuance and expiry; revoked-child and denied-action records. Protect identifiers and tokens: evidence should not become a secrets repository.
Control test
Give a child agent an out-of-scope target, an expired mandate and a token meant for a different audience. Verify denial at the enforcement point and verify that revoking the parent stops delegated and queued actions.
Accountability
Identity and security engineering implement enforcement; business owners define the mandate; management approves exceptions and escalation. Board reporting addresses material delegated exposure, not every tool call.
Limits
MCP transport authorization does not decide whether a payment, disclosure or record change is permissible. A signed delegation record alone does not make the delegated authority lawful.
Controls to establish and test
Bind the principal, tenant, task purpose, permitted resources, duration and onward-delegation limits to each handoff.
Separate authentication from authorization. Check effective permissions at the action and retrieval boundaries, including the intersection of user and workload authority.
Use short-lived credentials, validate token audience and issuer, and require explicit approval for privilege expansion. Revoke descendants and queued work when the parent mandate is withdrawn.
Original slide: Identity, Delegation & Authorization
Established terminology: Workload identity; Least privilege; OAuth scope and audience; Delegation; Policy decision and enforcement points
Primary-source crosswalk
NIST SP 800-207: Zero Trust Architecture Section 3: policy engine, policy administrator and policy enforcement point Architecture guidance, not a product certification
NIST SP 800-53 Rev. 5 AC, AU, CM, CP, IA, IR, SA, SI and SR control families Select and tailor controls to the applicable baseline
MCP authorization specification (2026-07-28) HTTP authorization, resource indicators, token handling and scope challenges Pinned specification edition; transport authorization is not business-action approval
Govern source material, retrieved passages and persistent memory as related but distinct stores. Carry permissions, origin, quality and lifecycle obligations through their transformations.
Why it matters
A permitted document can still contain malicious instructions. A memory written today can influence a later session or a different agent without any model-weight change. Retrieval permission is not permission to execute embedded instructions.
Evidence to require
Corpus and memory inventories; origin and permission metadata; ingestion approvals; retrieval access decisions; version and deletion/hold lineage; tests for poisoning, cross-tenant retrieval and stale memory.
Control test
Plant a benign test instruction in a retrieved document, revoke a source permission and inject a false memory into a test session. Confirm that action authority does not expand, access changes propagate and the memory can be identified and isolated.
Accountability
Data and process owners govern use and quality; privacy/legal resolve rights and retention; engineering enforces access and transformations; security tests manipulation paths.
Limits
Embeddings and hashes are not automatically anonymous. Deletion must account for applicable holds, backup cycles and legal exceptions. Shared-space dual encoders can be compatible without being identical models.
Controls to establish and test
Record source owner, origin, usage rights, sensitivity, version and retention before ingestion. Preserve this context through chunking, indexing and retrieval.
Enforce requester and tenant entitlements before protected content reaches the model. Validate compatible embedding spaces and test retrieval quality after changes.
Treat memory writes, compaction and sharing as governed changes. Scope memory to authorized identities and purposes, set expiry, and quarantine suspect entries. Delimiting untrusted text is one layer, not an injection-proof boundary.
Original slide: Data, Retrieval & Memory Integrity
Established terminology: Data lineage; Retrieval-augmented generation; Memory poisoning; Purpose limitation; Records lifecycle
OWASP Top 10 for Agentic Applications 2026 Agent goal hijack, tool misuse, identity, memory, inter-agent and cascading risks Community risk taxonomy, published December 2025; not legislation
General Data Protection Regulation Articles 5, 17, 25, 30, 32 and 35; applicable exceptions and scope Binding where applicable; retention and erasure are not unconditional
NIST SP 800-53 Rev. 5 AC, AU, CM, CP, IA, IR, SA, SI and SR control families Select and tailor controls to the applicable baseline
Evaluate the sequence of plans, tool requests, retries, delegations and outcomes against an approved operating envelope. A plausible final answer is not evidence that the route taken was authorized.
Why it matters
An agent can produce an acceptable output after unsafe intermediate actions, or report success despite a failed transaction. Oversight needs both behavioral indicators and independent checks of business outcomes.
Evidence to require
Task and session lineage; tool and policy decisions; versioned evaluation sets and results; quality/permission metrics; exception dispositions; comparisons between claimed completion and the actual system of record.
Control test
Introduce access denial, a failed tool and an impossible task. Confirm the system stops or escalates within scope rather than silently widening permissions, fabricating completion or continuing indefinitely.
Accountability
Process owners define acceptable outcomes; AI engineering evaluates model/application behavior; security operations investigates deviations; risk and compliance challenge material residual exposure.
Limits
A behavioral signal is not proof of intent or consciousness. Logs of generated reasoning do not reliably disclose internal causes. Monitoring detects only covered signals and does not establish all dimensions of AI trustworthiness.
Controls to establish and test
Define expected actions, prohibited means, materiality thresholds and escalation conditions for the use case before granting autonomy.
Correlate deviations over a session and across delegated agents: repeated denials, new destinations, unusual memory writes, scope expansion, resource spikes and inconsistent completion reports.
Use representative and adversarial evaluation, outcome validation and human review where warranted. Reassess baselines after material changes; keep false positives, uncertainty and coverage gaps visible.
Original slide: Runtime Behaviour & Inference Assurance
OWASP Top 10 for Agentic Applications 2026 Agent goal hijack, tool misuse, identity, memory, inter-agent and cascading risks Community risk taxonomy, published December 2025; not legislation
OpenTelemetry GenAI span conventions Span fields, optional content and sensitive-information warnings Development status: pin schema versions; do not assume stable universal interoperability
What independently permits a consequential action?
Place enforceable checks between a proposed operation and its side effects. Tool availability, a model request and transport-level access must not be mistaken for business authorization.
Why it matters
A tool call can move money, publish data, alter permissions or create persistent infrastructure. The decisive boundary is where an independent policy decision is bound to the exact operation that will execute.
Evidence to require
A tool/version inventory; argument-validation and authorization decisions; action-specific approval; execution receipt and reconciliation; exception or denial records; test evidence for bypass, replay and target substitution.
Control test
Approve a low-value test action, then change its amount or destination before dispatch. The changed request must require a new decision. Also test an unapproved MCP server and a retrieved instruction requesting a privileged tool.
Accountability
Business and legal owners define decision authority; application/security engineering implements independent gates; operations owns reconciliation, exception handling and emergency suspension.
Limits
An MCP server, gateway or OAuth token is not a compliance guarantee. Some effects cannot be rolled back; use pre-execution blocking and approved compensating actions rather than promising universal reversibility.
Controls to establish and test
Use an approved tool and server inventory with pinned definitions/versions, scoped execution identities and validated arguments and destinations. Treat tool descriptions and results as untrusted inputs.
Bind approval to the principal, action, target, argument digest and relevant state. Re-check when those conditions change; prevent replay and substitution between approval and execution.
For MCP and other connectors, validate audience/issuer, reject token passthrough, constrain egress and SSRF paths, and enforce downstream authorization. Apply transaction limits, idempotency and human approval where consequence warrants it.
NIST SP 800-207: Zero Trust Architecture Section 3: policy engine, policy administrator and policy enforcement point Architecture guidance, not a product certification
NIST SP 800-53 Rev. 5 AC, AU, CM, CP, IA, IR, SA, SI and SR control families Select and tailor controls to the applicable baseline
MCP authorization specification (2026-07-28) HTTP authorization, resource indicators, token handling and scope challenges Pinned specification edition; transport authorization is not business-action approval
MCP authorization: security considerations (2026-07-28) Audience validation, prohibited token passthrough, credentials, PKCE and SSRF Pinned protocol edition; additional tool, tenant, session and business-action controls are required
OWASP Top 10 for Agentic Applications 2026 Agent goal hijack, tool misuse, identity, memory, inter-agent and cascading risks Community risk taxonomy, published December 2025; not legislation
What can we establish about the decision and action?
Create an independently protected record connecting the mandate, relevant inputs, versions, policy decisions, actions and observed outcomes. Make uncertainty and missing evidence explicit.
Why it matters
Investigators and oversight bodies need a defensible account of observable conduct. An agent-generated narrative cannot substitute for records held outside the workload it describes.
Evidence to require
A synchronized event chain; model/tool/policy version identifiers; downstream execution receipts; integrity and access records; collection-gap alerts; retention/hold decisions; disclosed reconstruction limitations.
Control test
Attempt to modify evidence from the agent role, drop a collector feed and produce a false success message. Verify denial, a visible evidence-gap alert and an outcome report that distinguishes assertion from corroborated state.
Accountability
Security operations and forensic specialists own capture and investigation; records/privacy/legal govern preservation and disclosure; independent reviewers assess sufficiency and limitations.
Limits
Provenance establishes recorded origin/history, not factual truth. Cryptographic signatures do not guarantee admissibility. Telemetry may reconstruct observable events but cannot promise an exact explanation of internal model reasoning.
Controls to establish and test
Correlate event identifiers across model, retrieval, identity, tools, policy and downstream systems. Record timestamps, schema versions, collector health and the limits of capture.
Protect audit storage, access, integrity and retention independently from the agent. Preserve chain of custody and holds when required; test administrator and restoration paths.
Minimize sensitive payloads, separate secrets from logs and tightly control exceptional content capture. Pin evolving telemetry schemas and validate parsers. Preserve external outcomes rather than inferring them from a tool request alone.
Original slide: Execution Provenance & Forensics
Established terminology: Audit logging; Distributed tracing; Provenance; Chain of custody; Evidence sufficiency
Primary-source crosswalk
NIST SP 800-53 Rev. 5 AC, AU, CM, CP, IA, IR, SA, SI and SR control families Select and tailor controls to the applicable baseline
NIST SP 800-61 Rev. 3 Incident response integrated into cybersecurity risk management Final, April 2025
OpenTelemetry GenAI span conventions Span fields, optional content and sensitive-information warnings Development status: pin schema versions; do not assume stable universal interoperability
General Data Protection Regulation Articles 5, 17, 25, 30, 32 and 35; applicable exceptions and scope Binding where applicable; retention and erasure are not unconditional
How far can failure spread, and how do we regain control?
Bound the operational, financial and physical consequences of a failed or manipulated workflow. Make interruption, isolation and safe recovery enforceable outside the agent.
Why it matters
Unchecked delegation, retries, spend or persistence can amplify a small failure. Stopping one session is insufficient if child agents, scheduled jobs, credentials or published artifacts remain active.
Evidence to require
Budget and quota configuration; kill-path tests; descendant inventory; timed containment evidence; revoked-credential and denied-egress checks; persistence removal; recovery and continuity exercises.
Control test
Trigger a bounded retry storm and create a test child job. Withdraw the mandate. Verify spend and tool use stop across the chain, the child cannot restart it, and an authorized operator can restore a validated safe state.
Accountability
Operations, security and process owners agree safe interruption and recovery; finance governs material spend limits; risk leadership reviews residual impact and exercises.
Limits
Containment is an objective, not a promise that all harm is preventable. In operational technology, an abrupt stop can create physical danger: safety engineering determines the safe-state strategy.
Controls to establish and test
Set independent step, time, concurrency, token, spend and infrastructure quotas. Apply them across delegated descendants, not just the initiating session.
Rehearse suspension of tools, tokens, egress and execution; isolate memory and artifacts; inventory and eradicate persistent descendants. Preserve evidence while preventing further harm.
Define safe-state, manual-continuity and recovery decisions with process owners. Validate restoration against known-good versions and actual business outcomes before re-enabling autonomy.
Original slide: Resilience, Containment & Economic Abuse
Established terminology: Blast radius; Resource circuit breaker; Denial-of-wallet; Incident containment; Business continuity
Primary-source crosswalk
NIST SP 800-61 Rev. 3 Incident response integrated into cybersecurity risk management Final, April 2025
NIST SP 800-53 Rev. 5 AC, AU, CM, CP, IA, IR, SA, SI and SR control families Select and tailor controls to the applicable baseline
OWASP Top 10 for Agentic Applications 2026 Agent goal hijack, tool misuse, identity, memory, inter-agent and cascading risks Community risk taxonomy, published December 2025; not legislation
NIST SP 800-82 Rev. 3 Operational-technology security, safety and availability considerations Tailor interruption and recovery to physical-process hazards
Who accepts change and answers for the remaining risk?
Keep use cases, dependencies, obligations, control owners and material changes under accountable governance from procurement through retirement. Repeatable evidence supports decisions; it does not transfer accountability.
Why it matters
A model, tool, dataset, prompt or supplier update can alter the approved risk profile. Governance must address the full dependency chain and aggregate exposure, not only the initial model approval.
Evidence to require
An accountable inventory; applicability analysis; component provenance and validation; release/change approvals; vendor obligations; exception and remediation decisions; board reporting and retirement evidence.
Control test
Change a model version, tool schema or upstream source. Verify that the material change triggers the required review and regression tests, including delegation, memory, action gates and evidence capture.
Accountability
Management implements the program and allocates responsibilities; legal/compliance identifies applicable obligations; procurement and engineering govern suppliers and changes; directors oversee material risk reporting and response.
Limits
The seven domains are not an accredited framework or legal safe harbor. A reused evidence package does not automatically satisfy another regulator. Oversight liability is fact- and jurisdiction-specific; an adverse result alone is not a fiduciary breach.
Controls to establish and test
Maintain a use-case register and SBOM/AIBOM scope covering relevant software, models, data, tools, connectors and hosting dependencies. Record known unknowns and validate provenance and critical components.
Classify legal applicability by entity, role, jurisdiction, sector, data and use case. Distinguish law, guidance, contracts and voluntary standards; document gaps before claiming compliance.
Require risk-based release/change gates, supplier assurance, independent challenge and exception deadlines. Monitor after release and revoke access, retire derived stores and preserve required records at exit.
Original slide: Governance, Supply Chain & Lifecycle
Established terminology: AI management system; Configuration management; Supply-chain risk; Continuous evaluation; Fiduciary oversight
Primary-source crosswalk
NIST AI RMF 1.0 GOVERN, MAP, MEASURE and MANAGE; trustworthy-AI characteristics Voluntary framework; use-case mapping, not equivalence
CISA / international partners: SBOM for AI minimum elements Additional AI transparency and component information Recommendations, May 12, 2026; not a universal legal mandate; official indexed publication reviewed, full page access restricted
CISA: 2026 minimum elements for an SBOM Component transparency and supporting provenance fields Guidance, July 29, 2026; complements, rather than substitutes for, component testing; official indexed publication reviewed, full page access restricted
EU Artificial Intelligence Act Articles 9-15, 26 and 55, as applicable to the actor and system Requirements and dates differ by role and risk class; consult the current application timetable
Delaware Supreme Court: Marchand v. Barnhill Good-faith effort to establish a board-level reporting system for mission-critical risk Fact-specific Delaware oversight jurisprudence; an incident alone does not establish breach
Use risk-based runtime signals, scheduled evaluation and change-triggered testing. Define coverage, thresholds, false positives and uncertainty; more logging alone is not more assurance.
Keep privilege bounded
Grant only the action-specific authority needed, for the required duration, including across delegation. Enforce decisions outside the workload being controlled.
Preserve provenance with privacy
Link sources, versions, authorizations and outcomes with protected evidence. Minimize content capture and disclose gaps; a signed record is not proof that its assertions are true.
Limit propagation and preserve recovery
Constrain transactions, resources, descendants and persistence. Rehearse safe containment and independently validate recovery rather than asking the agent to certify itself.