C · U · S · T · O · D · Y
Each pillar states universal control objectives, then how the requirement shifts by level and by mandate. Every pillar applies to every profile. The profile determines rigor, not applicability.
An L1 assistant still has a supervision requirement; it is "someone can turn it off and it is rate limited," not a tree-wide network-layer kill switch. It still has a disposal requirement; it is "we know what it wrote and where," not creation-time artifact tracking with per-artifact teardown evidence. A blank cell in the control matrix would mean a pillar does not apply, and there are none.
The pillars are a mnemonic, not a sequence. The adoption path differs and runs in dependency order.
C Conditions of ReleaseWhat the agent may touch, and your right to authorize it
Intent. Convert authorization from prose into a machine-enforceable artifact that upstream controls consume directly. If a condition cannot be expressed as data, it cannot be enforced. This is the release order: specific, versioned, signed, and binding on every control downstream.
Control objectives
- Conditions are a structured, versioned artifact: systems, data domains, IP ranges, DNS zones, cloud account IDs, repositories, asset tags, identity domains, and explicit exclusions.
- The artifact declares the agent's profile — level ceiling, mandate, reach ceiling — and these are enforced, not descriptive. The level ceiling in particular is enforced by the absence of capability, not by instruction.
- The same artifact is the input to network policy, identity scoping, and monitoring. A single source of truth, not three drifting copies.
- Authorization is verified for every asset class, with attention to shared-tenancy SaaS, managed services, provider terms, and partner-connected systems.
- Exclusion zones are enumerated explicitly: safety systems, medical devices, OT and ICS, production payment paths, regulated data stores, third-party infrastructure.
- Conditions changes require re-authorization and are versioned. Mid-assignment expansion is a governed event, not a configuration tweak.
- Release is never open-ended. Every set of conditions carries an expiry.
- Delegated conditions are derived by restriction from a parent artifact and carry the parent's identifier.
The agent acts on something you had no standing or intent to authorize, most commonly a shared or partner-owned system that looked internal from where the agent was standing.
Where does our authorization boundary live as data? If a human and the agent disagree about whether a system is in scope, what adjudicates?
U Untrusted InputProtecting the agent from hostile content and supply chain risk
Intent. Every agent ingests content it did not author and cannot vouch for. Everything read during an assignment is potentially adversarial, and containment assurance expires the moment the agent changes.
Control objectives
- Ingested content — web pages, banners, file contents, logs, tool output, tickets, dependency documentation — is treated as untrusted data, never as instruction. Injection resistance is a tested property, not an assumed one.
- The agent supply chain is governed: model versions, tool plugins, extensions, MCP servers, and dependencies are inventoried, pinned, and reviewed.
- Any change to the model, agent framework, or tool set triggers re-certification. Containment validated against one version does not transfer to the next.
- Tool set changes are re-classified, not just re-certified. Adding a shell tool to an L3 agent is a level change and requires re-authorization at the new level.
- Containment is drilled: the organization periodically attempts to break its own agents out of their enclaves and treats success as a priority finding.
- In L5 systems, inter-agent messages are untrusted input. A sub-agent's output arriving at its parent is content from a system that consumed hostile data.
The agent becomes the incident: hijacked via injected instruction or compromised through its supply chain, then exercising its legitimate access on someone else's behalf.
When did we last try to break our own agent out? When our model provider ships an update, what happens to our containment assurance? If a tool was added last week, was the agent re-classified?
S Supervision & StopKeeping a human meaningfully in control at machine speed
Intent. Autonomy is tiered by consequence. The more irreversible the action, the more human judgment is required, and revocation must always be possible and fast.
Control objectives
- Actions are classified into tiers by blast radius and reversibility: read, then reversible write, then irreversible write (schema change, deletion, deployment), then privilege change, then actions affecting availability or third parties.
- Autonomy thresholds are set per tier, per profile, and per environment. Higher tiers require synchronous human approval, and the highest may be prohibited outright.
- A kill switch exists that operates at the network and identity layers, revoking access and severing egress, and does not depend on the agent processing a stop instruction.
- The kill switch is tree-wide. Stopping an orchestrator that has already spawned children stops nothing. Revocation targets the assignment identifier and reaches every identity and environment derived from it.
- Rate and volume limits constrain the pace of action, providing human-scale reaction time.
- Dead-man timers halt assignments that exceed expected duration or lose supervisory contact.
- Named humans are on call for the duration of any autonomous run, with unambiguous authority to revoke.
Speed outruns oversight. The damaging action completes before anyone reviews it.
How long from "we need this to stop" to "it has stopped"? Who has authority to call it, at 3am, without escalation? If we kill the parent, do the children die?
T Temporary AuthorityWhat it authenticates as, for how long, and on whose accountability
Intent. This is the pillar that directly enforces the authority and level principles. Treat the agent as a non-human identity with the tightest possible grant and a hard expiry, and treat credentials it encounters as material to be reported rather than capability to be used.
Control objectives
- Each assignment issues a unique, short-lived non-human identity. No shared service accounts, no reuse across assignments, no standing privilege.
- Privilege expires on wall-clock time independent of assignment state. Work that runs long loses its authority rather than extending it silently.
- Credentials encountered during an assignment do not become capability by default. Any credential, token, key, or session discovered in the environment is quarantined and reported. Use requires explicit gating against the conditions artifact.
- Assumed roles and inherited tokens are scoped down at assumption, not accepted at whatever breadth they happen to carry.
- Sub-agents inherit a subset of authority, never a superset and never a fresh grant. The delegation mechanism itself must be incapable of minting authority.
- Every action carries a run ID resolvable to a named accountable human and an authorizing manager, through the full delegation chain.
- Agent identities are distinguishable from human and production identities in all logs and detection logic, and the identity encodes the profile.
- Secrets are minimized and brokered rather than embedded or discoverable on disk.
- Granted authority does not exceed the authorizing human's own authority.
Capability accretion. The agent bootstraps from limited access to broad access, or authenticates into an environment nobody scoped using something it found in one that was.
What can this agent authenticate as right now, as opposed to what we granted it? What happens to a credential it discovers at 2am on a Saturday? Can any delegation path produce an identity more privileged than its parent?
O Observability & EscalationProving what happened, and responding when it goes wrong
Intent. Autonomous action at volume is only defensible if it is fully reconstructable. This pillar produces the record, and defines what happens the moment that record shows something unexpected.
Control objectives
- Every action is logged with fidelity sufficient to reconstruct the assignment: target, action, tier, timestamp, run ID, parent run ID, and the decision or approval that authorized it.
- Logs are written to storage the agent cannot modify or delete, independent of its execution environment.
- Effective authority is monitored, not just granted authority. Alert on an agent authenticating as an identity it was not issued, or reaching a system outside its conditions.
- Effective level is monitored. Alert on process spawn, tool acquisition, agent invocation, code execution, or scheduled-task creation by an agent whose ceiling does not permit it. This detection layer is usually absent.
- Effective mandate is monitored. Alert on escalation-shaped activity by a non-adversarial agent. Map these to existing ATT&CK-aligned detections; the agent identity is what makes the alert unambiguous.
- SOC deconfliction is established before launch, including a fast path to conclude that an incident is not the agent.
- Denied attempts, condition challenges, and near-misses are reviewed as behavioral signal about the agent, separate from the output of its work.
- Evidence is retained and structured to satisfy audit, regulatory inquiry, cyber insurance, and legal defense of the authorization.
You cannot prove what happened. Or the SOC burns a real incident response on agent activity and misses a concurrent genuine intrusion.
If a regulator or partner asked us to prove our agent never touched their systems, could we? Who decides that anomalous agent behavior is an incident? Can we reconstruct which sub-agent did a given thing, and under whose authority?
D Disposal & DecommissionVerified teardown of everything the assignment created
Intent. Assignments create access, artifacts, and infrastructure. Autonomy creates more of all three, faster, and with less human memory of what was created. Return is not complete until teardown is verified.
Control objectives
- Artifacts introduced during assignments — accounts, scheduled tasks, uploaded files, modified configurations, deployed resources, established persistence — are tracked at the moment of creation, not reconstructed from logs afterward.
- Removal is verified, not asserted. Cleanup produces evidence of completion per artifact. Artifacts of penetration tests not properly cleaned are a nightmare during incident response, where they are often interpreted as indicators of compromise.
- Assignment credentials are revoked and secrets rotated at close, independent of expiry timers.
- Execution environments are destroyed and rebuilt rather than reused.
- Assignment data is classified, encrypted, access-controlled, and retention-limited with a defined destruction date.
- Orphaned artifacts discovered after close are treated as findings against the program, not silently remediated.
- Teardown is tree-wide and bottom-up. Sub-agent environments, identities, and artifacts are destroyed before the parent's, and the parent's close is blocked until every child's teardown is verified.
The assignment ends but its access does not. Accounts, resources, and persistence mechanisms remain as unmanaged backdoors that a real adversary can find, and that you will not recognize as your own.
What did our agents create last month, and how much of it still exists? If an attacker used one of our leftover service accounts, would we notice? Who owns cleanup for a resource created by a sub-agent three levels down?
Y Yard & EgressMaking scope a property of the network rather than of intentions
Intent. The agent operates inside a bounded space where movement is genuinely unrestricted, with a single controlled way out. Within the yard, the agent works without friction. Leaving it requires passing a broker that independently enforces the conditions artifact, and containment does not depend on the agent's cooperation.
Control objectives
- Agents execute in a dedicated environment with no default route to corporate, production, or internet destinations.
- All traffic — including DNS, package installs, model API calls, and telemetry — exits through a mediating proxy or broker that validates each destination against the conditions artifact.
- Denied attempts are logged as high-signal security events. A pattern of out-of-scope attempts is itself a finding about the agent.
- The environment is ephemeral: built per assignment, never a long-lived system accumulating credentials and access.
- Model and tool endpoints are explicitly allowlisted; the agent cannot reach arbitrary external services to fetch payloads or exfiltrate collected data.
- Allowlisted bidirectional channels are treated as exfiltration paths, because they are. Destination validation cannot help with a model API endpoint that accepts arbitrary content by design. These need volume, rate, and content controls of their own, or a broker that owns the call rather than proxying it.
- The isolation boundary is sized to the mandate. A shared-kernel container is a reasonable boundary against an agent that is not trying to defeat it. It is not a boundary against an agent whose authorized function is defeating boundaries. Adversarial mandate, and any agent at R3, requires a hypervisor-class or dedicated-host boundary.
- Sub-agents run inside the parent's yard or a nested subset of it, never in a sibling environment with independent egress. Nesting is a property of policy inheritance at the broker, not of address space.
The breakout. The agent follows a route, trust relationship, or resolved hostname out of its intended environment and into a network nobody authorized.
If this agent were fully compromised right now, what is the complete set of systems it could reach? Can we demonstrate that answer rather than assert it?
The full control objectives
Section 7 of the specification carries each pillar in full, along with the annex control matrix that marks lowest-rigor forms distinctly from full controls and from recommendations.