Secure AI agents before they act on your systems
AI agents read your data, call tools and take actions on someone's behalf. A manipulated agent with broad access can leak data or do real damage. This editable standard sets the controls for every agent you build, configure or let in.
Chatbots answer. Agents act.
They hold access
Agents often run with a person's credentials, shared service accounts or long-lived keys. The standard gives each agent its own identity and short-lived access scoped to the task.
They read untrusted content
Web pages, emails and documents can carry hidden instructions (prompt injection). The standard keeps untrusted content from being treated as commands, and limits what a manipulated agent can reach.
They can move data and money
Agents can send messages, change records or approve payments. The standard sets human approval gates for high-impact actions, data leakage controls and a way to stop any agent at once.
Clear rules, from agent identity to kill switch
- Editable Word standard in formal "shall" requirement language
- Agent identity and token rules by risk tier, delegation logging and zero standing privilege
- Tool, connector and MCP tool-server hardening, sandboxing and path allowlists
- Prompt injection boundaries, human approval gates, kill switch and data leakage controls
- Five detection use cases, a worked invoice-agent example, and links to the post-quantum standard for agent certificates
Sections
Agent identity and access · Delegation and accountability · Tool, connector and tool-server hardening · Prompt injection and context boundaries · Human approval gates and stopping agents · Data leakage prevention · Monitoring and testing · Roles, exceptions and detection use cases.
Who it's for
CISOs, security architects, and AI platform and engineering teams deploying agents, agent features in purchased software, or vendor agents that act on your systems.
Frameworks referenced
- NIST AI RMF 1.0
- OWASP Top 10 for Agentic Applications
- NIST CSF 2.0
- ISO/IEC 27001:2022
- ISO/IEC 42001:2023
Questions
Is it tied to one AI platform?
No. It's vendor-neutral and covers agents you build, agent features you configure and vendor agents acting on your systems.
Does it work with the AI Governance Kit?
Yes. It applies the AI Acceptable Use Policy (AI-02) and risk method (AI-03) at a technical level, and the kit's workbook includes an Agent Register. It also works on its own.
Does it cover tool servers such as Model Context Protocol servers?
Yes. Section 6 covers tool, connector and tool-server hardening, allowlists and sandboxing.
Will it stop every attack on our agents?
No standard can. It sets controls that reduce the chance and impact of misuse, and helps you show reviewers how agents are governed.
Register every agent before it goes live
Owner, purpose, risk tier, tools, data and approval gates: the first requirement in the standard, and the one reviewers ask about first.