AI Governance Engineer
GitHub

Governing AI agents: the agent, not only the model.

An agent acts under delegated authority: it calls tools, keeps memory and hands work to other agents. This page is the way in: the control plane that bounds an agent, the patterns that build it and the threats it has to hold against, each linked to its section of chapter 23.

Chapter 23 · Body of Knowledge

Four properties make an agent a different object.

  1. Delegated authority It acts on someone’s behalf. The question is whose authority it used, and whether that was narrower than theirs.
  2. Tools Its output is an effect in a system of record, not text a person reads first.
  3. Memory What it keeps persists across sessions, users and tasks, and one poisoned write outlives the session that made it.
  4. Autonomy Steps happen with no person between them, so the design has to say where a person decides and how anyone stops it.

OWASP’s agentic list names the first principle least agency: avoid autonomy the task does not need. The cheapest agent control is the agent you did not build.

Autonomy levels and the controls each addsThe 5 autonomy levels of chapter 23, from the person taking every action to the person auditing after the fact, each adding minimum controls to the levels below it.01 OperatorTakes every action. ATF tier:Intern.+ Registry entry+ Its own identity+ Read-only tools+ Traces02 CollaboratorApproves significant steps.ATF tier: Junior.Previous, plus:+ Tool allow-list, deny bydefault+ Checkpoint before everywrite03 ConsultantSets goals, gives feedback.ATF tier: Junior to Senior.Previous, plus:+ Runtime guardrail on everytool call+ Execution budgets04 ApproverApproves critical orirreversible steps. ATF tier:Senior.Previous, plus:+ Approval log, bound to thecall+ Per-agent circuit breaker+ Drilled kill switch05 ObserverAudits after the fact. ATF tier:Principal.Previous, plus:+ Trajectory anomalydetection+ Independent trajectory evals+ Reversible, bounded actionsonlySource: chapter 23, "Autonomy is adesign decision"
Autonomy levels and the controls each addsThe 5 autonomy levels of chapter 23, from the person taking every action to the person auditing after the fact, each adding minimum controls to the levels below it.01OperatorTakes every action. ATFtier: Intern.+ Registry entry+ Its own identity+ Read-only tools+ Traces02CollaboratorApproves significantsteps. ATF tier: Junior.Previous, plus:+ Tool allow-list, denyby default+ Checkpoint before everywrite03ConsultantSets goals, givesfeedback. ATF tier:Junior to Senior.Previous, plus:+ Runtime guardrail onevery tool call+ Execution budgets04ApproverApproves critical orirreversible steps. ATFtier: Senior.Previous, plus:+ Approval log, bound tothe call+ Per-agent circuitbreaker+ Drilled kill switch05ObserverAudits after the fact. ATFtier: Principal.Previous, plus:+ Trajectory anomalydetection+ Independent trajectoryevals+ Reversible, boundedactions onlySource: chapter 23, "Autonomy is a design decision"
Autonomy is bought with controls Five levels by the role the person plays (Feng, McDonald and Zhang), not the 0 to 4 registry scale of chapter 11: each level keeps every control below it and adds its own. Choose the lowest level the task allows.
Data table
Each autonomy level with what the person does, the nearest ATF tier and the minimum controls it adds
LevelUser roleDetailMinimum controls it adds
1OperatorTakes every action. ATF tier: Intern.Registry entry; Its own identity; Read-only tools; Traces
2CollaboratorApproves significant steps. ATF tier: Junior.Tool allow-list, deny by default; Checkpoint before every write
3ConsultantSets goals, gives feedback. ATF tier: Junior to Senior.Runtime guardrail on every tool call; Execution budgets
4ApproverApproves critical or irreversible steps. ATF tier: Senior.Approval log, bound to the call; Per-agent circuit breaker; Drilled kill switch
5ObserverAudits after the fact. ATF tier: Principal.Trajectory anomaly detection; Independent trajectory evals; Reversible, bounded actions only

Autonomy levels and minimum controls in chapter 23

The agent control plane, component by component.

Ten components sit around every agent in production. Each one leaves evidence, and each links to its section in chapter 23.

The agent control plane One tool call through the agent control plane: registry, identity, gateway, guardrail, checkpoint and breaker, with telemetry kept as evidence. One tool call through the control plane Agent registry owner, scope, expiry no entry, no credential Identity issuer short-lived credential Agent proposes a tool call Tool gateway deny by default Runtime guardrail policy check, every call fails closed for pay, delete, send, execute Human checkpoint where stakes demand it Circuit breaker per agent stop levels task scope breaker identity class degrade stops trips Tool, MCP server or remote agent your boundary: revoke what you issued Telemetry and evidence identity, tool calls, verdicts, approvals Layer 02 Inventory & Transparency Layer 04 Runtime Controls & Observability Layer 05 Assurance & Continuous Compliance
The agent control plane One tool call through the agent control plane: a registry entry gates the credential, the gateway and the guardrail check the call, a checkpoint fires where the stakes demand it and a per-agent breaker can stop it, while every step leaves telemetry kept as evidence. Check that each agent in your registry has all of them and that its stop has been drilled. Illustrative, not a claim of conformity. Drawn from chapter 23. Permalink, downloads and citation
Text description

The control plane in the order a tool call meets it. The agent registry (Layer 02 Inventory & Transparency) holds every agent with an owner, a purpose, an autonomy level, its tools, pinned versions, stop handles and an expiry: no registry entry, no credential. The identity issuer (Layer 04 Runtime Controls & Observability) gives the agent a short-lived, attested workload credential, with delegation that names the agent, never impersonation of the user. The agent proposes a tool call. The tool gateway denies by default, with pinned tool definitions, scopes, rates and egress per tool, and admitted MCP servers only. The runtime guardrail checks every call before it runs (identity against a live registry entry, the allow-list and definition hash, parameters within policy, instruction provenance, the output and egress filter, execution budgets) and fails closed for pay, delete, send and execute, open with an alert only for reads. A human checkpoint approves where the stakes or irreversibility demand it, showing the raw call. The per-agent circuit breaker has six stop levels: pause a task, narrow the scope, trip the breaker, revoke the identity, stop a class and degrade; exhausted budgets trip it, and a tripped breaker makes the gateway reject every call from the agent. Past your boundary sit the tool, the MCP server or a remote agent: you cannot stop someone else's agent, only stop calling it and revoke what you issued to it. Every step leaves telemetry that carries identity, tool calls, verdicts and approvals, kept as evidence (Layer 05 Assurance & Continuous Compliance). Memory controls, delegation across hops and prompt change control complete the plane in chapter 23.

  1. Agent registry Every agent with an owner, a purpose, an autonomy level, its tools, pinned versions, stop handles and an expiry.
  2. Identity issuer Short-lived, attested workload credentials; delegation that names the agent, never impersonation of the user.
  3. Tool gateway and allow-list Deny by default: pinned tool definitions, scopes, rates and egress per tool, and admitted MCP servers only.
  4. Runtime guardrail Every tool call checked before it runs, with a failure posture decided per operation class and execution budgets.
  5. Human checkpoint Approval where the stakes or irreversibility demand it, showing the raw call and bound to its parameters.
  6. Circuit breaker and kill switch Stop levels from one task to a fleet segment, drilled on a schedule and verified to hold.
  7. Memory controls Write gates, isolation per user and task, retention as code and rollback to a known-good state.
  8. Delegation across hops The originating principal and every actor stay on the record, and scope narrows at each hop.
  9. Prompt and configuration change control System prompts and tool descriptions versioned, reviewed, gated by evals and rolled back by hash.
  10. Telemetry and evidence Traces that carry identity, tool calls, verdicts and approvals, kept as evidence and fed to incident response.

Chapter 23 sets out 42 agent controls across these components. The agent control profile tool picks the ones one agent needs; the agent runtime control profile states each as a draft reference control with the evidence it must leave, open for technical review.

Write down one agent’s control profile in the toolkit

Six patterns that build it.

Ten agentic threats, and the control for each.

The OWASP Top 10 for Agentic Applications 2026, each threat mapped to the control that contains it and the pattern that implements the control.

Ten agentic threats and the patterns that hold themThe ten OWASP agentic threats, each flowing to the pattern or patterns chapter 23 assigns it; 7 patterns, each in its stack-layer colour and named with its layer.OWASP agentic threat to PatternASI03 + ASI07 (2)L4 · Agent Identity & ScopedCredentials: 2ASI01 Agent Goal Hijack (1)L4 · Runtime Guardrail: 1ASI02 Tool Misuse and Exploitation(1)L4 · Runtime Guardrail: 1ASI05 Unexpected Code Execution(RCE) (1)L4 · Runtime Guardrail: 1ASI06 Memory & Context Poisoning(1)L4 · Runtime Guardrail: 1ASI04 Agentic Supply ChainVulnerabilities (1)L2 · AIBOM: 1ASI08 Cascading Failures (1)L4 · Kill Switch / Circuit Breaker: 1ASI09 Human-Agent Trust Exploitation(1)L4 · Human-in-the-loop Gate: 1ASI10 Rogue Agents (2)L2 · Agent Registry: 1L2 · Shadow-AI Discovery: 1Source: chapter 23, "Threatsmapped to controls"As of 2026-09-24
Ten agentic threats and the patterns that hold themThe ten OWASP agentic threats, each flowing to the pattern or patterns chapter 23 assigns it; 7 patterns, each in its stack-layer colour and named with its layer.OWASP agentic threatPatternASI03 Identity and Privilege Abuse; ASI07 Insecure Inter-Agent Communication to Layer 04 · Agent Identity & Scoped Credentials: 2 threat-pattern pairsASI03 Identity and Privilege Abuse; ASI07 Insecure Inter-Agent Communication: 2 threat-pattern pairsASI03 + ASI072ASI01 Agent Goal Hijack to Layer 04 · Runtime Guardrail: 1 threat-pattern pairASI01 Agent Goal Hijack: 1 threat-pattern pairASI01 Agent Goal Hijack1ASI02 Tool Misuse and Exploitation to Layer 04 · Runtime Guardrail: 1 threat-pattern pairASI02 Tool Misuse and Exploitation: 1 threat-pattern pairASI02 Tool Misuse and Exploitation1ASI05 Unexpected Code Execution (RCE) to Layer 04 · Runtime Guardrail: 1 threat-pattern pairASI05 Unexpected Code Execution (RCE): 1 threat-pattern pairASI05 Unexpected Code Execution (RCE)1ASI06 Memory & Context Poisoning to Layer 04 · Runtime Guardrail: 1 threat-pattern pairASI06 Memory & Context Poisoning: 1 threat-pattern pairASI06 Memory & Context Poisoning1ASI04 Agentic Supply Chain Vulnerabilities to Layer 02 · AIBOM: 1 threat-pattern pairASI04 Agentic Supply Chain Vulnerabilities: 1 threat-pattern pairASI04 Agentic Supply Chain Vulnerabilities1ASI08 Cascading Failures to Layer 04 · Kill Switch / Circuit Breaker: 1 threat-pattern pairASI08 Cascading Failures: 1 threat-pattern pairASI08 Cascading Failures1ASI09 Human-Agent Trust Exploitation to Layer 04 · Human-in-the-loop Gate: 1 threat-pattern pairASI09 Human-Agent Trust Exploitation: 1 threat-pattern pairASI09 Human-Agent Trust Exploitation1ASI10 Rogue Agents to Layer 02 · Agent Registry: 1 threat-pattern pairASI10 Rogue Agents to Layer 02 · Shadow-AI Discovery: 1 threat-pattern pairASI10 Rogue Agents: 2 threat-pattern pairsASI10 Rogue Agents2Layer 04 · Agent Identity & Scoped Credentials: 2 threat-pattern pairsL4 · Agent Identity & Scoped Credentials2Layer 04 · Runtime Guardrail: 4 threat-pattern pairsL4 · Runtime Guardrail4Layer 02 · AIBOM: 1 threat-pattern pairL2 · AIBOM1Layer 04 · Kill Switch / Circuit Breaker: 1 threat-pattern pairL4 · Kill Switch / Circuit Breaker1Layer 04 · Human-in-the-loop Gate: 1 threat-pattern pairL4 · Human-in-the-loop Gate1Layer 02 · Agent Registry: 1 threat-pattern pairL2 · Agent Registry1Layer 02 · Shadow-AI Discovery: 1 threat-pattern pairL2 · Shadow-AI Discovery1Source: chapter 23, "Threats mapped to controls"As of 2026-09-24
Which pattern holds which threat Each threat flows to the pattern chapter 23 assigns it; a pattern's width is the number of its threats, its colour and its "L" prefix the pattern's stack layer. Runtime Guardrail holds 4 of the 10. ASI10 flows to both patterns the chapter gives it, Agent Registry and Shadow-AI Discovery, so its block counts 2. ASI03 and ASI07 share one block, as both go to Agent Identity & Scoped Credentials; it opens ASI03's row. Select a threat for its row in the table below.
Data table
Each OWASP agentic threat with the pattern or patterns chapter 23 assigns it
ThreatPatternThreats
ASI03 Identity and Privilege Abuse; ASI07 Insecure Inter-Agent CommunicationLayer 04 · Agent Identity & Scoped Credentials2
ASI01 Agent Goal HijackLayer 04 · Runtime Guardrail1
ASI02 Tool Misuse and ExploitationLayer 04 · Runtime Guardrail1
ASI05 Unexpected Code Execution (RCE)Layer 04 · Runtime Guardrail1
ASI06 Memory & Context PoisoningLayer 04 · Runtime Guardrail1
ASI04 Agentic Supply Chain VulnerabilitiesLayer 02 · AIBOM1
ASI08 Cascading FailuresLayer 04 · Kill Switch / Circuit Breaker1
ASI09 Human-Agent Trust ExploitationLayer 04 · Human-in-the-loop Gate1
ASI10 Rogue AgentsLayer 02 · Agent Registry1
ASI10 Rogue AgentsLayer 02 · Shadow-AI Discovery1
Threat Control Pattern
ASI01 Agent Goal Hijack Instruction provenance; checkpoints before writes; trajectory evals Runtime Guardrail
ASI02 Tool Misuse and Exploitation Tool allow-list; per-tool rate, egress and budgets Runtime Guardrail
ASI03 Identity and Privilege Abuse Workload identity; short-lived delegated tokens; audience checks Agent Identity & Scoped Credentials
ASI04 Agentic Supply Chain Vulnerabilities MCP server admission; pinned tool definitions AIBOM
ASI05 Unexpected Code Execution (RCE) Sandboxed execution; deny by default Runtime Guardrail
ASI06 Memory & Context Poisoning Memory write gate; isolation; rollback Runtime Guardrail
ASI07 Insecure Inter-Agent Communication Mutual authentication; signed Agent Cards; peer allow-list Agent Identity & Scoped Credentials
ASI08 Cascading Failures Depth and fan-out limits; per-agent breakers Kill Switch / Circuit Breaker
ASI09 Human-Agent Trust Exploitation Approvals that show the raw call; oversight metrics Human-in-the-loop Gate
ASI10 Rogue Agents Registry with expiry; discovery; drilled kill switch Agent Registry ; Shadow-AI Discovery

The full threat-to-control table

Where the frameworks and the law meet it.

  1. The agent-control table (chapter 08) TC260 Framework 3.0 Appendix 2, the OWASP agentic list and the NIST agent initiative, control by control.
  2. NIST AI Agent Standards Initiative (chapter 08) Agent identity, authentication, authorisation and agent security.
  3. OWASP GenAI Security Project (chapter 08) The agentic threat list, the 2026 LLM list and the Agent Control Standard.
  4. CSA AICM and STAR for AI (chapter 08) The AI Controls Matrix and its extensions towards agents.
  5. Frameworks written for agents (chapter 23) NIST, CSA, Singapore’s IMDA, TC260 and OWASP, with their status.
  6. EU AI Act hooks for agents (chapter 23) Articles 12, 14, 15, 25, 26 and 50 and the GPAI duties, with the agent artefact for each.
  7. Deployer duties, Article 26 (chapter 18) Oversight by competent people, monitoring, suspension and log retention.
  8. Designing human oversight (chapter 04) Automation bias, oversight that degrades, and how to measure it.

Tool categories for the control plane.

The categories that fill the runtime layer for agents, with the examples the Body of Knowledge names. The category is the substance; the brands are illustrative, not an endorsement.

Category Examples (illustrative) Layer
Agent-discovery tools Zenity L2
Guardrail frameworks NVIDIA NeMo Guardrails · Meta LlamaFirewall · Lakera · Guardrails AI · Llama Guard L4
Observability Langfuse · Arize Phoenix · OpenTelemetry (GenAI semantic conventions) L4
MCP / tool-call security MCP Inspector · Snyk Agent Scan · mcp-context-protector L4
Kill switch / circuit breaker Unleash · Envoy · Resilience4j L4
Agent workload identity SPIFFE/SPIRE · Microsoft Entra Agent ID · Okta Agent SSO L4

Every tool category, by layer

When agents fail.

  1. An agent acting beyond its mandate Harms atlas: operational disruption when an agent holds standing credentials broader than its task.
  2. Prompt injection Harms atlas: security compromise through instructions hidden in content the agent reads.
  3. Over-reliance Harms atlas: institutions acting on generated output without independent checks.
  4. The agent incident taxonomy (chapter 23) Eleven failure classes with the detection signal, the first containment and the threat IDs.
  5. AI-specific failure modes (chapter 17) Tool misuse, cascading failures and rogue behaviour inside the wider incident process.

Read the whole chapter.

Chapter 23 sets out autonomy levels, identity and MCP authorisation, checkpoints, memory, delegation chains and the EU AI Act hooks, with every source.

Read chapter 23 Browse all patterns