{
  "notice": "Illustrative mapping from the AI Governance Engineer Body of Knowledge v0.5.0 (not a claim of conformity)",
  "version": "0.5.0",
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "schemaVersion": 1,
  "schema": "https://aigovernanceengineer.com/api/v1/schemas/control.json",
  "self": "https://aigovernanceengineer.com/api/v1/controls/aige-ctl-agent-040.json",
  "source": "https://aigovernanceengineer.com/controls/agent-runtime#aige-ctl-agent-040",
  "citation": {
    "title": "AI Governance Engineering: The Thesis & Body of Knowledge",
    "authors": [
      "Jorge García Aibar"
    ],
    "parentDoi": "https://doi.org/10.5281/zenodo.22956197",
    "conceptDoi": "https://doi.org/10.5281/zenodo.22857084"
  },
  "control": {
    "id": "AIGE-CTL-AGENT-040",
    "profile": "agent-runtime",
    "url": "https://aigovernanceengineer.com/controls/agent-runtime#aige-ctl-agent-040",
    "json": "https://aigovernanceengineer.com/api/v1/controls/aige-ctl-agent-040.json",
    "title": "Users told what the agent may do and whom to call",
    "version": "0.2",
    "status": "draft",
    "reviewerStatus": "open",
    "depth": "derived",
    "objective": "Where people use the agent, they are told what it is authorised to do and decide, how it collects, stores and uses their data, and which people are responsible for it and can be alerted when it malfunctions or they dispute a decision; the notice changes when the allow-list does.",
    "failureModes": [
      "People using the agent cannot find out what it may do, how it uses their data or whom to alert when it malfunctions.",
      "The agent gains a tool that changes what it may do, and the notice stays the same."
    ],
    "scope": "Agents that people use directly, inside or outside the organisation.",
    "enforcementPoints": [
      "deploy"
    ],
    "verification": [],
    "evidence": [
      {
        "artefact": "User-facing notice; contact points named in the registry entry",
        "schemaId": null,
        "schema": null,
        "layer": 2
      }
    ],
    "failureResponse": {
      "effect": "alert",
      "text": "To be specified."
    },
    "layer": 2,
    "secondaryLayers": [],
    "patterns": [],
    "seeds": [
      {
        "id": "user-information",
        "title": "Users told what the agent may do and whom to call",
        "url": "https://aigovernanceengineer.com/bok/governing-agents#telling-people-what-the-agent-can-do"
      }
    ],
    "derivedFrom": [],
    "mappings": {
      "obligations": [],
      "iso42001": [],
      "nistAiRmf": [],
      "owasp": [],
      "atlas": [],
      "aiuc1": [],
      "csaAicm": [],
      "other": [
        {
          "framework": "IMDA MGF for Agentic AI v1.5",
          "ref": "2.4.2 Users who interact with agents, p.47",
          "note": "Direct fit: The agent's range of actions and decisions, how user data is used, and human contact points for malfunctions and disputed decisions"
        }
      ]
    },
    "references": [
      {
        "n": 31,
        "title": "Governing AI agents",
        "text": "Governing AI agents (AI Governance Engineering Body of Knowledge v0.5.0, chapter 23, section \"Telling people what the agent can do\"). AI Governance Engineer (Jorge García Aibar). 2026-09.",
        "url": "https://aigovernanceengineer.com/bok/governing-agents#telling-people-what-the-agent-can-do",
        "verified": "primary"
      },
      {
        "n": 29,
        "title": "Governing AI agents",
        "text": "Governing AI agents (AI Governance Engineering Body of Knowledge v0.5.0, chapter 23, section \"EU AI Act hooks for agents\"). AI Governance Engineer (Jorge García Aibar). 2026-09.",
        "url": "https://aigovernanceengineer.com/bok/governing-agents#eu-ai-act-hooks-for-agents",
        "verified": "primary"
      },
      {
        "n": 4,
        "title": "Model AI Governance Framework for Agentic AI, v1.5",
        "text": "Model AI Governance Framework for Agentic AI, v1.5 (published 2026-05-20, updated 2026-06-05; four dimensions: assess and bound the risks upfront, make humans meaningfully accountable, implement technical controls and processes, enable end-user responsibility). IMDA. 2026-06-05.",
        "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf",
        "verified": "primary"
      }
    ],
    "implementationNotes": [
      "This goes beyond the AI Act disclosure of AIGE-CTL-AGENT-031: that one says the person is dealing with an AI system, this one says what the agent may do and who answers for it."
    ],
    "openQuestions": [
      "Verification procedure and evidence schema to be specified; requires technical review."
    ],
    "observation": null,
    "observationSchema": "https://aigovernanceengineer.com/schemas/control-observation.v1.json",
    "examples": []
  }
}