Agentic Trust FrameworkATF Doesn't Compete With Your Frameworks. It Operationalizes Them.
“MAESTRO tells you what to worry about. OWASP tells you what can go wrong. NIST tells you the principles. ATF tells you what to build.”
Use threat models and risk assessments to identify gaps. Use ATF to close them.
At a Glance
Nine frameworks, and how each one relates to ATF.
| Framework | Relationship | Crosswalk |
|---|---|---|
| CSA AI Controls Matrix (AICM)243 AI security controls across 18 domains | Parent framework | 12 mapped points |
| MAESTRO (CSA)Threat modeling for multi-agent systems | Complementary | 7 mapped points |
| OWASP Top 10 for Agentic ApplicationsRisk catalog for AI agent vulnerabilities | Complementary | 10 mapped points |
| NIST 800-207 / AI RMFZero Trust architecture + AI risk management | Foundational | 7 mapped points |
| ISO/IEC 42001:2023AI-specific management system standard | Directly aligned | 9 mapped points |
| ISO/IEC 27001:2022Information security management baseline | Foundational | 8 mapped points |
| AWS Agentic AI Security Scoping MatrixAgent scope classification | Directly aligned | 4 mapped points |
| OWASP AEGIS (Forrester)Agent governance assessment | Complementary | 3 mapped points |
| KPMG TACOTrust in AI compliance and oversight | Adjacent | 3 mapped points |
CSA AI Controls Matrix (AICM)
243 AI security controls across 18 domains
AICM is CSA’s flagship AI security controls framework: 243 control objectives across 18 domains, built on the Cloud Controls Matrix. ATF operationalizes the agent-specific subset, adding the maturity model and progressive autonomy governance that AICM does not have.
| CSA AI Controls Matrix | ATF response |
|---|---|
| Identity & Access Management (IAM) | Identity: agent credentials, mutual authentication, non-human identity lifecycle |
| Data Security & Privacy Lifecycle (DSP) | Data Governance: input validation, PII/PHI classification, data lineage, output filtering |
| Log and Monitoring (LOG) | Behavior: real-time behavioral monitoring, structured decision logging, anomaly detection |
| Infrastructure & Virtualization Security (IVS) | Segmentation: network isolation, resource boundaries, blast radius containment |
| Security Incident Management (SEF) | Incident Response: kill switches, circuit breakers, containment, recovery playbooks |
| Model Security (MDS) | Identity + Data Governance: model provenance, supply chain verification, integrity validation |
| Application & Interface Security (AIS) | Segmentation + Behavior: API governance, action boundaries, rate limiting |
| Governance, Risk & Compliance (GRC) | Operating model: governance policies, promotion criteria, review cadence, compliance evidence |
| Supply Chain Management (STA) | Identity + Data Governance: agent provenance, tool verification, delegation chain integrity |
| Audit & Assurance (A&A) | Maturity model: governance sign-off gates, assessment scoring, certification readiness |
| Change Control & Config (CCC) | Behavior + Operating model: configuration drift detection, change approval workflows |
| Threat & Vulnerability Mgmt (TVM) | Behavior + Incident Response: threat detection for agent-specific attack vectors |
AICM defines the 243 controls for AI broadly; ATF operationalizes the subset that applies to autonomous agents. Organizations using AICM for broad AI governance can layer ATF as the agent-specific operating model, gaining a maturity progression and scored self-assessment AICM does not provide. Both are published through CSA and freely available.
MAESTRO (CSA)
Threat modeling for multi-agent systems
MAESTRO tells you what to worry about. ATF tells you what to build. MAESTRO provides a 7-layer threat model for multi-agent systems; ATF provides the governance controls that address those threats.
| MAESTRO | ATF response |
|---|---|
| Foundation Model | Identity: credential management, model provenance |
| Data Operations | Data Governance: input validation, output filtering |
| Agent Core | Behavior: monitoring, anomaly detection, explainability |
| Agent Ecosystem | Identity: agent-to-agent authentication, delegation chains |
| Deployment Infrastructure | Segmentation: network isolation, policy enforcement |
| Orchestration & Interaction | Segmentation + Behavior: workflow controls, coordination limits |
| Evaluation & Observability | All elements: continuous monitoring, compliance reporting |
When you finish a MAESTRO threat assessment, the natural next question is “now what do we build?” ATF is that implementation specification. Use MAESTRO to identify risks; use ATF to mitigate them.
OWASP Top 10 for Agentic Applications
Risk catalog for AI agent vulnerabilities
OWASP identifies the top risks; ATF provides the controls that mitigate them. Every OWASP agentic risk maps to one or more ATF elements.
| OWASP Top 10 for Agentic Applications | ATF response |
|---|---|
| ASI-01: Agent Identity Spoofing | Identity: cryptographic agent credentials, mutual auth |
| ASI-02: Agent Authorization Failures | Identity + Segmentation: RBAC/ABAC, policy-as-code |
| ASI-03: Excessive Agent Autonomy | Behavior + Segmentation: maturity levels, boundaries |
| ASI-04: Improper Output Handling | Data Governance: output validation, toxicity filtering |
| ASI-05: Insecure Agent Memory | Data Governance: data classification, encryption |
| ASI-06: Agent-to-Agent Trust Issues | Identity: delegation chains, session verification |
| ASI-07: Insufficient Agent Logging | Behavior: comprehensive structured logging |
| ASI-08: Vulnerable Agent Supply Chain | Identity + Data Governance: provenance, validation |
| ASI-09: Agent Resource Exhaustion | Segmentation: rate limiting, blast radius containment |
| ASI-10: Unreliable Agent Operations | Incident Response: circuit breakers, graceful degradation |
OWASP provides the risk vocabulary; ATF provides the governance response. Together they give security teams both the “what can go wrong” and the “how to prevent it.”
NIST 800-207 / AI RMF
Zero Trust architecture + AI risk management
ATF operationalizes NIST Zero Trust principles for AI agents. NIST 800-207 defines the architecture; ATF applies it to the specific challenges of autonomous, non-deterministic systems.
| NIST 800-207 / AI RMF | ATF response |
|---|---|
| Never trust, always verify | All elements: continuous verification at every level |
| Least privilege access | Segmentation: strict allowlists, maturity-based boundaries |
| Assume breach | Incident Response: kill switches, circuit breakers, containment |
| GOVERN function | Operating model: roles, review cadence, promotion criteria |
| MAP function | Identity + Behavior: agent characterization, behavioral baselines |
| MEASURE function | Behavior: anomaly detection, performance metrics |
| MANAGE function | All elements: controls, incident response, continuous improvement |
NIST provides the principles; ATF provides the agent-specific implementation. Organizations already implementing Zero Trust will find ATF a natural extension of their existing architecture.
ISO/IEC 42001:2023
AI-specific management system standard
The world’s first AI management system standard: 39 controls across 10 domains. ATF operationalizes the agent-specific subset, providing the implementation specification ISO 42001 programs need for autonomous systems. Microsoft, AWS, Google Cloud, and Anthropic have all achieved certification.
| ISO/IEC 42001:2023 | ATF response |
|---|---|
| A.2 AI Policy | Operating model: governance policies, promotion criteria, review cadence |
| A.3 Internal Organization | Operating model: roles, responsibilities, reporting for agent governance |
| A.4 Resources for AI Systems | Identity: agent inventory, credential management, resource documentation |
| A.5 AI System Lifecycle | Maturity model: Intern → Principal progression, promotion gates, demotion triggers |
| A.6 Data for AI Systems | Data Governance: input validation, data provenance, PII/PHI protection, output filtering |
| A.7 System Information for Interested Parties | Behavior: transparency, decision logging, explainability, audit trails |
| A.8 Use of AI Systems | Segmentation + Behavior: action boundaries, rate limiting, behavioral monitoring |
| A.9 Third-Party and Customer Relationships | Identity + Segmentation: agent-to-agent authentication, supply chain verification, delegation chains |
| A.10 Continual Improvement | All elements: maturity progression, incident-driven demotion, continuous verification |
ISO 42001 provides the management system; ATF provides the agent-specific operating model within it. Organizations pursuing certification will find that ATF implementation generates much of the evidence the standard requires for autonomous AI systems.
ISO/IEC 27001:2022
Information security management baseline
The global standard for information security management systems. ATF extends its controls to the unique challenges of autonomous agents: non-deterministic behavior, machine-speed decisions, and dynamic authorization and delegation.
| ISO/IEC 27001:2022 | ATF response |
|---|---|
| A.5 Organizational Controls | Operating model: agent governance policies, ownership, review cadence |
| A.5.15–A.5.18 Access Control | Identity + Segmentation: agent credentials, least privilege, action boundaries |
| A.8.1–A.8.10 Technology Controls | Behavior: continuous monitoring, structured logging, anomaly detection |
| A.8.11–A.8.12 Network Security | Segmentation: network isolation, resource allowlists, blast radius containment |
| A.8.15–A.8.16 Logging and Monitoring | Behavior: real-time behavioral analysis, decision audit trails |
| A.5.24–A.5.28 Incident Management | Incident Response: circuit breakers, kill switches, containment, recovery playbooks |
| A.5.31–A.5.36 Compliance | Maturity model: governance sign-off gates, compliance evidence generation |
| A.8.25–A.8.31 Secure Development | Data Governance: input validation, output filtering, data lineage |
ISO 27001 provides the information security foundation; ATF extends it for autonomous agents. The key addition is non-deterministic agent behavior, progressive autonomy, and machine-speed incident response, none of which ISO 27001 was designed to cover.
AWS Agentic AI Security Scoping Matrix
Agent scope classification
ATF maturity levels map one-to-one onto AWS scopes. That wasn’t accidental. Both frameworks recognize that agent autonomy has to be classified and governed progressively.
| AWS Agentic AI Security Scoping Matrix | ATF response |
|---|---|
| Scope 1: No Agency | Intern: read-only, fully supervised |
| Scope 2: Prescribed Agency | Junior: recommendations, human approval required |
| Scope 3: Supervised Agency | Senior: autonomous within guardrails, post-action notification |
| Scope 4: Full Agency | Principal: self-directed within policy bounds |
AWS provides the scoping model; ATF provides the governance framework that operationalizes each scope with specific controls, promotion criteria, and demotion triggers.
OWASP AEGIS (Forrester)
Agent governance assessment
AEGIS focuses on governance assessment and organizational readiness. ATF provides the technical specification organizations implement once they understand their posture.
| OWASP AEGIS | ATF response |
|---|---|
| Governance Assessment | ATF self-assessment: element-by-element readiness evaluation |
| Organizational Readiness | Operating model: roles, cadence, documentation |
| Risk Evaluation | Maturity model: risk profiles per level |
Use AEGIS to assess organizational readiness; use ATF to define what “ready” looks like technically. The two address different layers of the same problem.
KPMG TACO
Trust in AI compliance and oversight
TACO focuses on audit and compliance governance for AI broadly. ATF focuses on the operational governance of autonomous agents. Complementary scopes, overlapping concerns.
| KPMG TACO | ATF response |
|---|---|
| Compliance Oversight | ATF compliance mapping: SOC 2, ISO 27001, EU AI Act alignment |
| AI Governance | Operating model: promotion boards, review cadence |
| Trust Measurement | Maturity model: autonomy earned through demonstrated reliability |
Organizations implementing TACO for broad AI governance can use ATF as the agent-specific implementation layer, ensuring autonomous systems carry the additional controls their autonomy demands.