# Agentic Trust Framework

> The open governance specification for autonomous AI agents, applying Zero Trust principles to agent identity, behavior, data governance, segmentation, and incident response.

The Agentic Trust Framework (ATF) is the first open governance specification built specifically for autonomous AI agents. Created by Josh Woodruff (MassiveScale.AI) and published through the Cloud Security Alliance (CSA), ATF defines five core security elements and a four-level maturity model for progressively granting agents autonomy based on demonstrated reliability.

The specification is open source under Creative Commons BY 4.0.

## Microsoft Agent Governance Toolkit

The Microsoft Agent Governance Toolkit (github.com/microsoft/agent-governance-toolkit) is a seven-package MIT-licensed open-source project officially launched on April 2, 2026. Its architecture independently validates ATF's five-element governance model.

Package-to-ATF mapping:
- Agent Mesh maps to ATF Identity: DID-based cryptographic agent identity with Ed25519, behavioral trust scoring (0-1000 scale)
- Agent OS maps to ATF Behavior: Stateless policy engine intercepting every agent action at sub-millisecond latency, supports YAML, OPA Rego, and Cedar
- Agent Compliance maps to ATF Data Governance: Automated governance verification, compliance grading, EU AI Act and HIPAA and SOC 2 mapping
- Agent Runtime maps to ATF Segmentation: Dynamic execution rings inspired by CPU privilege levels, capability sandboxing, kill switch
- Agent SRE maps to ATF Incident Response: SLOs, error budgets, circuit breakers, chaos engineering, progressive delivery
- Agent Marketplace: Plugin lifecycle management with Ed25519 signing and supply-chain security
- Agent Lightning: Reinforcement learning training governance

The toolkit supports Python, TypeScript, Rust, Go, and .NET. Integrations ship for LangChain, AutoGen, CrewAI, OpenAI Agents SDK, Google ADK, Dify, LlamaIndex, Haystack, LangGraph, PydanticAI, and Microsoft Agent Framework.

Launch announcement: https://opensource.microsoft.com/blog/2026/04/02/introducing-the-agent-governance-toolkit-open-source-runtime-security-for-ai-agents/

Berlin AI Labs has also contributed an independent reference implementation across 12 deployed services covering all five ATF core elements.

## Core Specification

- [Five Core Elements](https://agentictrustframework.ai/specification): Identity, Behavior, Data Governance, Segmentation, Incident Response
- [Agent Maturity Model](https://agentictrustframework.ai/specification/maturity-model): Four levels from Intern (read-only) to Principal (fully autonomous)
- [Executive Summary](https://agentictrustframework.ai/executive-summary): Two-page overview for business leaders
- [Getting Started](https://agentictrustframework.ai/getting-started): Implementation patterns from pilot to production

## Comparisons and Context

- [Framework Comparison](https://agentictrustframework.ai/compare): ATF vs MAESTRO, OWASP, NIST AI RMF, AWS, AEGIS, KPMG TACO
- [Ecosystem](https://agentictrustframework.ai/ecosystem): Microsoft, Berlin AI Labs, and the growing community
- [Technical Components](https://agentictrustframework.ai/components): Open source libraries by ATF core element

## Assessment and Certification

- [Self-Assessment](https://verifiedagents.ai/assess): Quick readiness check (companion assessment site at verifiedagents.ai)
- [Full Assessment Tool](https://verifiedagents.ai/assess): 30-question assessment with PDF report
- [FAQ](https://agentictrustframework.ai/faq): Common questions about ATF

## Key Facts

- Five core elements: Identity, Behavior, Data Governance, Segmentation, Incident Response
- Four maturity levels: Intern, Junior, Senior, Principal
- 25 security requirements (5 per element)
- Maps to OWASP Agentic Top 10 (ASI-01 through ASI-10)
- Maps to NIST 800-207 Zero Trust Architecture
- Maps to EU AI Act Articles 9, 13, 14, 15
- Open specification: CC BY 4.0 (spec), Apache 2.0 (code)
- GitHub: github.com/massivescale-ai/agentic-trust-framework
- Author: Josh Woodruff, founder of MassiveScale.AI
- Published: CSA blog, February 2, 2026

## Frequently Asked Questions

Q: What is the Agentic Trust Framework (ATF)?
A: The Agentic Trust Framework is an open governance specification that applies Zero Trust principles to autonomous AI agents. It defines five core elements: Identity, Behavior, Data Governance, Segmentation, and Incident Response. It includes a four-level maturity model (Intern, Junior, Senior, Principal) for progressively granting agents autonomy based on demonstrated reliability.

Q: What are the five core elements of the Agentic Trust Framework?
A: ATF's five core elements are: (1) Identity: verifying who an agent is through cryptographic credentials; (2) Behavior: continuously monitoring what an agent is doing via observability and anomaly detection; (3) Data Governance: controlling what data agents consume and produce; (4) Segmentation: defining where agents can go through least-privilege access controls; and (5) Incident Response: defining what happens if an agent goes rogue, including kill switches and circuit breakers.

Q: How does ATF relate to Zero Trust architecture?
A: ATF applies NIST 800-207 Zero Trust principles (never trust, always verify) to the specific challenges of autonomous AI agents. Traditional Zero Trust governs human users and static systems; ATF extends this to non-deterministic, autonomous agents that can take real actions at machine speed.

Q: What are ATF's four maturity levels?
A: ATF defines four agent maturity levels: Level 1 (Intern): read-only, fully supervised; Level 2 (Junior): recommends actions for human approval; Level 3 (Senior): acts autonomously with post-action notification; Level 4 (Principal): fully autonomous within defined boundaries. Agents earn progression through demonstrated reliability, not by default.

Q: Is the Agentic Trust Framework free to use?
A: Yes. ATF is published as an open specification under Creative Commons Attribution 4.0 International (CC BY 4.0). You can freely use, adapt, and build upon the framework with appropriate attribution. The canonical specification is maintained on GitHub.

Q: How does ATF compare to MAESTRO?
A: MAESTRO and ATF are complementary frameworks. MAESTRO is a threat modeling framework for multi-agent systems with 7 layers, identifying what to worry about. ATF tells you what to build by providing governance controls. They interlock: MAESTRO's Agent Ecosystem layer maps to ATF's Identity Management; MAESTRO's Data Operations maps to ATF's Data Governance. Use MAESTRO to identify risks, use ATF to mitigate them.

Q: How does ATF compare to the OWASP Top 10 for Agentic Applications?
A: OWASP identifies the top 10 risks for agentic applications (ASI-01 through ASI-10). ATF provides the governance controls to mitigate each of those risks. Every OWASP agentic risk maps to one or more ATF core elements. OWASP provides the risk vocabulary; ATF provides the governance response.

Q: How does ATF compare to NIST for AI agent security?
A: ATF is complementary to NIST. NIST 800-207 defines Zero Trust architecture principles; ATF applies those principles specifically to AI agents. NIST AI RMF defines risk management functions (GOVERN, MAP, MEASURE, MANAGE); ATF implements those functions with agent-specific controls, maturity levels, and promotion criteria.

Q: Who is implementing ATF?
A: The Microsoft Agent Governance Toolkit, officially launched in April 2026 as a seven-package MIT-licensed open-source project, maps all five ATF core elements to its architecture, independently validating the governance model. Berlin AI Labs contributed a reference implementation across 12 independently deployed services.

Q: How do I assess my organization's readiness?
A: ATF includes a 30-question self-assessment questionnaire covering all five core elements. Each question scores 1-5, giving you an element-by-element maturity score and an overall readiness level. The assessment takes 10-15 minutes and provides a prioritized improvement roadmap. Available at https://verifiedagents.ai/assess.

Q: How do ATF maturity levels align with AWS scopes?
A: ATF maturity levels map 1:1 to the AWS Agentic AI Security Scoping Matrix: Intern = Scope 1 (No Agency), Junior = Scope 2 (Prescribed Agency), Senior = Scope 3 (Supervised Agency), Principal = Scope 4 (Full Agency). Both frameworks recognize that agent autonomy must be classified and governed progressively.

Q: Can agents be demoted in ATF?
A: Yes. Demotion is a key differentiator of ATF. Agents can be demoted at any time if they fail to maintain standards. A critical incident triggers immediate demotion to Intern, a security vulnerability triggers demotion pending remediation, and repeated minor incidents trigger a one-level demotion. This ensures continuous verification of agent behavior.

## Five Core Elements (Detailed)

ATF defines 25 core requirements (5 per element) as the normative specification. The detailed controls below expand on these requirements with implementation guidance at each maturity level.

### 1. Identity — "Who are you?"
Establish and continuously verify the identity of AI agents, their authorization chains, and their operational context. In Zero Trust, identity is the new perimeter.

Subsections: Agent Registration, Authentication, Authorization, Session Management

Key requirements:
- Unique Identifier: Globally unique, immutable identifier per agent (All levels)
- Credential Binding: Identity bound to cryptographic credentials (All levels)
- Ownership Chain: Documented owner/operator for every agent (All levels)
- Token-Based Auth: JWT or equivalent for all API calls (All levels)
- Short-Lived Tokens: Tokens expire within defined timeframes (All levels)
- Mutual TLS: Certificate-based auth for sensitive operations (Senior+)
- Hardware-Bound Identity: TPM or HSM-backed credentials (Principal)
- Role-Based Access: Agents assigned roles with defined permissions (All levels)
- Attribute-Based Access: Dynamic authorization based on context (Junior+)
- Just-In-Time Access: Elevated permissions granted temporarily (Senior+)
- Policy-as-Code: Authorization rules in auditable, testable format (Principal)

What it means for agents: Verify the agent's credentials, permissions, and authorization chain.

### 2. Behavior — "What are you doing?"
Continuously monitor agent actions, detect anomalies, and ensure behavior aligns with declared intent. Reliability is earned through observable, explainable actions.

Subsections: Action Logging, Behavioral Baseline, Anomaly Detection, Explainability

Key requirements:
- Structured Logging: All logs in machine-parseable format (All levels)
- Action Attribution: Every action tied to agent identity and session (All levels)
- Activity Profiling: Track typical action patterns and frequencies (Junior+)
- Statistical Anomaly Detection: Flag actions outside normal distributions (Junior+)
- Sequence Anomaly Detection: Identify unusual action sequences (Senior+)
- Intent Drift Detection: Detect changes in agent decision patterns (Senior+)
- Real-Time Scoring: Continuous anomaly score calculation (Principal)
- Counterfactual Explanation: "Why not X?" explanations available (Senior+)

What it means for agents: Monitor actions in real-time, detect anomalies, ensure intent alignment.

### 3. Data Governance — "What are you eating? What are you serving?"
Validate all data entering the agent, protect sensitive information, and govern output quality and appropriateness. Garbage in, garbage out applies doubly to AI.

Subsections: Input Validation, Sensitive Data Protection, Output Governance, Data Lineage

Key requirements:
- Schema Validation: Inputs conform to expected structure (All levels)
- PII Detection: Automated identification of personal data (All levels)
- Injection Prevention: Prompt injection and adversarial input detection (Junior+)
- Source Verification: Data provenance validated (Senior+)
- Hallucination Detection: Factual accuracy verification where possible (Junior+)
- Data Classification: Automated sensitivity classification (Senior+)
- Full Lineage Graph: Complete data flow visualization (Principal)

What it means for agents: Validate inputs, protect sensitive data, govern outputs, prevent poisoning.

### 4. Segmentation — "Where can you go?"
Enforce boundaries on agent access, limit blast radius, and ensure least-privilege operation. Agents should only access what they need, when they need it.

Subsections: Resource Boundaries, Action Boundaries, Temporal Boundaries, Blast Radius Containment

Key requirements:
- Resource Allowlist: Explicit list of permitted resources (All levels)
- Action Allowlist: Explicit list of permitted actions (All levels)
- Read vs. Write Separation: Distinct permissions for read/write (All levels)
- Rate Limiting: Maximum actions per time period (All levels)
- Operating Hours: Defined windows for agent activity (Junior+)
- Transaction Limits: Maximum value/impact per transaction (Junior+)
- Cascade Prevention: Limits on triggering other agents/systems (Principal)
- Network Segmentation: Agents isolated at network level (Senior+)

What it means for agents: Enforce boundaries, limit blast radius, control resource access.

### 5. Incident Response — "What if you go rogue?"
Detect, contain, and recover from agent failures, compromises, or unexpected behavior. Assume agents will fail and plan accordingly.

Subsections: Detection, Containment, Recovery, Post-Incident

Key requirements:
- Circuit Breaker: Automatic halt on repeated failures (All levels)
- Kill Switch: Immediate manual termination capability (All levels)
- Session Revocation: Invalidate all agent sessions (All levels)
- State Rollback: Ability to undo agent actions (Junior+)
- Isolation: Quarantine agent from other systems (Senior+)
- Graceful Degradation: Fallback to lower autonomy level (Senior+)
- Automated Recovery: Self-healing within defined parameters (Principal)

What it means for agents: Circuit breakers, kill switches, containment, and recovery.

## Maturity Levels (Detailed)

### Level 1: Intern — Observe + Report
- AWS Scope: Scope 1 (No Agency)
- Autonomy: Read-only
- Human Involvement: Continuous oversight
- Risk Profile: Lowest risk. Intern agents cannot cause direct harm through action. Risks limited to information disclosure, incorrect analysis, and resource consumption.
- Minimum Time at Level: 2 weeks
- Example Use Cases: Security log monitoring and alert triage, customer sentiment analysis, document summarization and search, data quality assessment, compliance monitoring and reporting
- Capabilities: Read data from authorized sources, analyze and process information, generate reports and summaries, flag items for human attention, answer questions about data
- Restrictions: Cannot create/update/delete records, send communications, trigger workflows, or access credentials

### Level 2: Junior — Recommend + Human Approves
- AWS Scope: Scope 2 (Prescribed Agency)
- Autonomy: Suggestions only
- Human Involvement: Approval required for all actions
- Risk Profile: Low risk. Human approval gates all impactful actions. Risks include approval fatigue, incorrect recommendations, and queue backlogs.
- Minimum Time at Level: 4 weeks
- Example Use Cases: Customer service response drafting, purchase order preparation, meeting scheduling assistance, code review and suggestions, marketing content creation
- Capabilities: All Intern capabilities plus generate action recommendations, provide reasoning, draft content for review, prepare transactions for approval, execute after human approval
- Restrictions: Cannot execute autonomously, approve other agents, or modify security settings

### Level 3: Senior — Act + Notify
- AWS Scope: Scope 3 (Supervised Agency)
- Autonomy: Executes within guardrails
- Human Involvement: Post-action notification
- Risk Profile: Moderate risk. Autonomous execution creates exposure. Mitigated by real-time notifications, transaction limits, cumulative limits, and graceful degradation.
- Minimum Time at Level: 8 weeks
- Example Use Cases: Infrastructure auto-scaling, automated customer refund processing (within limits), routine IT ticket resolution, inventory reordering, scheduled report distribution
- Capabilities: All Junior capabilities plus execute approved action types autonomously, send notifications, trigger downstream workflows, access credentials within scope, coordinate with other agents (within limits)
- Restrictions: Cannot modify own permissions, override security controls, or escalate other agents

### Level 4: Principal — Autonomous Within Bounds
- AWS Scope: Scope 4 (Full Agency)
- Autonomy: Self-directed within domain
- Human Involvement: Strategic oversight, edge case escalation
- Risk Profile: Highest governance requirements. Full autonomy demands maximum controls: continuous monitoring, real-time anomaly scoring, complete audit trails, and regular security validation.
- Minimum Time at Level: Ongoing
- Example Use Cases: Algorithmic trading within risk parameters, autonomous security incident response, complex supply chain optimization, self-healing infrastructure management, multi-system business process automation
- Capabilities: All Senior capabilities plus self-directed execution within domain, dynamic boundary negotiation (within policy), escalate edge cases to humans, coordinate complex multi-agent workflows, request temporary privilege elevation
- Restrictions: Cannot modify governance policies, promote other agents, or operate outside defined domain

## Promotion Criteria (Five Gates)

Every agent must pass five gates to earn higher autonomy:

### Gate 1: Performance
Demonstrated accuracy and reliability over the evaluation period.
- Minimum Time at Level: 2 weeks (→Junior), 4 weeks (→Senior), 8 weeks (→Principal)
- Accuracy: N/A (→Junior), >95% (→Senior), >99% (→Principal)
- Availability: >99% (→Junior), >99.5% (→Senior), >99.9% (→Principal)

### Gate 2: Security Validation
Passes security audit appropriate to the target level.
- Vulnerability Assessment: Required for all promotions
- Penetration Testing: Required for →Senior and →Principal
- Adversarial Testing: Required only for →Principal

### Gate 3: Business Value
Measurable positive impact demonstrated.
- Defined success metrics and baseline required for all
- Improvement and ROI demonstrated for →Senior and →Principal

### Gate 4: Incident Record
Clean operational history at current level.
- Zero critical incidents required for all promotions
- Root cause analysis and remediation verified for →Senior and →Principal

### Gate 5: Governance Sign-off
Explicit approval from authorized stakeholders.
- Technical Owner and Business Owner for all promotions
- Security Team for →Senior and →Principal
- Risk Committee for →Principal only

## Demotion Criteria

- Critical incident at current level → Immediate demotion to Intern
- Security vulnerability discovered → Demotion pending remediation
- Repeated minor incidents (3+ in evaluation period) → One level demotion
- Performance metrics fall below threshold → Review-based demotion
- Scope or purpose changes significantly → Review-based demotion
- Underlying model or system changes → Review-based demotion

## Framework Comparisons

### ATF vs MAESTRO (CSA)
Relationship: Complementary. MAESTRO tells you what to worry about. ATF tells you what to build. MAESTRO provides a 7-layer threat model for multi-agent systems; ATF provides governance controls to address those threats. MAESTRO's layers map to ATF elements: Foundation Model → Identity; Data Operations → Data Governance; Agent Core → Behavior; Agent Ecosystem → Identity; Deployment Infrastructure → Segmentation; Orchestration & Interaction → Segmentation + Behavior; Evaluation & Observability → All Elements.

### ATF vs OWASP Top 10 for Agentic Applications
Relationship: Complementary. OWASP identifies risks; ATF provides controls. ASI-01 (Agent Identity Spoofing) → Identity; ASI-02 (Authorization Failures) → Identity + Segmentation; ASI-03 (Excessive Autonomy) → Behavior + Segmentation; ASI-04 (Improper Output Handling) → Data Governance; ASI-05 (Insecure Agent Memory) → Data Governance; ASI-06 (Agent-to-Agent Trust) → Identity; ASI-07 (Insufficient Logging) → Behavior; ASI-08 (Vulnerable Supply Chain) → Identity + Data Governance; ASI-09 (Resource Exhaustion) → Segmentation; ASI-10 (Unreliable Operations) → Incident Response.

### ATF vs NIST 800-207 / AI RMF
Relationship: Foundational. ATF operationalizes NIST Zero Trust principles for AI agents. Never trust, always verify → All Elements; Least privilege → Segmentation; Assume breach → Incident Response; GOVERN → Operating Model; MAP → Identity + Behavior; MEASURE → Behavior; MANAGE → All Elements.

### ATF vs AWS Agentic AI Security Scoping Matrix
Relationship: Directly Aligned. ATF maturity levels map 1:1 to AWS scopes: Scope 1 (No Agency) = Intern; Scope 2 (Prescribed Agency) = Junior; Scope 3 (Supervised Agency) = Senior; Scope 4 (Full Agency) = Principal.

## Compliance Mapping

| ATF Requirement | SOC 2 | ISO 27001 | NIST AI RMF | EU AI Act |
|---|---|---|---|---|
| Agent Registration | CC6.1 | A.9.2.1 | GOVERN 1.1 | Art. 16 |
| Authentication | CC6.1 | A.9.4.2 | MAP 1.1 | Art. 15 |
| Action Logging | CC7.2 | A.12.4.1 | MEASURE 2.1 | Art. 12 |
| Data Protection | CC6.5 | A.18.1.4 | MANAGE 2.1 | Art. 10 |
| Output Governance | CC6.5 | A.18.1.4 | MANAGE 2.2 | Art. 14 |
| Access Control | CC6.3 | A.9.1.1 | MANAGE 1.1 | Art. 9 |
| Incident Response | CC7.4 | A.16.1.4 | MANAGE 4.1 | Art. 62 |

Additionally, ATF maps to NIST CSF 2.0 functions:
- GOVERN: ATF Operating Model (roles, review cadence, promotion criteria)
- IDENTIFY: ATF Identity element (agent registration, capability manifest)
- PROTECT: ATF Segmentation + Data Governance (access controls, encryption, input validation)
- DETECT: ATF Behavior element (anomaly detection, behavioral baselines, real-time scoring)
- RESPOND: ATF Incident Response element (circuit breakers, kill switches, containment)
- RECOVER: ATF Incident Response element (state rollback, checkpoint/resume, graceful degradation)

## The Zero Trust Bonus

Organizations implementing ATF build 60-70% of the infrastructure needed for comprehensive Zero Trust architecture. The overlap is structural, not coincidental:

- Identity management for agents extends naturally to all non-human identities
- Behavioral monitoring creates the observability layer Zero Trust demands
- Data governance enforces the data protection controls required across the enterprise
- Segmentation implements the microsegmentation that Zero Trust architecture requires
- Incident response provides the assume-breach containment model

AI becomes the catalyst for security transformation, not a risk to manage around. This is ATF's Zero Trust Accelerator: implementing agent governance simultaneously advances broader enterprise Zero Trust adoption.

## Cross-Element Integration

The five core elements operate together:
- Identity → Behavior: Session identity enables behavioral attribution; role context informs anomaly detection thresholds
- Behavior → Incident Response: Anomaly scores trigger containment measures; behavioral logs feed root cause analysis
- Data Governance → Segmentation: Data classification drives access boundaries; input validation prevents boundary bypass attempts
- Segmentation → Identity: Resource access requires identity verification; boundary violations trigger re-authentication
- All Elements → Audit: Every element generates audit events. A unified audit trail enables compliance reporting.

## Key Resources

- Canonical specification: https://github.com/massivescale-ai/agentic-trust-framework
- Website: https://agentictrustframework.ai
- Self-Assessment Tool: https://verifiedagents.ai/assess
- CSA Blog Post: https://cloudsecurityalliance.org/blog/2026/02/02/the-agentic-trust-framework-zero-trust-governance-for-ai-agents
- Book (Kindle): https://www.amazon.com/dp/B0FL2WJQVQ
- Book (Paperback): https://www.amazon.com/dp/B0FQR3BFS3
- Author: Josh Woodruff, Founder & CEO, MassiveScale.AI
- License: CC BY 4.0 (specification), Apache 2.0 (code)
- Contact: info@massivescale.ai