Agentic Trust FrameworkThe Five Core Elements
Twenty-five core requirements across five elements, with the implementation controls that support them and the maturity level each becomes required from.
Identity
Who are you?
Establish and continuously verify the identity of AI agents, their authorization chains, and their operational context. In Zero Trust, identity is the new perimeter.
The five requirements for this element, as published in the CSA specification. An implementation MUST satisfy all five to claim conformance.
| Requirement | Description |
|---|---|
| Unique Identifier | Globally unique, immutable identifier for each agent instance |
| Credential Binding | Agent identity bound to cryptographic credentials |
| Ownership Chain | Clear documentation of ownership and operational responsibility |
| Purpose Declaration | Documented intended use and operational scope |
| Capability Manifest | Machine-readable list of claimed agent capabilities |
Detailed controls supporting the core requirements, with the maturity level each becomes required from.
Agent Registration
| Requirement | Description | Applies from |
|---|---|---|
| Unique Identifier | Globally unique, immutable identifier per agent | All |
| Credential Binding | Identity bound to cryptographic credentials | All |
| Ownership Chain | Documented owner/operator for every agent | All |
| Purpose Declaration | Documented intended use and scope | Junior+ |
| Capability Manifest | Machine-readable list of agent capabilities | Senior+ |
Authentication
| Requirement | Description | Applies from |
|---|---|---|
| Token-Based Auth | JWT or equivalent for all API calls | All |
| Short-Lived Tokens | Tokens expire within defined timeframes | All |
| Mutual TLS | Certificate-based auth for sensitive operations | Senior+ |
| Hardware-Bound Identity | TPM or HSM-backed credentials | Principal |
Authorization
| Requirement | Description | Applies from |
|---|---|---|
| Role-Based Access | Agents assigned roles with defined permissions | All |
| Attribute-Based Access | Dynamic authorization based on context | Junior+ |
| Just-In-Time Access | Elevated permissions granted temporarily | Senior+ |
| Policy-as-Code | Authorization rules in auditable, testable format | Principal |
Session Management
| Requirement | Description | Applies from |
|---|---|---|
| Session Tracking | All sessions logged with timestamps | All |
| Session Limits | Maximum concurrent sessions enforced | All |
| Session Termination | Ability to revoke sessions immediately | All |
| Session Context | Environment and purpose tracked per session | Junior+ |
Basic JWT authentication with role assignment. Focus on audit trail.
Add OAuth2/OIDC flows for human approval workflows. Session context enables approval routing.
Implement attribute-based policies. Just-in-time privilege elevation for specific actions.
Full policy-as-code with OPA. Hardware-backed identity for high-value operations.
Behavior
What are you doing?
Continuously monitor agent actions, detect anomalies, and ensure behavior aligns with declared intent. Reliability is earned through observable, explainable actions.
The five requirements for this element, as published in the CSA specification. An implementation MUST satisfy all five to claim conformance.
| Requirement | Description |
|---|---|
| Structured Logging | All agent actions logged in machine-parseable format |
| Action Attribution | Every action tied to agent identity and session context |
| Behavioral Baseline | Established patterns of normal operation for anomaly detection |
| Anomaly Detection | Identification of deviations from expected behavior |
| Explainability | Ability to retrieve rationale for agent decisions |
Detailed controls supporting the core requirements, with the maturity level each becomes required from.
Action Logging
| Requirement | Description | Applies from |
|---|---|---|
| Structured Logging | All logs in machine-parseable format | All |
| Action Attribution | Every action tied to agent identity and session | All |
| Input/Output Capture | Request and response payloads logged | All |
| Reasoning Capture | Agent's stated rationale for decisions | Junior+ |
Behavioral Baseline
| Requirement | Description | Applies from |
|---|---|---|
| Activity Profiling | Track typical action patterns and frequencies | Junior+ |
| Resource Usage Baseline | Normal CPU, memory, network, API call patterns | Junior+ |
| Temporal Patterns | Expected operating hours and activity rhythms | Senior+ |
| Interaction Patterns | Typical agent-to-agent and agent-to-system interactions | Senior+ |
Anomaly Detection
| Requirement | Description | Applies from |
|---|---|---|
| Statistical Anomaly Detection | Flag actions outside normal distributions | Junior+ |
| Sequence Anomaly Detection | Identify unusual action sequences | Senior+ |
| Intent Drift Detection | Detect changes in agent decision patterns | Senior+ |
| Real-Time Scoring | Continuous anomaly score calculation | Principal |
Explainability
| Requirement | Description | Applies from |
|---|---|---|
| Decision Logging | Record factors influencing each decision | All |
| Audit Query Support | Retrieve decision rationale on demand | Junior+ |
| Counterfactual Explanation | “Why not X?” explanations available | Senior+ |
| Real-Time Explanation | On-demand explanation during operation | Principal |
Comprehensive structured logging. Human review of all outputs.
Add behavioral baselines and anomaly flagging. Suspicious actions routed to human queue.
Real-time anomaly detection with automated alerting. Actions continue but humans notified.
Continuous behavioral scoring integrated with incident response. Automated escalation of edge cases.
Data Governance
What are you eating? What are you serving?
Validate all data entering the agent, protect sensitive information, and govern output quality and appropriateness. Garbage in, garbage out applies doubly to AI.
The five requirements for this element, as published in the CSA specification. An implementation MUST satisfy all five to claim conformance.
| Requirement | Description |
|---|---|
| Schema Validation | Inputs conform to expected structure and types |
| Injection Prevention | Detection of prompt injection and adversarial inputs |
| PII/PHI Protection | Automated detection and masking of sensitive data |
| Output Validation | Outputs conform to expected structure and content policies |
| Data Lineage | Tracking of data provenance through the agent pipeline |
Detailed controls supporting the core requirements, with the maturity level each becomes required from.
Input Validation
| Requirement | Description | Applies from |
|---|---|---|
| Schema Validation | Inputs conform to expected structure | All |
| Type Checking | Data types verified before processing | All |
| Injection Prevention | Prompt injection and adversarial input detection | Junior+ |
| Source Verification | Data provenance validated | Senior+ |
Sensitive Data Protection
| Requirement | Description | Applies from |
|---|---|---|
| PII Detection | Automated identification of personal data | All |
| Data Masking | Sensitive data redacted in logs and outputs | All |
| Encryption in Transit | TLS for all data movement | All |
| Data Classification | Automated sensitivity classification | Senior+ |
Output Governance
| Requirement | Description | Applies from |
|---|---|---|
| Output Schema Validation | Outputs conform to expected structure | All |
| Toxicity Filtering | Harmful content detection and filtering | All |
| Hallucination Detection | Factual accuracy verification where possible | Junior+ |
| Regulatory Compliance | Outputs meet industry-specific requirements | Principal |
Data Lineage
| Requirement | Description | Applies from |
|---|---|---|
| Input Source Tracking | Record where each input originated | Junior+ |
| Transformation Logging | Track how data was processed | Senior+ |
| Output Attribution | Outputs traceable to input sources | Senior+ |
| Full Lineage Graph | Complete data flow visualization | Principal |
Basic schema validation and PII detection. All outputs reviewed by humans.
Add prompt injection detection and output validation. Flagged items queued for approval.
Full data classification and lineage tracking. Automated remediation for common issues.
Custom NER models for domain-specific data. Full DLP integration. Real-time output governance.
Segmentation
Where can you go?
Enforce boundaries on agent access, limit blast radius, and ensure least-privilege operation. Agents should only access what they need, when they need it.
The five requirements for this element, as published in the CSA specification. An implementation MUST satisfy all five to claim conformance.
| Requirement | Description |
|---|---|
| Resource Allowlist | Explicit enumeration of permitted resources |
| Action Boundaries | Explicit enumeration of permitted actions |
| Rate Limiting | Maximum operations per time period |
| Transaction Limits | Maximum impact per individual action |
| Blast Radius Containment | Limits on cumulative impact and cascade effects |
Detailed controls supporting the core requirements, with the maturity level each becomes required from.
Resource Boundaries
| Requirement | Description | Applies from |
|---|---|---|
| Resource Allowlist | Explicit list of permitted resources | All |
| API Endpoint Restrictions | Limited to specific endpoints | All |
| Data Scope Limits | Access to specific data subsets only | All |
| Network Segmentation | Agents isolated at network level | Senior+ |
Action Boundaries
| Requirement | Description | Applies from |
|---|---|---|
| Action Allowlist | Explicit list of permitted actions | All |
| Read vs. Write Separation | Distinct permissions for read/write | All |
| Destructive Action Limits | Special controls for delete/modify | Junior+ |
| Rate Limiting | Maximum actions per time period | All |
Temporal Boundaries
| Requirement | Description | Applies from |
|---|---|---|
| Operating Hours | Defined windows for agent activity | Junior+ |
| Maintenance Windows | Restricted operation during sensitive periods | Senior+ |
| Time-Based Permissions | Permissions that expire or activate on schedule | Senior+ |
Blast Radius Containment
| Requirement | Description | Applies from |
|---|---|---|
| Scope Limits | Maximum scope of any single action | All |
| Transaction Limits | Maximum value/impact per transaction | Junior+ |
| Cumulative Limits | Maximum impact over time periods | Senior+ |
| Cascade Prevention | Limits on triggering other agents/systems | Principal |
Strict allowlists for resources and read-only actions. No write access.
Add action allowlists with human approval for anything outside list.
Policy-as-code enforcement. Dynamic boundaries based on context.
Full microsegmentation with real-time policy evaluation.
Incident Response
What if you go rogue?
Detect, contain, and recover from agent failures, compromises, or unexpected behavior. Assume agents will fail and plan accordingly.
The five requirements for this element, as published in the CSA specification. An implementation MUST satisfy all five to claim conformance.
| Requirement | Description |
|---|---|
| Circuit Breaker | Automatic halt on repeated failures |
| Kill Switch | Immediate manual termination capability (<1 second) |
| Session Revocation | Ability to invalidate all agent sessions |
| State Rollback | Ability to undo agent actions where possible |
| Graceful Degradation | Fallback to lower autonomy level on issues |
Detailed controls supporting the core requirements, with the maturity level each becomes required from.
Detection
| Requirement | Description | Applies from |
|---|---|---|
| Error Detection | Automatic identification of failures | All |
| Anomaly Alerts | Notifications when behavior deviates | Junior+ |
| Threshold Alerts | Notifications when limits approached | Junior+ |
| Correlation | Link related events across systems | Senior+ |
Containment
| Requirement | Description | Applies from |
|---|---|---|
| Circuit Breaker | Automatic halt on repeated failures | All |
| Kill Switch | Immediate manual termination capability | All |
| Session Revocation | Invalidate all agent sessions | All |
| Isolation | Quarantine agent from other systems | Senior+ |
Recovery
| Requirement | Description | Applies from |
|---|---|---|
| State Rollback | Ability to undo agent actions | Junior+ |
| Checkpoint/Resume | Restore from known good state | Senior+ |
| Graceful Degradation | Fallback to lower autonomy level | Senior+ |
| Automated Recovery | Self-healing within defined parameters | Principal |
Post-Incident
| Requirement | Description | Applies from |
|---|---|---|
| Incident Logging | Complete record of incident timeline | All |
| Root Cause Analysis | Systematic investigation process | Junior+ |
| Remediation Tracking | Follow-up actions documented and tracked | Senior+ |
| Lessons Learned | Updates to policies and procedures | Senior+ |
Circuit breakers and kill switches. All incidents trigger human review.
Add automated alerting and basic rollback. Incidents pause approval queue.
Full isolation and recovery capabilities. Graceful degradation to Junior level.
Automated detection, containment, and recovery within bounds. Escalation for novel incidents.
Cross-Element Integration
The five elements don't operate in isolation. Effective implementation requires deliberate integration between them.
Session identity enables behavioral attribution; role context informs anomaly detection thresholds
Anomaly scores trigger containment measures; behavioral logs feed root cause analysis
Data classification drives access boundaries; input validation prevents boundary bypass attempts
Resource access requires identity verification; boundary violations trigger re-authentication
Compliance Mapping
ATF requirements map directly to established compliance frameworks, so the work you do here counts toward audits you already face.
| ATF requirement | SOC 2 | ISO 27001 | NIST AI RMF | EU AI Act |
|---|---|---|---|---|
| Agent Registration | CC6.1 | A.9.2.1 | GOVERN 1.1 | Art. 16 |
| Authentication | CC6.1 | A.9.4.2 | MAP 1.1 | Art. 15 |
| Action Logging | CC7.2 | A.12.4.1 | MEASURE 2.1 | Art. 12 |
| Data Protection | CC6.5 | A.18.1.4 | MANAGE 2.1 | Art. 10 |
| Output Governance | CC6.5 | A.18.1.4 | MANAGE 2.2 | Art. 14 |
| Access Control | CC6.3 | A.9.1.1 | MANAGE 1.1 | Art. 9 |
| Incident Response | CC7.4 | A.16.1.4 | MANAGE 4.1 | Art. 62 |
Continue
Maturity Model
The Intern-to-Principal progression, with promotion and demotion criteria.
Read the model →Components
The recommended open-source stack, and the per-level configuration matrix.
See the stack →Self-Assessment
Evaluate your readiness across all five elements. About 15 minutes.
Take the assessment →