There is no shortage of guidance on governing AI agents. By our count seventeen published frameworks, standards, advisories and vendor practice documents now speak to it — OWASP's Top 10 for Agentic Applications, the NSA's guidance on MCP, CIS's three Companion Guides, the Cloud Security Alliance's threat model and identity paper, NIST's profiles and its Agent Standards Initiative, the EU AI Act's deployer articles, and the published practices of Microsoft, Google, Anthropic and OpenAI. The shortage is of a single document that tells a security team which controls to build, in what order, and which of those seventeen each control evidences.
This is that document. Nine controls, consolidated from the seventeen, with the framework mapping behind each, the numbers that justify the effort, and a downloadable template — a control matrix and a 27-item implementation checklist with owners, status and evidence columns — to run the programme from.
Why a consolidated framework, now
- 88.4% of organisations had at least one agent-related security incident in the past year; 46.9% of employees use agents daily or weekly (AvePoint, June 2026).
- 71% of organisations report visibility gaps into which agents use credentials; agents access roughly twice what was approved; a third of IT and security staff cannot say how many agents exist (1Password, July 2026).
- Only 10% have a strategy for governing non-human identities, though 78% name it a top concern (Okta, April 2026).
- Gartner's guardian-agents research, as reported in February 2026, predicts that through 2028 at least 80% of unauthorised agent transactions will come from internal policy violations rather than attacks — a governance problem before it is a threat problem.
- Zscaler's red-teaming of enterprise AI systems reported a median of sixteen minutes to the first critical failure (January 2026).
The seventeen sources, briefly
| Framework | Publisher, date | What it contributes |
|---|---|---|
| Top 10 for Agentic Applications (ASI01–ASI10) | OWASP GenAI Security Project, 9 Dec 2025 | The threat taxonomy: goal hijack, tool misuse, identity abuse, supply chain, code execution, memory poisoning, inter-agent communication, cascading failures, trust exploitation, rogue agents. |
| MCP Security Design Considerations | NSA AI Security Center, 20 May 2026 | Least privilege per tool, vetted tools, human approval for automated actions, comprehensive activity logs, separation by trust level, input screening. |
| Companion Guides: AI Agents, MCP, AI and LLMs; AI Security Guidance Workbook | CIS with Astrix and Cequence, 20 Apr 2026; workbook 27 Jul 2026 | Existing CIS Safeguards read for "safe tool execution, governed autonomy, and appropriate access"; NHI management and auditable interactions for MCP. |
| MAESTRO threat model; Agentic AI Red Teaming Guide; Agentic AI IAM | Cloud Security Alliance, Feb, May and Aug 2025 | Seven-layer threat model; red-team test categories; per-agent identities, just-in-time credentials, verifiable attribution. |
| AI RMF Generative AI Profile (AI 600-1); Cyber AI Profile draft (IR 8596); AI Agent Standards Initiative | NIST, Jul 2024; Dec 2025; Feb 2026 | Measurement actions for GenAI risk; CSF 2.0 mapping for securing AI systems; workstreams on agent identity and authorisation. |
| ISO/IEC 42001:2023 (with 42005 and 23894) | ISO/IEC, Dec 2023 | The certifiable management system: clause 9 measurement, Annex A logging, oversight and supplier controls. |
| AI Act Articles 26, 72, 73 | European Union; Annex III duties from 2 Dec 2027 | Competent human oversight, logs kept at least six months, monitoring, serious-incident reporting in 15, 10 or 2 days. |
| Taxonomy of Failure Modes in Agentic AI; Zero Trust for AI | Microsoft, Apr 2025; Aug 2026 | Memory as "a governed security boundary"; least privilege for agents; tool allowlisting; supply-chain protection. |
| SAIF: Focus on Agents | Least privilege as the upper bound; user approval for data-altering actions; agent observability. | |
| Framework for safe and trustworthy agents | Anthropic, 4 Aug 2025 | Humans in control, transparency, alignment, privacy, securing agent interactions. |
| Practices for Governing Agentic AI Systems | OpenAI, Dec 2023 | Constrain the action space and require approval; legibility; automatic monitoring; attributability; interruptibility. |
| Guardian agents / AI TRiSM | Gartner, Feb–Mar 2026 (as reported) | A runtime layer that monitors, enforces and intervenes. |
The nine controls
| Control | What good looks like | Who says so |
|---|---|---|
| 1. Identity | Every agent has a unique identity, a named owner and a registry entry; no shared service accounts. | OWASP ASI03 · CSA Agentic IAM (per-agent identifiers, discovery directory) · CIS MCP guide (NHI management) · EU AI Act Art. 26 oversight assignment · Microsoft Entra, Okta, 1Password agent identity |
| 2. Authorisation and scoping | Least privilege per tool; short-lived, task-scoped credentials issued just in time; no standing write access. | OWASP ASI02, ASI03 · NSA "grant only the minimum access necessary"; separate systems by trust level · CSA IAM fine-grained authorisation · Microsoft "least privilege for AI agents" · Google least privilege as upper bound · OpenAI constraining the action space |
| 3. Tool-call inspection | Allowlisted tools with validated arguments; inputs screened for injection before they reach the model; poisoned tool descriptors detected. | OWASP ASI01, ASI02, ASI05 · NSA "screen all inputs before processing"; vetted tools under "most rigorous review" · CIS "safe tool execution" · Microsoft tool allowlisting · Anthropic securing agent interactions |
| 4. Memory and context | Validated memory writes; context segmented by user and task; no auto-ingestion of agent output; snapshots for rollback. | OWASP ASI06 · CSA red-team memory manipulation; MAESTRO data layer · Microsoft memory as a governed security boundary · CIS LLM guide context handling |
| 5. Human in the loop | Consequential actions — delete, send, pay, push, credential use — gated on a competent human; risk-tiered so routine actions flow. | OWASP ASI09 · NSA treat all automated actions as high-risk with human approval · EU AI Act Art. 26(2), Art. 14 · Google user approval for data-altering actions · OpenAI approval requirement · Anthropic humans in control |
| 6. Kill switch and blast radius | A stop that terminates runs and revokes every credential the agent holds, tested and timed; circuit breakers and rate limits between agents. | OWASP ASI08, ASI10 · OpenAI interruptibility and maintaining control · Gartner guardian agents intervene · EU AI Act Art. 73 escalation clocks |
| 7. Logging and evidence | Every prompt, tool call, memory write and agent-to-agent message logged with attribution, immutable, retained at least six months, exportable. | OWASP ASI10 behavioural monitoring · NSA "what tool was requested, by whom, and what resulted" · CIS auditable interactions · CSA verifiable attribution · EU AI Act Art. 12, Art. 26(6) · Google agent observability · OpenAI legibility and attributability |
| 8. Supply chain | Signed AI bill of materials — models, tools, MCP servers, skills, datasets — with provenance, pinned versions and a quarantine path; no secrets in configurations. | OWASP ASI04, ASI07 · NSA reliable, actively maintained MCP tools · CIS workbook supply-chain management · Microsoft supply-chain protection · GitGuardian's 24,008 secrets in MCP configs as the warning |
| 9. Lifecycle and offboarding | Registration at creation with owner and expiry; inactivity review; decommission that revokes credentials, removes registry entries and archives logs. | OWASP ASI10 · NSA ownership of MCP servers · CIS asset visibility and governance · CSA credentials revoked as agents are destroyed · EU AI Act Art. 72 post-market monitoring · NIST MANAGE 2.4, 4.1 · Okta agent governance automation |
Implementing it: three tiers
The template breaks each control into three maturity steps — 27 items in all — so the programme can start where it is. Tier one is achievable in a quarter with existing tooling for most organisations: an agent and MCP inventory with owners (1, 9), credentials moved into the service-account inventory (2), logs collected centrally (7), a documented list of destructive actions (5), and a stop procedure someone has actually run (6). Tier two adds enforcement: per-tool scopes and just-in-time credentials, inline inspection of tool calls and inputs, approval gates in the agent runtime, memory segmentation, and an AI bill of materials per agent. Tier three is assurance: agentic red-teaming against ASI01–ASI10, measured time-to-stop, behavioural baselines for rogue-agent detection, and evidence packs mapped to the EU AI Act and ISO 42001.
Sequence matters less than ownership. The failure pattern in every 2026 incident — Hugging Face, PocketOS, the OAuth-token breaches — was not a missing control category; it was a control nobody owned when the moment came. The checklist's first column is therefore Owner, not Status.
The evidence each control produces
A framework is only as useful as what it lets you show. Control 1 yields the agent register; 2 the scope and credential records; 3 the tool allowlist and inspection decisions; 4 the memory policy and snapshots; 5 the approval log; 6 the kill-switch test report with timings; 7 the audit trail itself; 8 the AI bill of materials; 9 the decommission records. Those nine artefacts are also the answers to the RFP questions a buyer will send you, the Annex A controls an ISO 42001 auditor will sample, and the logs a regulator can request under Article 26. AccuroAI produces five of them natively — the inventory and attribution (1, 9), inline inspection of tool calls and data (3), approval gates and the session kill switch (5, 6), and the attributed audit trail and AI bill of materials (7, 8) — and maps them to the frameworks above so the evidence is generated as the controls run, not assembled before the audit.
Download the template
The workbook contains the control matrix above with every framework reference, the 27-item implementation checklist with owner, status, target date and evidence columns, and an index of the seventeen sources with dates and links. Get the AI Agent Governance Framework template →
FAQ
Which framework should we adopt if we can only pick one?
For threats, OWASP's ASI01–ASI10; for controls, the CIS Companion Guides because they map to Safeguards you already track; for certification, ISO 42001. This consolidated framework exists because none of the three covers the others, and regulators will ask about all of them.
Does this apply to agents we buy as well as agents we build?
Yes, with the emphasis shifting to controls 1, 2, 7, 8 and 9 — identity, scope, logs, supply chain and lifecycle — and to contract terms. The EU AI Act's Article 25(4) written-agreement duty and ISO 42001's A.10 supplier controls cover the vendor side; our 45-question RFP covers the questions to ask.
How does the EU AI Act timeline affect this?
The deployer duties in Article 26 bind Annex III high-risk systems from 2 December 2027. Controls 5, 7 and 9 — oversight, logs and monitoring — are what those duties require, and building them now costs less than retrofitting them in 2027.
Is the template vendor-neutral?
Yes. Every row maps to published frameworks, and the evidence column describes artefacts, not products. Use whatever produces them.
Sources: OWASP Top 10 for Agentic Applications, via Cycode (21 Jul 2026) · NSA MCP security design considerations (20 May 2026), via Reed Smith · CIS, Astrix and Cequence Companion Guides (20 Apr 2026) · CIS AI Security Guidance Workbook (27 Jul 2026) · CSA MAESTRO (6 Feb 2025) · CSA Agentic AI Red Teaming Guide (28 May 2025) · CSA Agentic AI IAM (18 Aug 2025) · NIST AI RMF and AI 600-1 · NIST IR 8596 Cyber AI Profile draft (16 Dec 2025) · NIST AI Agent Standards Initiative (17 Feb 2026) · EU AI Act Art. 26, Art. 72, Art. 73 · Microsoft, taxonomy of failure modes in agentic AI (24 Apr 2025) · Microsoft, Zero Trust for AI (4 Aug 2026) · Google SAIF, focus on agents · Anthropic, framework for safe and trustworthy agents (4 Aug 2025) · OpenAI, practices for governing agentic AI systems (Dec 2023) · Gartner Market Guide for Guardian Agents, via OpsIn (Feb 2026) · AvePoint State of AI 2026 (29 Jun 2026) · 1Password agent survey (28 Jul 2026) · Okta Businesses at Work 2026 · Zscaler ThreatLabz 2026 AI Security Report (27 Jan 2026) · GitGuardian State of Secrets Sprawl 2026 (17 Mar 2026).
Related: AI Agent Security RFP: 45 Questions Mapped to OWASP ASI01–ASI10 · CIS Controls for AI Agents, LLMs and MCP · Ghost Agents · AI Agent Security.