The twelve controls, in full
Every control referenced by the assessment and the risk profiler, expanded: what it's for, why it matters, how to implement it, and what evidence an auditor would expect to see. See the methodology page for how these get selected per risk tier.
Every AI agent that exists is recorded in one authoritative list — not scattered across team spreadsheets, or existing only in someone's memory.
You cannot govern, secure, or account for an agent you don't know exists. This is the control everything else depends on.
Register each agent at the point of deployment, not during a periodic audit. Capture name, purpose, environment, owner and technology at minimum.
A register export showing every entry with a named owner and a last-reviewed date.
Agents deployed without security review are discoverable — not just the agents someone remembered to register.
A register only covers what people choose to add. Detection catches what they didn't.
Network or SaaS discovery tooling, API gateway logging, or a lightweight scan for common agent frameworks and API key patterns.
A record of at least one detection sweep and its findings, with follow-up actions logged.
No agent shares credentials or an account with another agent, service, or person.
Shared identity is the fastest way to lose the ability to attribute an action to a specific agent — and the fastest way for one compromise to become hundreds. See the Salesloft-Drift breach below.
Provision each agent its own service identity at creation. Reject requests to reuse an existing credential for a new agent.
An identity provider export showing a one-to-one mapping between agents and credentials.
Every agent has a specific, named human accountable for its purpose and continued need to exist — not a team, not a role. A person.
This is the invariant the product is built around. A distribution list is not accountable; a named person is — and it's enforced at the database layer, not just asked for on a form.
Capture the principal at registration. Require it before approval. Re-confirm it at every recertification.
The Agent Passport's own principal field, plus the approval record showing it was checked before sign-off.
An agent holds only the permissions its stated task requires — not the broadest role available.
The agent's blast radius is its entitlement set. Overprovisioning turns a routine prompt injection into a serious compromise.
Scope entitlements at deployment. Compare granted access to actual usage on a defined cycle, and revoke what's unused.
An access review showing granted-versus-used permissions per agent, with remediation tracked for gaps.
Before an agent goes live, its tool bindings and data classifications are documented and its blast radius is rated.
This is the assessment that catches an entitlement problem before deployment, rather than discovering it after.
A short, standard checklist completed at registration: which tools, which systems, which data classes, reversibility of actions.
The completed assessment attached to the Agent Passport.
No agent's credential lives in a config file, environment variable, or as a long-lived static token.
This is the exact failure mode behind the Salesloft-Drift breach — stolen OAuth tokens with no rotation reached over 700 downstream organisations. See below.
Issue credentials from a vault, per-task where feasible, with automatic rotation.
A vault audit log showing credential issuance and rotation events for the agent.
A single agent's access can be revoked without disrupting any other agent or system.
If revoking one agent means an outage decision, revocation becomes something people avoid rather than something people do.
Never share a credential across agents. Test revocation as part of onboarding, not only during an incident.
A logged test revocation with confirmation that only the target agent lost access.
What an agent actually did — not just what it was asked — is recorded somewhere it cannot quietly edit.
Prompts and outputs describe intent. Actions are what create liability. Log the actions.
Log tool calls, writes and escalations to a store the agent itself has no write or delete access to. Review on a scheduled cycle, not only reactively.
A sample of the action log for one agent, plus a record of the most recent scheduled review.
A misbehaving agent can be stopped mid-task — and someone has actually tried it.
An untested stop control is a belief, not a control. The Replit incident happened despite an explicit freeze instruction — the instruction lived in a prompt, not in an enforced control. See below.
Define ownership and a target response time. Run the test at least annually, or after any material change to the agent.
A dated test record: who ran it, how long it took, what happened.
Every agent's entitlements and continued need are reconfirmed on a defined cycle — not left as a one-time decision.
Access granted once and never reviewed becomes standing privilege — the same problem user access reviews exist to catch, applied to non-human identities.
A recertification campaign with owner attestation, on a cycle set by risk tier (more frequent for higher tiers).
A completed attestation record with the owner's confirmation and date.
An agent is retired when its owner leaves or its purpose ends — both triggers, not just one.
Orphaned agents with standing entitlements are the non-human equivalent of a dormant admin account nobody remembered to disable.
Tie decommissioning to HR offboarding events and to a defined purpose-review cycle, with verification that access was actually removed.
A decommissioning record showing the trigger, the action taken, and confirmation of removal.
Risk model version 2026.1. Last reviewed July 2026. Framework mappings are indicative — confirm current text for your jurisdiction and sector.
© 2026 Aseem Mohan · Assessment · Methodology · Five Rules for Agent Identity · Privacy notice