AID-M-009: Agent Autonomy & Authority Governance
Define and version the control-plane facts that determine an agent's approved mission, functional autonomy, authority envelope, accountable runtime identity and delegation lineage, live trust state, and required control profile. The child controls partition those dimensions into separate control objectives, while preserving one chain from approved purpose to constrained runtime authority and recoverable change history.
Example: a support agent may read a knowledge base and draft replies autonomously, require approval before sending email, and be forbidden from issuing refunds or changing credentials. Its exact workload identity, delegated scope, goal-manifest digest, authority-envelope version, and current trust state must remain bound to that decision.
Example: a support agent may read a knowledge base and draft replies autonomously, require approval before sending email, and be forbidden from issuing refunds or changing credentials. Its exact workload identity, delegated scope, goal-manifest digest, authority-envelope version, and current trust state must remain bound to that decision.
Scope boundary
Owns signed governance facts for an agent's functional autonomy, authority envelope, runtime identity and delegation lineage, goal changes, trust state, and required capability-tier control profile. It publishes facts for enforcement but never grants an action solely from a governance artifact.
AID-H-018: AID-M-009 defines and publishes the approved autonomy, authority, identity, delegation, trust-state, and control-profile facts; AID-H-018 verifies those facts at the runtime action boundary and returns the authorization outcome. Governance states what authority should exist, while runtime enforcement decides whether the exact current action may proceed.
Sub-techniques
- AID-M-009.001: Operating Scope & Functional Autonomy Profiles
- AID-M-009.002: Authority Envelope & Action Risk Classification
- AID-M-009.003: Agent Identity, Delegation Lineage & Authorization Context
- AID-M-009.004: Runtime Trust-State Demotion & Autonomy Narrowing
- AID-M-009.005: Goal Manifest Change Governance, Provenance & Rollback
- AID-M-009.006: Capability-Tier Control-Profile Binding & Assurance Gate
Threat mappings
MITRE ATLAS
- AML.T0048 External Harms
- AML.T0053 AI Agent Tool Invocation
- AML.T0073 Impersonation
- AML.T0081 Modify AI Agent Configuration
- AML.T0101 Data Destruction via AI Agent Tool Invocation
- AML.T0103 Deploy AI Agent
- AML.T0108 AI Agent
- AML.T0125 Create Account
MAESTRO
- Compromised Agents (L7)
- Agent Impersonation (L7)
- Agent Identity Attack (L7)
- Agent Tool Misuse (L7)
- Agent Goal Manipulation (L7)
- Integration Risks (L7)
- Inaccurate Agent Capability Description (L7)
OWASP LLM Top 10 2026
- LLM03:2026 Excessive Agency
OWASP ML Top 10 2023
- N/A
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI02:2026 Tool Misuse and Exploitation
- ASI03:2026 Identity and Privilege Abuse
- ASI08:2026 Cascading Failures
- ASI10:2026 Rogue Agents
NIST Adversarial Machine Learning 2025
- NISTAML.027 Misaligned Outputs
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-2.1 Excessive Agency
- AITech-3.1 Masquerading / Obfuscation / Impersonation
- AITech-5.2 Configuration Persistence
- AITech-14.2 Abuse of Delegated Authority
- AISubtech-2.1.2 Capability and Permission Overreach
- AISubtech-3.1.1 Identity Obfuscation
- AISubtech-3.1.2 Trusted Agent Spoofing
- AISubtech-4.3.4 Replay Exploitation
- AISubtech-5.2.1 Agent Profile Tampering
- AISubtech-14.1.2 Insufficient Access Controls
- AISubtech-14.2.1 Permission Escalation via Delegation
Google Secure AI Framework 2.0 - Risks
- IIC: Insecure Integrated Component
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Agents - Core 13.2: Tool Misuse
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.4: Resource Overload
- Agents - Core 13.6: Intent Breaking & Goal Manipulation
- Agents - Core 13.8: Repudiation & Untraceability
- Agents - Core 13.9: Identity Spoofing & Impersonation
- Agents - Core 13.13: Rogue Agents in Multi-Agent Systems
- Agents - Tools MCP Server 13.22: Excessive Permissions and Scope Creep
- Agents - Tools MCP Client 13.31: Excessive Permission Granting