Cross-Industry
Autonomous Procurement / Ops Agent
Minimal RiskUnverifiedDiscuss / dispute
Agent that negotiates, orders, pays or reconfigures systems autonomously across ERP and supplier APIs.
Classification rationale: Minimal risk under the AI Act if isolated from safety-critical physical processes — but the lethal-trifecta profile (external supplier input + privileged ERP/payment APIs + irreversible transactions) makes spend-approval thresholds, deterministic financial guardrails and the full agentic RDA stack mandatory, plus an Art. 25 role-flip check.
Indicative decision support, not legal advice. Risk classification depends on your concrete deployment context and can change with scope drift — validate the result with qualified counsel.
Compliance brief
This use case is minimal-risk under the EU AI Act (Minimal Risk); no product-specific obligations beyond general AI literacy apply.
What is owed
- Art. 4. Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems.
- GDPR Art. 22. Right not to be subject to solely automated decisions with legal/similar effect; requires meaningful human involvement or explicit legal basis + safeguards.
- GDPR Art. 17. Right to erasure collides with AI Act Art.
- GDPR Art. 25. Privacy by design & default: minimisation, pseudonymisation, PII filters in pipelines and vector stores.
- GDPR Art. 35. Data-protection impact assessment for high-risk processing — pairs with AI Act fundamental-rights impact assessment (Art.
Dates that bind
- 2026-08-02 — General applicability + Art. 50. Transparency obligations for chatbots, deepfakes and synthetic content; EU-level enforcement begins.
- 2026-12-02 — Additional prohibitions. Additional bans (deepfake CSAM et al.) and transition period for synthetic content under Art. 50(2).
Maximum exposure
- EU AI Act: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
- GDPR: Up to €20m or 4% of worldwide annual turnover
- Cyber Resilience Act: Up to €15m or 2.5% of worldwide annual turnover
- NIS2 Directive: Up to €10m or 2% of worldwide annual turnover
- AI Liability Directive (withdrawn): None — the instrument was withdrawn before adoption. Civil exposure runs through the revised Product Liability Directive and national fault-based liability regimes instead.
First five actions
- Confirm in writing whether this organisation builds/places the system on the market (provider) or only operates it (deployer), since the role is not yet established.
- Commission and confirm the Art. 4, GDPR Art. 22, GDPR Art. 17 obligations named above as active workstreams with an accountable owner.
- Stand up the named oversight design — Mode 2 — with a documented human-review procedure.
- Produce the technical documentation and evidence artefacts already mapped to this use case (HITL Escalation Queue & Review UI, Bitemporal Memory (GDPR×Art.12), PII Scrubbing / DLP-NER Layer) before they are requested.
- Put 2026-08-02 — General applicability + Art. 50 — into the compliance calendar with an owner and lead time.
Terms used above: · · ·
Applicable Regulations (6)
EU AI Act (Regulation (EU) 2024/1689)
unverified · no verification date source EUR-Lex
Horizontal, risk-based product-safety law for AI systems and GPAI models. Extraterritorial market-place principle. Staged applicability 2025–2030 (Digital Omnibus: Annex III → 2 Dec 2027, Annex I → 2 Aug 2028).
Sanctions: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
GDPR (Regulation (EU) 2016/679)
unverified · no verification date source EUR-Lex
Applies unchanged next to the AI Act for all personal data in training, fine-tuning, RAG and inference. Key friction points: Art. 22 automated decisions, Art. 17 erasure vs. AI Act logging, Art. 35 DPIA.
Sanctions: Up to €20m or 4% of worldwide annual turnover
Cyber Resilience Act (Regulation (EU) 2024/2847)
unverified · no verification date source EUR-Lex
Security-by-design for products with digital elements over the full lifecycle: vulnerability management, patching, SBOM. Complements AI Act Art. 15 at product level.
Sanctions: Up to €15m or 2.5% of worldwide annual turnover
Revised Product Liability Directive (Directive (EU) 2024/2853)
unverified · no verification date source EUR-Lex
Extends strict defect liability to standalone software and AI — including systems that continue learning post-deployment. Covers physical harm, property damage, psychological health impairment and non-professional data loss; disclosure duties and rebuttable defect presumption shift the burden of proof toward the injured party. Makes reconstructible decision evidence an economic necessity.
NIS2 Directive (Directive (EU) 2022/2555)
unverified · no verification date source EUR-Lex
Cyber-resilience duties for essential/important entities: supply-chain risk management, incident response, 24h early warning / 72h notification. AI components count as operational IT in scope.
Sanctions: Up to €10m or 2% of worldwide annual turnover
AI Liability Directive (withdrawn) (AILD — COM(2022) 496, withdrawn)
withdrawn · verified 2026-08-07
Historical context, not live law: the proposed fault-based liability companion to the PLD would have introduced a rebuttable presumption of causality where AI Act duties (oversight, logging) were breached, plus court-ordered disclosure of technical documentation, logs and risk assessments. The Commission announced its withdrawal in the 2025 work programme, so no such presumption exists in EU law. What survives in practice is the substance: the revised Product Liability Directive (reg-pld) now carries the software and AI liability weight, including disclosure duties and its own rebuttable defect presumption — which keeps evidence architecture a liability defence for exactly the same reasons.
Sanctions: None — the instrument was withdrawn before adoption. Civil exposure runs through the revised Product Liability Directive and national fault-based liability regimes instead.
Legal Obligations (6)
Art. 4 — AI Literacy
Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems. In force since 2 Feb 2025.
unverified · no verification date read the article artificialintelligenceact.eu
GDPR Art. 22 — Automated Decisions
Right not to be subject to solely automated decisions with legal/similar effect; requires meaningful human involvement or explicit legal basis + safeguards.
unverified · no verification date read the article EUR-Lex
GDPR Art. 17 — Erasure
Right to erasure collides with AI Act Art. 12 immutable logging — resolved architecturally via bitemporal data modelling + physical partition scrub.
unverified · no verification date read the article EUR-Lex
GDPR Art. 25 — Data Protection by Design
Privacy by design & default: minimisation, pseudonymisation, PII filters in pipelines and vector stores.
unverified · no verification date read the article EUR-Lex
GDPR Art. 35 — DPIA
Data-protection impact assessment for high-risk processing — pairs with AI Act fundamental-rights impact assessment (Art. 27) for public-facing high-risk systems.
unverified · no verification date read the article EUR-Lex
Art. 25 — Value Chain / Role Flip
A deployer becomes the provider (full Art. 8–17 duties) by re-branding, changing intended purpose, or making a substantial modification — e.g. deep fine-tuning or wiring a model into autonomous agent toolchains.
unverified · no verification date read the article artificialintelligenceact.eu
Control Objectives (0)
obligation (article) → operationalized_by → control objective → satisfied_by → component/pattern; control objective → evidenced_by → evidence artifact
Art. 4
control layer: community mandate — propose objectives
GDPR Art. 22
control layer: community mandate — propose objectives
GDPR Art. 17
control layer: community mandate — propose objectives
GDPR Art. 25
control layer: community mandate — propose objectives
GDPR Art. 35
control layer: community mandate — propose objectives
Art. 25
control layer: community mandate — propose objectives
Take this into your GRC tooling
A control mapping your ISO/IEC 42001 or CSA AICM workbook can ingest, and an Annex IV skeleton to start the technical file from. Indicative mappings only — cells we are not confident about are exported empty rather than filled in.
Standards & Evidence
ISO/IEC 42005 (AI Impact Assessment)
Guidance for AI system impact assessments — supports DPIA/FRIA-style analyses.
unverified · no verification date publisher ISO
evidence for: GDPR Art. 35
IEEE CertifAIEd™
Ethics certification (transparency, accountability, algorithmic bias, privacy) for products and professionals; interfaces with the EU ALTAI assessment list.
unverified · no verification date
evidence for: EU AI Act
ENISA Multilayer Framework & AI Threat Landscape
Three-layer good-practice model (cyber foundations → AI-specific → sectoral) and lifecycle threat landscape — the operational base for Art. 15 and CRA.
unverified · no verification date
evidence for: Cyber Resilience Act
NIST SP 800-218 (SSDF)
Secure Software Development Framework: practices for provenance, review and vulnerability handling of generated and third-party code; SSDF-AI companion covers AI-assisted development.
unverified · no verification date
evidence for: Cyber Resilience Act
ISO/IEC 27001:2022 + A.8.28
Information-security management; control A.8.28 (secure coding) is the natural anchor for AI code-generation and QA workflows alongside ISO 42001.
unverified · no verification date publisher ISO
evidence for: Cyber Resilience Act
BSI C5:2026
Cloud compliance catalogue (168 requirements): post-quantum crypto, confidential computing, container security — infrastructure evidence layer for NIS2/CRA/Art. 15; binding baseline from June 2027.
unverified · no verification date
evidence for: NIS2 Directive
Architecture Blueprint
Agentic RDA Stack (6 Layers)
Regulatory Design & Architecture framework for agentic systems: (1) isolated ephemeral execution (gVisor/Firecracker, read-only root, egress allowlists) → (2) agentic zero-trust identity (per-agent ID, short-lived OBO OAuth 2.1 tokens) → (3) MCP gateway with default-deny ACLs & credential vault → (4) reasoning + guardrail interception (prompt shields, sidecar alignment checks) → (5) human-oversight & durable state persistence (propose-action objects, checkpoint store) → (6) continuous observability & signed audit logs (≥ 6 months, SIEM).
Mode 2 — Supervised Autonomy
Execution within a delay window during which a human can intervene; dominant mode in well-designed regulated production systems.
Required Technical Components (28)
HITL Escalation Queue & Review UI
HITL escalation queue & review UI ('Human-as-a-Tool': the agent calls the human like any other tool via propose-action objects). Confidence- and risk-threshold routing, SLA timers, structured accept/modify/reject verdicts with digital reviewer signature at gate release — each verdict is itself Art. 14 evidence and feeds the active-learning loop.
from: GDPR Art. 22
Bitemporal Memory (GDPR×Art.12)
valid_from/valid_to + transaction time on every record: GDPR erasure removes data from the active retrieval path while the HMAC-chained immutable log survives for Art. 12 / PLD defence; tenant-scoped partitions allow physical scrub of PII.
from: GDPR Art. 17
PII Scrubbing / DLP-NER Layer
Automated detection, pseudonymisation and blocking of personal data in inputs, retrievals and outputs.
from: GDPR Art. 25
Per-Tenant Retrieval Segmentation
Retrieval is scoped by tenant and by caller entitlement at query time, preventing cross-client and cross-role leakage through shared indexes.
from: GDPR Art. 25
Segmented Vector Store (RBAC + CMEK)
Vector indexes, embeddings and document stores are logically and physically partitioned per client, with role-based access and customer-managed encryption keys.
from: GDPR Art. 25
Live Risk Register / Posture Management
Continuously updated risk register wired to runtime posture: threat-model deltas, open defects, control status, exposure per system. Includes Shadow-AI discovery — continuous scanning for unsanctioned agents, MCP servers and AI API usage outside the register; an unregistered agent is an unmanaged Art. 12/26 liability and the empirical driver of proportionate (not blanket) controls.
from: GDPR Art. 35
Zero-Data-Retention Vendor Binding
Sensitive inference is contractually and technically restricted to endpoints under zero-data-retention and non-training terms, evidenced per vendor and re-validated annually.
from: Art. 25
SBOM & Dependency Management
Software bill of materials incl. model weights and datasets; automated vulnerability patching pipeline.
from: Cyber Resilience Act
Secure Boot & Hardened Runtime
Verified boot chain and hardened runtimes for edge/IoT deployments per CRA security-by-design.
from: Cyber Resilience Act
OpenTelemetry / FCoT Tracing
Hierarchical trace spans for every sub-task, prompt, retrieved document and API call — the reconstructible decision path for Art. 12/14 and PLD disclosure.
from: Revised Product Liability Directive · AI Liability Directive (withdrawn) · Agentic RDA Stack (6 Layers)
WORM / Immutable Audit Vault
Append-only, hash-chained audit vault (WORM object-lock storage, AES-256 at rest, TLS 1.3 in transit). Guarantees tamper-evidence within the organization's trust domain — which stops your own team, but not an admin who can rebuild the vault. Pair with an external trust anchor and key ceremonies outside the operating team for evidence that holds against the insider scenario.
from: Revised Product Liability Directive · AI Liability Directive (withdrawn) · Agentic RDA Stack (6 Layers)
Unified Incident-Response Runbook
One procedure reconciling AI Act Art. 73, GDPR Art. 33 (72h), DORA and NIS2 (24h/72h) timelines and recipients.
from: NIS2 Directive
Vendor & Model Due-Diligence Kit
Scoring model: jurisdiction (CLOUD Act exposure), zero-data-retention, BYOK support, audit evidence (C5/AIC4/ISO 42001/EN 18286:2026), tenant isolation.
from: NIS2 Directive
Ephemeral Execution Isolation
gVisor/Firecracker microVMs, read-only root, egress allowlists; container discarded after each task to prevent persistence of exploits.
from: Agentic RDA Stack (6 Layers)
Agentic Zero Trust
Unique cryptographic identity per agent; short-lived, finely-scoped tokens (OAuth 2.1 + PKCE); On-Behalf-Of flow so an agent can never see more than its triggering user.
from: Agentic RDA Stack (6 Layers)
MCP Gateway / Proxy
Central chokepoint for agent tool traffic: default-deny tool ACLs (tools/list vs tools/call), schema & argument inspection, credential injection from vault, rate limits, full audit mirror. Regulatory root cause: the base MCP protocol enforces no authentication or authorization at protocol level — Host/Client/Server topology with Tools/Resources/Prompts primitives ships without an identity layer, so a policy-enforcing gateway is not optional hardening but the only place Art. 12/15 duties can be enforced for tool calls.
from: Agentic RDA Stack (6 Layers)
Guardrail Sidecar / Interception
Rule-based (NeMo/Colang), model-based (alignment checkers) and structural validators deployed as sidecar or gateway plugin (<50 ms), decoupling safety scaling from inference scaling.
from: Agentic RDA Stack (6 Layers)
Propose-Action Objects
Agents never call target APIs directly: they emit typed proposal objects (endpoint, params, risk estimate, rationale) validated by the governance layer before execution; idempotent execution layer.
from: Agentic RDA Stack (6 Layers)
Durable Checkpointing (Pause & Resume)
At oversight gates the complete operational state — working memory, conversation history, tool arguments, intermediate artifacts — is serialized into a durable checkpoint (fast KV store for sub-ms lookups, transactional backend as recovery anchor, vector store for semantic caching of past human decisions). On approval the agent deserializes and resumes at the exact step; matched precedents can shortcut re-planning entirely.
from: Agentic RDA Stack (6 Layers)
Per-Action Autonomy Tiering
Tools tagged read-only / reversible-write / irreversible-write; controls layer routes each action to the matching oversight mode. Mode selection is per action type, never per agent.
from: Agentic RDA Stack (6 Layers)
Agent Identity & Access (IdP)
Per-agent identities, short-lived scoped tokens, OBO flow enforcement — the identity substrate of agentic zero trust.
from: Agentic RDA Stack (6 Layers)
Central Credential Vault
Agents never hold target-system keys; the gateway injects centrally managed credentials after policy checks.
from: Agentic RDA Stack (6 Layers)
Watchdog Supervisor & Rate Limiting
Cost/iteration caps, loop detection, anomaly-triggered mandatory approval (CodeBuddy 'suspicious command override').
from: Agentic RDA Stack (6 Layers)
Trinity Defense (TCB + Command Gates + IFC)
Treats the LLM as an untrusted proposal engine behind a hardened non-LLM Trusted Computing Base. Three pillars: (1) command gates — actions only via a Finite Action Calculus, authorized by a deterministic policy checker before any execution; (2) information-flow control — lattice labels stop confidential data flowing to low-trust sinks without audited declassification; (3) privilege separation — sandboxed low-privilege planner ingests untrusted input, isolated high-privilege worker executes only gate-approved, TCB-normalized actions. Grounded in the impossibility result: token content alone can never unforgeably separate commands from data.
from: Agentic RDA Stack (6 Layers)
Guardian Agents (Runtime Policy Enforcement)
Autonomous supervisory agents outside the supervised agent's reasoning loop: stateful threat engines with graph-based cross-session history (catch multi-turn injection, gradual exfiltration, incremental privilege escalation), event-driven exposure visibility (permission drift, new connectors), and contextual risk correlation into unified issues — interception before execution, not post-hoc logging.
from: Agentic RDA Stack (6 Layers)
Deterministic Policy Engine (OPA / Cedar)
Policy-as-code decision point (PDP) with enforcement points (PEP) in front of every tool call: versioned policies in Git, microsecond evaluation, typed action schemas — authorization decided outside the model's reasoning space, never in the prompt.
from: Agentic RDA Stack (6 Layers)
Shadow-Mode Execution
Run governance controls in observe-and-score mode before enforcement: the policy engine and guardrails evaluate every agent action and log verdicts without blocking, yielding empirical false-positive/negative rates and calibrated thresholds. De-risks the enforcement cutover, produces baseline evidence for Art. 9 risk estimation, and is the standard migration path when retrofitting controls onto a live workflow.
from: Agentic RDA Stack (6 Layers)
Multi-Model Router & Fallback Abstraction
Abstraction layer decoupling application logic from model providers: dynamic routing on capability, cost, latency SLA and regulatory constraint (sensitive-data classes pinned to ZDR private/VPC endpoints or on-prem open-weight instances); real-time health monitoring with automatic fallback to secondary endpoints or local fine-tuned models on outage/latency spikes. Discharges resilience duties (DORA-class), prevents provider lock-in, and makes model deprecations a routing-table change instead of a re-architecture. Router decisions are logged into the decision trace — model version per event is an audit-packet field.
from: Agentic RDA Stack (6 Layers)
Delivery Stack & Pipeline Stage (2)
Service-as-a-Software delivery: the engines, patterns and artifacts this workflow needs on top of the generic obligations. See the full pipeline
Cognitive Orchestrator
The reasoning and control plane of an agentic workflow: goal decomposition, tool selection across enterprise APIs, confidence scoring per step, and a human-machine interface exposing progress, limitations and a global halt. It is the architectural home of AI Act Art. 14 oversight — oversight that lives only in a downstream UI cannot stop an executing agent.
Local Perimeter Execution (MCP)
Execution agents run inside the corporate perimeter and reach tools through the Model Context Protocol instead of shipping raw records to third-party model endpoints. Context is scoped to the minimum attributes the task needs, which is how data minimisation (GDPR Art. 5(1)(c)) and Art. 25 privacy-by-design survive multi-tool agent orchestration.
Build or Buy — Vendor Layer (5)
The graph models vendor CATEGORIES as first-class nodes and keeps named vendors as community-maintained, disputable desc content with lastVerified dates. A category is stable; a vendor list is a currency-layer object like any standard node.
Agent Orchestration & SDLC Toolkits
Developer middleware for multi-agent networks, tool-use chains, RAG abstraction, state/memory persistence and model routing. Exemplary (community-maintained): LangChain, LlamaIndex, AutoGen, CrewAI; MCP-based tool ecosystems. Regulatory posture: orchestration code is where autonomy tiering, propose-action objects and fallback routing get implemented — the framework choice constrains which controls are cheap and which are retrofits.
unverified · verified 2026-08-06 community-maintained
selection metrics: broad model-API abstraction, state/memory management, error recovery, fallback routing hooks
supplies: HITL Escalation Queue & Review UI · Multi-Model Router & Fallback Abstraction · Cognitive Orchestrator
AI GRC & Governance Platforms
Second-line systems of record: model/agent inventory incl. third-party SaaS AI, automated risk tiering, policy administration, cross-framework mapping & control deduplication, audit-evidence generation, intake workflows. Exemplary (community-maintained): ModelOp Center, Credo AI, IBM watsonx.governance, OneTrust, Holistic AI, Modulos (governance graph), Monitaur (insurance/lending), Fairly AI, Saidot, Trustible, Enzai, LatticeFlow (technical validation), Vanta (evidence automation), ServiceNow (intake/ITSM); data-catalog adjacency: Collibra, Alation, Informatica. Selection metrics: see meta.marketLandscape.selectionMetrics.grc.
unverified · verified 2026-08-06 community-maintained
selection metrics: multi-model/multi-cloud cataloging incl. third-party SaaS, automated risk tiering, regulatory reporting, independent-2nd-line deployability, cross-framework control deduplication
supplies: Live Risk Register / Posture Management · Vendor & Model Due-Diligence Kit
Runtime Security & Guardrail Vendors
First-line inline enforcement: single-pass parallel input/output evaluation proxies, injection & exfiltration defense, PII masking, grounding checks, SecOps routing. Exemplary (community-maintained): Prompt Security, HiddenLayer (MLSDR), Palo Alto AI Runtime Security, AWS Bedrock Guardrails, NVIDIA NeMo Guardrails, Guardrails AI, Robust Intelligence, LLM Guard / Llama Guard OSS class. Selection metrics: single-pass latency (<20 ms class), catch rates, policy-version telemetry into the AI-BOM.
unverified · verified 2026-08-06 community-maintained
selection metrics: single-pass parallel evaluation latency (<20 ms class), injection/hallucination catch rates, SecOps/SIEM routing, policy versioning surfaced into the AI-BOM
supplies: MCP Gateway / Proxy · Guardrail Sidecar / Interception
Regulated Foundation-Model Platforms
Frontier commercial APIs and open-weight models under enterprise controls: zero-data-retention tiers, data isolation, fine-tuning governance, safety alignment documentation, EU-sovereign options. Exemplary (community-maintained): Anthropic Claude (ZDR enterprise tier), OpenAI GPT enterprise, Google Gemini Enterprise, Cohere (private-cloud RAG), Mistral (EU/self-hosted), Meta Llama (open-weight sovereignty). GPAI-chapter duties and vendor due diligence attach at this layer.
unverified · verified 2026-08-06 community-maintained
selection metrics: ZDR enterprise tiers, data isolation, EU-sovereign options, fine-tuning controls, safety alignment documentation
supplies: Multi-Model Router & Fallback Abstraction
Secure Data Infrastructure & Vector Storage
Governed retrieval substrate: vector databases, lakehouses and catalogs with tenant/namespace isolation, RBAC + client-managed keys (CMEK), lineage into RAG chunks, air-gap options. Exemplary (community-maintained): Pinecone (serverless, SOC 2), Chroma/FAISS (self-hosted/air-gapped sovereignty), Snowflake Cortex (masking, clean rooms), Databricks Unity Catalog (end-to-end lineage), Azure AI Search, AWS OpenSearch. The Art. 10 runtime data-governance duties land here.
unverified · verified 2026-08-06 community-maintained
selection metrics: namespace/tenant isolation, RBAC + CMEK, lineage into RAG chunks, SOC 2 / ISO 27001 attestations, air-gap capability
supplies: Local Perimeter Execution (MCP)
Procurement rule: Derived from three-lines-of-defense separation: the second-line GRC platform must be procured and deployed independently of any first-line runtime or model vendor — a governance tool that only sees its own vendor's models cannot govern a multi-model estate, and closed third-party SaaS AI can only be governed contractually (intake, attestation, AI-BOM disclosure), never by inline inspection.
Outsourced delivery BPO · SaaS · Service-as-a-Software caveats
Delivery Model — BPO · SaaS · Service-as-a-Software
Spectrum
BPO: input-priced (billable hours/FTEs), linear headcount scaling, human error & attrition as primary risk
SaaS: capability-priced (software access), client operates the workload, implementation/adoption failure as primary risk
Service-as-a-Software: outcome-priced (SLA on completed work), provider-managed AI executes 60–80% of cognitive tasks with specialist supervision, algorithmic bias & non-compliance as primary risk
Caveats in regulated markets
— Outcome SLAs move compliance risk onto the provider — but NOT the buyer's deployer duties: Art. 26 oversight, log retention and FRIA obligations stay with the enterprise even when execution is outsourced.
— Provider role analysis is the central legal question: a productized platform that fine-tunes, re-purposes or chains models can flip into the Art. 25 provider role with full high-risk obligations.
— Certified operations (ISO 42001) function as a procurement moat and shortcut third-party risk assessment — but organizational certificate ≠ product conformity (never conflate, see meta.assuranceEcosystem).
— The buyer's evidence chain must reach into the provider: contractually mandated AI-BOM disclosure, ZDR certificates, bias-audit reports and logging-ledger access are the artifacts that make an outsourced workflow auditable.
Threat Profile
Lethal Trifecta
Untrusted external input + privileged access + irreversible external actions in one agent: any successful context manipulation becomes a potentially catastrophic incident. Break at least one leg architecturally.
mitigate with: MCP Gateway / Proxy, Propose-Action Objects, Reversibility Engineering, Ephemeral Execution Isolation, Trinity Defense (TCB + Command Gates + IFC), Deterministic Policy Engine (OPA / Cedar)
LLM06 Excessive Agency
Over-broad rights/functions of autonomous agents lead to uncontrolled actions.
mitigate with: MCP Gateway / Proxy, Agentic Zero Trust, Per-Action Autonomy Tiering, Trinity Defense (TCB + Command Gates + IFC), Deterministic Policy Engine (OPA / Cedar), Guardian Agents (Runtime Policy Enforcement)