The questions
21 questions, 69 indicators, 253 links to 209 provisions. Five questions are about freedom and the rest about governance. "Part" means the indicator answers part of what the provision asks. "Its absence" means the provision describes the lack of that fact.
Q 01. What is the agent built on?
Freedom. One answer reaches 5 provisions in 1 instruments: OWASP.
| Indicator | Tier | Cites |
|---|---|---|
I01 It is a vendor's assistant, used as supplied | Public | OWASP, AT1 Vendor Embedded Assistant |
I02 It runs on an AI platform with the organisation's own data, without executing arbitrary code | Public | OWASP, AT2 Platform Integrated |
I03 It is configured on a low-code or no-code builder and acts on real organisational data | Public | OWASP, AT3 Citizen Developer Agent |
I04 It generates and executes code with local or cloud privileges | Public | OWASP, AT4 Code Executing Agent |
I05 It is built in-house: the organisation controls its identity, tools and boundaries | Public | OWASP, AT5 Custom In-House Agent |
Q 02. Does it act, or only answer and recommend?
Freedom. One answer reaches 9 provisions in 2 instruments: Salesforce, Microsoft.
| Indicator | Tier | Cites |
|---|---|---|
I06 It follows fixed rules, with no reasoning | Public | Salesforce, Level 0: Fixed Rules and Repetitive Tasks (Chatbots and Co-pilots); Microsoft, 100: Initial, Business strategy (part); Microsoft, 100: Initial, Business strategy (part); Microsoft, 100: Initial, Business strategy (part) |
I07 It retrieves information and recommends actions; a person acts | Public | Salesforce, Level 1: Information Retrieval Agents; Salesforce, Level 0, how companies can advance from Level 0 to Level 1 (part) |
I08 It executes actions itself | Public | Salesforce, Level 2: Simple Orchestration, Single Domain (part); Salesforce, Level 1, how to advance from Level 1 to Level 2; Microsoft, 200: Repeatable, Business strategy (part) |
Q 03. How far does it reach?
Freedom. One answer reaches 10 provisions in 4 instruments: Salesforce, Microsoft, OWASP, NIST AI RMF.
| Indicator | Tier | Cites |
|---|---|---|
I09 It works in one domain's data | Public | Salesforce, Level 2: Simple Orchestration, Single Domain (part); Salesforce, Level 0, how companies can advance from Level 0 to Level 1 (part) |
I10 It works across several domains or systems | Public | Salesforce, Level 3: Complex Orchestration, Multiple Domain; Salesforce, Level 2, how to advance from Level 2 to Level 3; Salesforce, Level 3, how to advance from Level 3 to Level 4 (part); Microsoft, 400: Capable, Business strategy; Microsoft, 200: Repeatable, Technology and data (part) |
I11 It connects to external tools or services across a trust boundary | Public | OWASP, AT6 Externally Extended Agent; NIST AI RMF, GOVERN 6.1 (part); NIST AI RMF, MAP 4.1 (part) |
Q 04. Does it work with other agents?
Freedom. One answer reaches 10 provisions in 4 instruments: OWASP, Salesforce, Microsoft, AAGMM.
| Indicator | Tier | Cites |
|---|---|---|
I12 Several agents coordinate inside the organisation | Public | OWASP, AT7 Multi-Agent Orchestration; Salesforce, Level 2, how to advance from Level 2 to Level 3 (part); Microsoft, 500: Efficient, Technology and data; AAGMM, GD-09 (part) |
I13 Agents operate across organisational boundaries or disparate stacks | Public | OWASP, AT8 Federated / Cross Boundary; Salesforce, Level 4: Multi-Agent Orchestration; Salesforce, Level 3, how to advance from Level 3 to Level 4; Salesforce, Level 4, how to maximize value (part) |
I14 There is a published protocol or communication layer between agents | Public | Salesforce, Level 3, how to advance from Level 3 to Level 4; Salesforce, Level 2, how to advance from Level 2 to Level 3 (part); AAGMM, GD-09 (part) |
Q 05. What is the person's role?
Freedom. One answer reaches 6 provisions in 2 instruments: EAAMM, Microsoft.
| Indicator | Tier | Cites |
|---|---|---|
I15 The person operates: every action is prompted and controlled by them | Public | EAAMM, L1 Assistive (survey item Q9) |
I16 The agent suggests; the person reviews and approves each action | Public | EAAMM, L2 Collaborative (survey item Q9) |
I17 The agent handles routine tasks; the person is consulted on exceptions | Public | EAAMM, L3 Consultative (survey item Q9) |
I18 The agent works independently; the person approves critical decisions only | Public | EAAMM, L4 Supervisory (survey item Q9) |
I19 The agent has full autonomy within boundaries; the person monitors | Public | EAAMM, L5 Autonomous (survey item Q9); Microsoft, 500: Efficient, Business strategy (part) |
Q 06. Is what it is for written down?
Governance. One answer reaches 9 provisions in 4 instruments: NIST AI RMF, EU AI Act, OWASP, Microsoft.
| Indicator | Tier | Cites |
|---|---|---|
I20 Its purpose and permitted tasks are stated in writing | Public | NIST AI RMF, MAP 1.1 (part); NIST AI RMF, MAP 2.1; NIST AI RMF, MAP 3.3; NIST AI RMF, MAP 1.3 (part); EU AI Act, Article 13 (part) |
I21 Its autonomy limits and the tools it may use are defined | Declared | OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action; NIST AI RMF, MAP 2.2 (part); Microsoft, 300: Defined, Business strategy (part) |
I22 Its limits and known failure cases are documented for those who use it | Public | NIST AI RMF, MAP 2.2; NIST AI RMF, MEASURE 2.5 (part); EU AI Act, Article 13 (part) |
Q 07. Does it have its own identity and only the access it needs?
Governance. One answer reaches 19 provisions in 4 instruments: MCP authorization, AAGMM, Salesforce, OWASP.
| Indicator | Tier | Cites |
|---|---|---|
I23 What it can reach is enumerated: scopes, permissions, tools | Public | MCP authorization, Authorization (draft) (part); MCP authorization, Authorization (draft) (part); AAGMM, GD-02 (part) |
I24 Its authorisation is published as metadata that anyone can read | Public | MCP authorization, Authorization (draft); MCP authorization, Authorization (draft); MCP authorization, Authorization (draft) (part); MCP authorization, Authorization (draft) (part) |
I25 It asks for narrower access than the whole account | Public | MCP authorization, Authorization (draft); Salesforce, Level 2, how to advance from Level 2 to Level 3 (part); Salesforce, Level 3, how to advance from Level 3 to Level 4 (part); AAGMM, GD-02 (part); MCP authorization, Authorization (draft) (part) |
I26 It has its own identity, separate from any person's | Declared | AAGMM, GD-02 (part); Salesforce, Level 2, how to advance from Level 2 to Level 3 (part); OWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action (part) |
I27 Its identity is cryptographic and can be checked by others | Public | OWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action |
I28 Its tokens are bound to the service they were issued for and are not passed on | Evidenced | MCP authorization, Authorization (draft) (part); MCP authorization, Authorization (draft); MCP authorization, Authorization (draft) (part); MCP authorization, Authorization (draft) (part); MCP authorization, Authorization (draft); MCP authorization, Authorization (draft); MCP authorization, Authorization (draft) (part) |
Q 08. Is it in a registry, with an owner?
Governance. One answer reaches 11 provisions in 5 instruments: OWASP, NIST AI RMF, AAGMM, Salesforce, Microsoft.
| Indicator | Tier | Cites |
|---|---|---|
I29 The organisation keeps a registry of its agents | Declared | OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action; NIST AI RMF, GOVERN 1.6; AAGMM, GD-01 (part); AAGMM, GD-07 (part); Salesforce, Level 3, how to advance from Level 3 to Level 4 (part); OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action (part) |
I30 Each agent has a named owner | Declared | OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action; OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action (part); Microsoft, 200: Repeatable, Organization and culture (its absence) |
I31 Agents are retired by a defined process | Declared | NIST AI RMF, GOVERN 1.7; Salesforce, Level 3, how to advance from Level 3 to Level 4; AAGMM, GD-01 (part); Salesforce, Level 3, how to advance from Level 3 to Level 4 (part) |
Q 09. Who is accountable for it?
Governance. One answer reaches 9 provisions in 3 instruments: OWASP, Microsoft, NIST AI RMF.
| Indicator | Tier | Cites |
|---|---|---|
I32 A named executive or body is accountable for the organisation's agents | Public | OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action; Microsoft, 300: Defined, AI strategy and experience; Microsoft, 500: Efficient, AI strategy and experience; NIST AI RMF, GOVERN 2.3; Microsoft, 100: Initial, AI strategy and experience (its absence); OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action (part) |
I33 Roles and responsibilities for AI risk are documented | Declared | NIST AI RMF, GOVERN 2.1; NIST AI RMF, GOVERN 3.2 (part); Microsoft, 200: Repeatable, Organization and culture (its absence) |
Q 10. Is there a policy that governs it?
Governance. One answer reaches 24 provisions in 6 instruments: OWASP, Microsoft, NIST AI RMF, AAGMM, Salesforce, EU AI Act.
| Indicator | Tier | Cites |
|---|---|---|
I34 A governance policy for agents is published | Public | OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action; Microsoft, 300: Defined, Business strategy; Microsoft, 200: Repeatable, AI governance and security (part); Microsoft, 100: Initial, AI governance and security (its absence); NIST AI RMF, GOVERN 1.2 (part); NIST AI RMF, GOVERN 1.4; AAGMM, GD-04 (part); Salesforce, Level 1, how to advance from Level 1 to Level 2 (part); OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action (part) |
I35 Agents and use cases are classed by risk | Declared | AAGMM, GD-10; OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action (part); NIST AI RMF, GOVERN 1.3; NIST AI RMF, MAP 1.5 (part); NIST AI RMF, MAP 5.1 (part); EU AI Act, Article 9 (part); Salesforce, Level 0, how companies can advance from Level 0 to Level 1; Microsoft, 300: Defined, Business strategy (part); NIST AI RMF, MANAGE 1.2 (part) |
I36 The laws that apply to it are identified | Declared | NIST AI RMF, GOVERN 1.1; OWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action (part); Microsoft, 100: Initial, AI governance and security (part) |
I37 New agents pass an approval or review before they run | Declared | OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action; Microsoft, 400: Capable, AI governance and security (part); NIST AI RMF, MANAGE 1.1 (part) |
Q 11. Can a person step in or stop it?
Governance. One answer reaches 10 provisions in 7 instruments: OWASP, EU AI Act, AAGMM, NIST AI RMF, Salesforce, Microsoft, EAAMM.
| Indicator | Tier | Cites |
|---|---|---|
I38 High-impact actions need a person's approval | Public | OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action; EU AI Act, Article 14 (part); AAGMM, GD-06 (part); NIST AI RMF, MAP 3.5 (part); Salesforce, Level 3, how to advance from Level 3 to Level 4 (part); Microsoft, 300: Defined, Business strategy (part) |
I39 There is a way to pause or stop it | Declared | OWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise action; NIST AI RMF, MANAGE 2.4; EU AI Act, Article 14 (part) |
I40 There is a defined escalation path | Declared | EAAMM, Prerequisite, L2 to L3; NIST AI RMF, GOVERN 3.2 (part); AAGMM, GD-06 (part) |
Q 12. Is what it does logged?
Governance. One answer reaches 7 provisions in 3 instruments: OWASP, EU AI Act, AAGMM.
| Indicator | Tier | Cites |
|---|---|---|
I41 Its actions are logged | Declared | OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action (part); OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action; EU AI Act, Article 12; AAGMM, GD-03 (part); AAGMM, GD-08 (part) |
I42 The log is tamper-evident and kept for a stated time | Evidenced | EU AI Act, Article 12 (part); EU AI Act, Article 26 (part); AAGMM, GD-08 (part); OWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action (part) |
Q 13. Is it watched while it runs?
Governance. One answer reaches 14 provisions in 6 instruments: Microsoft, NIST AI RMF, EU AI Act, AAGMM, Salesforce, OWASP.
| Indicator | Tier | Cites |
|---|---|---|
I43 It is monitored in operation | Declared | Microsoft, 200: Repeatable, AI governance and security; NIST AI RMF, MANAGE 4.1; NIST AI RMF, GOVERN 1.5 (part); EU AI Act, Article 72 (part); AAGMM, GD-03 (part); Salesforce, Level 1, how to advance from Level 1 to Level 2 (part); NIST AI RMF, MEASURE 2.4; Microsoft, 300: Defined, AI governance and security (part) |
I44 Anomalies are detected in real time and raise alerts | Evidenced | OWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise action; OWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise action (part); Microsoft, 400: Capable, AI governance and security; Microsoft, 500: Efficient, AI governance and security (part); OWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise action (part); AAGMM, GD-07 (part) |
Q 14. What stands between it and what it should not do?
Governance. One answer reaches 8 provisions in 3 instruments: OWASP, AAGMM, Microsoft.
| Indicator | Tier | Cites |
|---|---|---|
I45 A limit on it is enforced by something outside its own reach | Public | OWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise action (part); AAGMM, GD-04 (part); Microsoft, 200: Repeatable, AI governance and security (part); Microsoft, 200: Repeatable, AI governance and security (part); Microsoft, 500: Efficient, AI governance and security (part) |
I46 A limit on it is a setting that its own account could change | Public | |
I47 A limit on it is a rule in prose | Public | OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action (part) |
I48 Policy is enforced as machine-readable rules | Declared | OWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise action; OWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action (part); Microsoft, 500: Efficient, AI governance and security (part) |
I49 The difference between what it can reach and what it is for is stated | Public |
Q 15. Is it tested, and are the results shown?
Governance. One answer reaches 10 provisions in 3 instruments: NIST AI RMF, EAAMM, EU AI Act.
| Indicator | Tier | Cites |
|---|---|---|
I50 Test or evaluation results are published | Public | NIST AI RMF, MEASURE 2.1 (part); NIST AI RMF, MEASURE 2.3; NIST AI RMF, MEASURE 2.5 (part); EAAMM, Prerequisite, L2 to L3; EU AI Act, Article 15 (part); NIST AI RMF, MEASURE 1.1 (part) |
I51 It is tested for safety and security, including by attack | Declared | NIST AI RMF, MEASURE 2.6; NIST AI RMF, MEASURE 2.7; EU AI Act, Article 15 (part); NIST AI RMF, GOVERN 4.3 (part) |
I52 People who did not build it take part in assessing it | Declared | NIST AI RMF, MEASURE 1.3 |
Q 16. What happens when it goes wrong?
Governance. One answer reaches 9 provisions in 4 instruments: OWASP, AAGMM, NIST AI RMF, EU AI Act.
| Indicator | Tier | Cites |
|---|---|---|
I53 There is an incident process for agents | Declared | OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action; AAGMM, GD-11; NIST AI RMF, MANAGE 2.3; NIST AI RMF, GOVERN 4.3 (part); NIST AI RMF, MANAGE 1.3 (part) |
I54 Incidents and errors are communicated to those affected | Public | NIST AI RMF, MANAGE 4.3; EU AI Act, Article 73 (part); EU AI Act, Article 26 (part) |
I55 There is a plan for a failure of a third party it depends on | Declared | NIST AI RMF, GOVERN 6.2 |
Q 17. Do people know it is an AI, and can they answer back?
Governance. One answer reaches 6 provisions in 3 instruments: EU AI Act, NIST AI RMF, Salesforce.
| Indicator | Tier | Cites |
|---|---|---|
I56 It tells the people it talks to that it is an AI | Public | EU AI Act, Article 50 |
I57 There is a channel to report problems with it or contest its output | Public | NIST AI RMF, MEASURE 3.3; NIST AI RMF, GOVERN 5.1 (part); Salesforce, Level 1, how to advance from Level 1 to Level 2; Salesforce, Level 4, how to maximize value (part); NIST AI RMF, GOVERN 5.2 (part) |
Q 18. What data does it use, and under what rules?
Governance. One answer reaches 7 provisions in 5 instruments: AAGMM, EAAMM, Salesforce, Microsoft, NIST AI RMF.
| Indicator | Tier | Cites |
|---|---|---|
I58 The data it uses is described | Public | AAGMM, GD-05 (part); EAAMM, Readiness dimension 2 (part); Salesforce, Level 0, how companies can advance from Level 0 to Level 1 (part); Salesforce, Level 1, how to advance from Level 1 to Level 2 (part) |
I59 There are data quality rules for what it reads | Declared | EAAMM, Prerequisite, L2 to L3; Salesforce, Level 1, how to advance from Level 1 to Level 2; AAGMM, GD-05 (part); Microsoft, 400: Capable, Technology and data (part) |
I60 Its privacy risk has been examined | Declared | NIST AI RMF, MEASURE 2.10; AAGMM, GD-05 (part) |
Q 19. What does it depend on from others?
Governance. One answer reaches 6 provisions in 2 instruments: OWASP, NIST AI RMF.
| Indicator | Tier | Cites |
|---|---|---|
I61 The models and third-party components it uses are listed | Public | OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action; NIST AI RMF, MAP 4.1 (part) |
I62 Third-party components are monitored and have risk controls | Declared | NIST AI RMF, GOVERN 6.1; NIST AI RMF, MANAGE 3.1; NIST AI RMF, MANAGE 3.2; NIST AI RMF, MAP 4.2 |
Q 20. Has anyone independent checked?
Governance. One answer reaches 4 provisions in 3 instruments: AAGMM, OWASP, Microsoft.
| Indicator | Tier | Cites |
|---|---|---|
I63 A public certificate or audit report covers it | Public | AAGMM, GD-08 (part); OWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action (part) |
I64 Compliance evidence is produced continuously, ready for a regulator | Evidenced | OWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action; OWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action; Microsoft, 500: Efficient, AI governance and security (part) |
Q 21. Is the organisation behind it ready?
Governance. One answer reaches 40 provisions in 7 instruments: Microsoft, NIST AI RMF, EAAMM, EU AI Act, Salesforce, AAGMM, OWASP.
| Indicator | Tier | Cites |
|---|---|---|
I65 There is a stated strategy for agents | Public | Microsoft, 300: Defined, AI strategy and experience; Microsoft, 200: Repeatable, AI strategy and experience (part); Microsoft, 200: Repeatable, AI strategy and experience (part); Microsoft, 400: Capable, AI strategy and experience (part); Microsoft, 100: Initial, AI strategy and experience (its absence); NIST AI RMF, MAP 1.3 (part); EAAMM, Readiness dimension 1 (part) |
I66 The people who work with it are trained | Declared | NIST AI RMF, GOVERN 2.2; EU AI Act, Article 4; EAAMM, Readiness dimension 3; Microsoft, 100: Initial, Organization and culture (its absence); Microsoft, 200: Repeatable, Organization and culture (part); Microsoft, 300: Defined, Technology and data; Microsoft, 300: Defined, Organization and culture (part); NIST AI RMF, MAP 3.4 (part) |
I67 Its value is measured | Declared | Salesforce, Level 0, how companies can advance from Level 0 to Level 1 (part); Salesforce, Level 0, how companies can advance from Level 0 to Level 1; Salesforce, Level 1, how to advance from Level 1 to Level 2; Salesforce, Level 3, how to advance from Level 3 to Level 4; Salesforce, Level 4, how to maximize value (part); Salesforce, Level 4, how to maximize value; Microsoft, 200: Repeatable, Business strategy (part); Microsoft, 300: Defined, AI strategy and experience; Microsoft, 300: Defined, Business strategy (part); Microsoft, 400: Capable, Business strategy; Microsoft, 400: Capable, AI strategy and experience (part); NIST AI RMF, MAP 1.4 (part); NIST AI RMF, MAP 3.1 (part); Microsoft, 100: Initial, Organization and culture (its absence) |
I68 It is improved on a regular cycle | Declared | AAGMM, GD-12; Microsoft, 400: Capable, AI governance and security; Microsoft, 500: Efficient, Business strategy (part); Microsoft, 500: Efficient, AI strategy and experience (part); NIST AI RMF, MANAGE 4.2; OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action (part); NIST AI RMF, MEASURE 4.3 (part) |
I69 The organisation's risk management covers agents | Declared | EAAMM, Readiness dimension 4; EAAMM, Readiness dimension 1 (part); EU AI Act, Article 9 (part); NIST AI RMF, MAP 1.5; Microsoft, 500: Efficient, AI governance and security (part) |