{"title":"Agent & MCP Governance (AGT) Requirements — 9 Workforce AI Security Controls","description":"Govern agents, MCP servers and tool calls with identity, scope and runtime control. 9 vendor evaluation requirements with acceptance criteria, verification tests and framework mappings.","updated":"2026-10-21","count":9,"requirements":[{"id":"AGT-001","section":"Agent & MCP Governance","requirement":"Govern tool calls at read, write and delete scope","acceptance":"Permit a read while refusing write, delete or other destructive actions, with every attempt logged and attributable.","tier":"AT1, AT3, AT4, AT6","whyItMatters":"One agent can read, write and delete in the same workflow. Allow or deny per app is too blunt.","verificationMethod":"LT","verificationTest":"Reads to a connected system are allowed while attempts to change or delete information are blocked.","formerly":null,"alsoIn":["guardrails"],"sort":36,"adoptionContext":"Citizen-built, code-executing and MCP-extended workflows can take consequential tool actions, making operation-level permissions relevant.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Allowing reads while refusing writes, deletes and destructive operations enforces least privilege at the tool-call boundary. Enforce restrictions before the operation and record every attempt with usable attribution, retention, protection and analysis. Warnings or a live view alone are insufficient; runtime refusal does not review or revoke the underlying connector grant.","kind":"framework","references":{"csf":["PR.AA-05"],"soc2":["CC6.3"],"iso27001":["A.8.3","A.8.15"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"A defined, enforced boundary between permitted reads and prohibited destructive actions implements a concrete responsible-use procedure for agents. It contributes to the wider AI-use process without implying that the standard prescribes these exact API scopes.","kind":"framework","references":{"iso":["A.9.2"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Operation-level refusal limits destructive tool misuse and actions attempted through excessive or misapplied delegated identity. Attributable attempts help investigate those failures; the control covers the operations and tool paths where it is enforced.","kind":"framework","references":{"owasp":["ASI02","ASI03"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-001","frameworkRefs":{"ISO27001":["A.8.3","A.8.15"],"ISO42001":["A.9.2"],"NIST-CSF":["PR.AA-05"],"SOC2":["CC6.3"],"OWASP-ASI":["ASI02","ASI03"]}},{"id":"AGT-002","section":"Agent & MCP Governance","requirement":"Flag destructive, over-scoped or anomalous agent actions","acceptance":"Detect excessive permissions, unexpected tools, destructive operations, abnormal call sequences and policy bypass.","tier":"AT3, AT4, AT6","whyItMatters":"Destructive or unusual agent actions are often the first sign of a hijacked or misconfigured agent.","verificationMethod":"LT","verificationTest":"A destructive or out-of-pattern tool call in the pilot is flagged with context.","formerly":null,"alsoIn":["aidr"],"sort":37,"adoptionContext":"The listed connected-agent contexts can produce abnormal tool sequences, excessive scope or destructive operations that ordinary prompt inspection may miss.","mappings":[{"frameworks":["csf","iso","soc2","iso27001"],"explanation":"Detecting destructive operations, unexpected tools, abnormal call sequences and policy bypass supplies adverse-event analysis and monitoring of agent behavior. Excess-permission findings also inform access-right review; detection does not prevent an operation or reduce its permissions.\nISO/IEC 27001: A.8.16: Event assessment and response remain wider dependencies; test false-positive and response handling.","kind":"framework","references":{"csf":["DE.AE-02","DE.CM-09"],"iso":["A.6.2.6"],"soc2":["CC7.2","CC6.3"],"iso27001":["A.8.16","A.5.18"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Runtime findings supply the monitoring and evaluation component of post-deployment risk management. A detection capability alone does not establish the wider plan for user input, incident response, recovery and change management.","kind":"framework","references":{"rmf":["MANAGE 4.1"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Destructive calls and excessive permissions expose tool-misuse and identity-abuse patterns; abnormal sequences and policy bypass can also flag rogue-agent behavior. These are indicators for investigation, rather than proof that every anomalous agent is compromised or that the behavior is contained.","kind":"framework","references":{"owasp":["ASI02","ASI03","ASI10"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-002","frameworkRefs":{"ISO27001":["A.8.16","A.5.18"],"ISO42001":["A.6.2.6"],"NIST-CSF":["DE.AE-02","DE.CM-09"],"NIST-AI-RMF":["MANAGE 4.1"],"SOC2":["CC7.2","CC6.3"],"OWASP-ASI":["ASI02","ASI03","ASI10"]}},{"id":"AGT-003","section":"Agent & MCP Governance","requirement":"Inspect sensitive data retrieved through connectors mid-workflow","acceptance":"Detect when an agent picks up sensitive content from one connnected tool and attemps to share it with a separate tool, even if the user prompt was benign.","tier":"AT3, AT4, AT6","whyItMatters":"Connectors pull sensitive data into a conversation even when the user's question is harmless.","verificationMethod":"LT","verificationTest":"When an agent picks up sensitive information from one tool or dataset and attempts to share it with a different tool, the even is blocked if it violates policy.","formerly":null,"alsoIn":["guardrails"],"sort":38,"adoptionContext":"Embedded assistants, integrated platforms, citizen workflows and MCP extensions can retrieve sensitive data after a benign prompt; inspect the returned payload.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Inspecting connector payloads reveals sensitive information entering a workflow even when the prompt is benign, supplying runtime evidence for transfer, confidentiality and leakage controls. Detection alone does not restrict later disclosure; finding sensitive content also does not establish poisoned context.\nSOC 2: C1.1: The Confidentiality category and relevant information must be in scope.\nISO/IEC 27001: A.8.12: Operate inspection within a leakage-protection workflow with defined alert triage, warnings, blocking or another protective response.","kind":"framework","references":{"csf":["PR.DS-02","DE.CM-09"],"soc2":["CC6.7","C1.1"],"iso27001":["A.8.12"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Where retrieved content includes personal data, the findings inform examination of privacy risk within the AI workflow. Recognizing sensitive content is one input to that examination, not a complete privacy-risk assessment.","kind":"framework","references":{"rmf":["MEASURE 2.10"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-003","frameworkRefs":{"ISO27001":["A.8.12"],"NIST-CSF":["PR.DS-02","DE.CM-09"],"NIST-AI-RMF":["MEASURE 2.10"],"SOC2":["CC6.7","C1.1"]}},{"id":"AGT-004","section":"Agent & MCP Governance","requirement":"Attribute every connector and tool call alert to a person","acceptance":"Answer which server and tool were called, by whom, using which identity, every time an alert or intervention fires.","tier":"AT3, AT4, AT6","whyItMatters":"Without attribution, an agent action cannot be investigated or tied to accountability.","verificationMethod":"LT","verificationTest":"Every pilot tool call alert shows the tool used, the surface, the user identity, and the result.","formerly":null,"alsoIn":["aidr","audit"],"sort":39,"adoptionContext":"The listed connected-agent contexts need an identity chain from the employee to the server and tool call, including the delegated identity actually used.","mappings":[{"frameworks":["soc2"],"explanation":"Linking the person, execution identity, server, tool, scope and result supplies usable information for correlating calls and reviewing identity use. It can reveal gaps between human and delegated identities; attribution alone does not authenticate the caller, manage the identity lifecycle or authorize the operation.","kind":"framework","references":{"soc2":["CC2.1","CC7.2"]},"relation":null,"conditions":[]},{"frameworks":["iso","iso27001"],"explanation":"The person-to-identity-to-tool chain supplies attribution needed for AI event records and an audit trail. Answering those questions does not by itself require persistent protected logs, and the chain must preserve the distinction between the person and any service or delegated identity.\nISO/IEC 27001: Human attribution must not expose credential values.","kind":"framework","references":{"iso":["A.6.2.8"],"iso27001":["A.8.15"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Visible identity and scope relationships help investigate inherited-identity abuse, excessive delegation and confused-deputy behavior. Attribution exposes how authority was used; it does not itself stop an unauthorized call.","kind":"framework","references":{"owasp":["ASI03"]},"relation":null,"conditions":[]},{"frameworks":["csf"],"explanation":"Joining the person, execution identity, server, tool, scope and result supports event correlation. Attribution does not authenticate the caller, manage identity lifecycles or authorize the operation.","kind":"framework","references":{"csf":["DE.AE-03"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-004","frameworkRefs":{"ISO27001":["A.8.15"],"ISO42001":["A.6.2.8"],"NIST-CSF":["DE.AE-03"],"SOC2":["CC2.1","CC7.2"],"OWASP-ASI":["ASI03"]}},{"id":"AGT-005","section":"Agent & MCP Governance","requirement":"Provide targeted containment for a single connector or tool.","acceptance":"Disable or revoke one connector, tool, plugin, or integration for a user or group without switching off the whole AI tool.","tier":"AT1, AT2, AT3, AT6","whyItMatters":"When one connector misbehaves, switching off the whole AI tool punishes everyone.","verificationMethod":"LT","verificationTest":"One connector is disabled for one pilot group while the AI tool keeps working.","formerly":null,"alsoIn":["aidr"],"sort":40,"adoptionContext":"The listed agent contexts may share an AI client across multiple connectors, making targeted revocation preferable to disabling the whole tool when feasible.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Disabling an affected connector or revoking its token removes a specific access path and supplies an incident-containment action. It contributes to eradication only where it removes the compromised access mechanism; containment alone does not establish complete eradication or incident response.\nISO/IEC 27001: A.5.26: Integrate containment into the buyer’s incident process. A.5.18: Review effective access and adjust or revoke it where required; cached access and in-flight actions may survive revocation.","kind":"framework","references":{"csf":["RS.MI-01","RS.MI-02"],"soc2":["CC6.3","CC7.4"],"iso27001":["A.5.26","A.5.18"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"A targeted disablement mechanism enables disengagement of an unsafe AI dependency while other functions remain available. It contributes to operational response, but the capability alone does not establish who has authority to invoke it or a complete operational-support process.","kind":"framework","references":{"rmf":["MANAGE 2.4"],"iso":["A.6.2.6"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Isolating a connector, tool or token can interrupt propagation through an agent workflow, matching the isolation and circuit-breaker approach to cascading failures. The scope and timing of disablement determine which downstream actions it can contain.","kind":"framework","references":{"owasp":["ASI08"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-005","frameworkRefs":{"ISO27001":["A.5.26","A.5.18"],"ISO42001":["A.6.2.6"],"NIST-CSF":["RS.MI-01","RS.MI-02"],"NIST-AI-RMF":["MANAGE 2.4"],"SOC2":["CC6.3","CC7.4"],"OWASP-ASI":["ASI08"]}},{"id":"AGT-006","section":"Agent & MCP Governance","requirement":"Discover the MCP servers and connectors employees attach to their AI clients","acceptance":"Inventory local and remote MCP servers reached from desktop, IDE and CLI AI tools with owner, scope and exposure.","tier":"AT3, AT4, AT6","whyItMatters":"MCP-capable clients now ship inside IDEs, terminals and desktop apps, and each connector is a new path to corporate data.","verificationMethod":"LT","verificationTest":"Local and remote MCP servers used by pilot users appear with client, owner, scope and exposure.","formerly":"DIS-007","alsoIn":["spm"],"sort":41,"adoptionContext":"Citizen-built, code-executing and MCP-extended workflows can attach external servers, so connector discovery must reach those integration paths.","mappings":[{"frameworks":["csf","rmf"],"explanation":"The MCP and connector inventory identifies third-party components and services, with owner, scope and exposure to inform supplier prioritization and component-risk mapping. Discovery alone does not assess their risks.","kind":"framework","references":{"csf":["GV.SC-04","ID.AM-04"],"rmf":["MAP 4.1"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"ISO/IEC 42001: The local and remote MCP/connector inventory documents resources relevant to AI activities, including their owner, scope and exposure, supporting A.4.2. External MCP servers and connectors also identify supplier relationships to govern under A.10.3; locally owned servers are not automatically suppliers. Inventory does not establish supplier due diligence or trustworthiness.","kind":"framework","references":{"iso":["A.4.2","A.10.3"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"The inventory exposes external MCP servers and runtime-connected components relevant to agentic supply-chain compromise. It provides a review surface, not evidence that components are trustworthy.","kind":"framework","references":{"owasp":["ASI04"]},"relation":null,"conditions":[]},{"frameworks":["soc2","iso27001"],"explanation":"Owned connector records supply usable inventory/control information and inputs to supplier-risk review. Keeping the register current does not itself approve a connector or reduce its permissions.\nISO/IEC 27001: Maintain usable, owned inventory records. Internally owned servers are not automatically suppliers, and discovery does not assess supplier security.","kind":"framework","references":{"soc2":["CC2.1","CC9.2"],"iso27001":["A.5.9","A.5.19"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-006","frameworkRefs":{"ISO27001":["A.5.9","A.5.19"],"ISO42001":["A.4.2","A.10.3"],"NIST-CSF":["GV.SC-04","ID.AM-04"],"NIST-AI-RMF":["MAP 4.1"],"SOC2":["CC2.1","CC9.2"],"OWASP-ASI":["ASI04"]}},{"id":"AGT-007","section":"Agent & MCP Governance","requirement":"Map the actions available via each connector.","acceptance":"Show, per connector/MCP server, what actions are available and which are currently enabled.","tier":"AT3, AT4, AT6","whyItMatters":"Approving a connector without knowing which actions it exposes and which are enabled leaves the scope of available functionality unclear.","verificationMethod":"W","verificationTest":"For three connectors you name, the console lists the actions each exposes and shows which are currently enabled.","formerly":"DIS-008","alsoIn":["spm"],"sort":42,"adoptionContext":null,"mappings":[{"frameworks":["soc2","iso27001"],"explanation":"An inventory of connector actions and their enabled status supports risk assessment and access-rights review. It provides review inputs; it does not demonstrate effective permissions or their enforcement.","kind":"framework","references":{"soc2":["CC3.2","CC6.3"],"iso27001":["Cl. 6.1.2","A.5.18"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Knowing which actions a connector exposes helps identify risks and control needs associated with third-party components.","kind":"framework","references":{"rmf":["MAP 4.2"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Reviewing available and enabled actions helps identify unnecessarily broad functionality. Assessing identity and privilege abuse also requires evidence about agent identities, credentials and delegated permissions. These mappings concern action visibility and review, not reachable-file discovery or data-flow mapping.","kind":"framework","references":{"owasp":["ASI03"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-007","frameworkRefs":{"ISO27001":["Cl. 6.1.2","A.5.18"],"NIST-AI-RMF":["MAP 4.2"],"SOC2":["CC3.2","CC6.3"],"OWASP-ASI":["ASI03"]}},{"id":"AGT-008","section":"Agent & MCP Governance","requirement":"Support local and remote MCP gateway placement for employee AI clients","acceptance":"Support applicable Windows, macOS and Linux patterns, allow endpoint-integrated or remote placement, and define traffic coverage for each.","tier":"AT3, AT4, AT6","whyItMatters":"Different MCP clients need different gateway placements to be covered.","verificationMethod":"W + D","verificationTest":"The vendor shows local and remote MCP gateway placement and documents what each covers.","formerly":"ARC-005","alsoIn":[],"sort":43,"adoptionContext":"Citizen-built, code-executing and MCP-extended workflows motivate local or remote gateway placement; these contexts do not necessarily involve agent-to-agent communication.","mappings":[{"frameworks":["rmf"],"explanation":"Documented MCP gateway placement identifies where component controls can operate and which traffic they cover. It supplies architecture evidence rather than proof of effective authentication or inspection.","kind":"framework","references":{"rmf":["MAP 4.2"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Operating-system patterns, local or remote gateways and their dependencies provide computing-resource information for AI deployment. Availability of placement options does not establish secure operation.","kind":"framework","references":{"iso":["A.4.5"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"An MCP gateway’s location and coverage can establish an inspection boundary for runtime-fetched servers and other agentic supply-chain components. Placement alone neither assesses their trustworthiness nor prevents malicious components.","kind":"framework","references":{"owasp":["ASI04"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-008","frameworkRefs":{"ISO42001":["A.4.5"],"NIST-AI-RMF":["MAP 4.2"],"OWASP-ASI":["ASI04"]}},{"id":"AGT-009","section":"Agent & MCP Governance","requirement":"Detect indirect prompt injection in content agents read","acceptance":"Identify malicious instructions from the sources that AI systems are able to read from. Name the originating connector or source, respond before the agent acts where configured, and demonstrate tested coverage and known gaps.","tier":"AT3, AT4, AT6","whyItMatters":"A poisoned tool response can turn a trusted agent into an attacker's tool while the user's prompt looks harmless.","verificationMethod":"LT","verificationTest":"Injected instructions in content returned to pilot users' agents are detected and attributed to their source.","formerly":"DAT-014","alsoIn":["aidr"],"sort":44,"adoptionContext":"Indirect injection enters through connected-agent workflows and retrieved content; the listed tiers do not imply identical detection coverage.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Evidence and source attribution for injection, jailbreak and bypass behavior support adverse-event analysis, security monitoring and event triage. Test connector responses, retrieved content and tool outputs even with benign user prompts; prompt injection is not automatically malware, and detection does not guarantee blocking or constitute malware prevention.\nISO/IEC 27001: A.8.16: Demonstrate analysis of anomalous or risky behavior beyond usage collection. Validate surface coverage, known gaps and false positives, with an event-assessment and response process.","kind":"framework","references":{"csf":["DE.AE-02","DE.CM-09"],"soc2":["CC7.2"],"iso27001":["A.8.16","A.5.25"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Detection evidence, originating sources, tested coverage and known gaps support continuing identification of AI risks and operational monitoring. Findings must feed an ongoing tracking and review process; a detector alone does not establish that process.","kind":"framework","references":{"rmf":["MEASURE 3.1"],"iso":["A.6.2.6"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Direct and indirect malicious instructions can hijack agent goals under ASI01. ASI06 applies when content poisons retained or retrievable context; a malicious connector response is not automatically memory poisoning. Detection coverage must be demonstrated, and blocking is not guaranteed.","kind":"framework","references":{"owasp":["ASI01","ASI06"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-009","frameworkRefs":{"ISO27001":["A.8.16","A.5.25"],"ISO42001":["A.6.2.6"],"NIST-CSF":["DE.AE-02","DE.CM-09"],"NIST-AI-RMF":["MEASURE 3.1"],"SOC2":["CC7.2"],"OWASP-ASI":["ASI01","ASI06"]}}]}