AICM: agent controls with the CSA Agentic Trust Framework and AARM specification

Agent-specific AICM controls (e.g. IAM-18 Agent Access Restriction, AIS-11 Agents Security Boundaries), with the Agentic Trust Framework v1 (earned autonomy tiers) and the AARM runtime-interception specification

By Jorge García Aibar Reviewed 2026-09-24

From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-CSA-AICM-AGENTIC. Drawn from chapter 08.

Text alternative

Clause: CSA AICM, Agent controls.
Duty holder: Not stated.
Applies from: No date, Voluntary.
Artefact: Agent-specific control definitions.
Layers: Layer 01, Layer 04.
Evidence record: Evidence record v1.
Record schema: Evidence record.
No crosswalk topic files this clause yet.

Id: AIGE-OBL-CSA-AICM-AGENTIC
Instrument: CSA AI Controls Matrix (AICM) v1.1 controls
Clause: Agent controls (AICM v1.1, ATF, AARM)
Applies from: No date Voluntary · AICM v1.1 published 2026-06-22, Agentic Trust Framework v1 in February 2026; the "Agentic Control Supplement" of earlier editions could not be matched to a CSA primary document as of 2026-09-24 (to be confirmed)

The artefact that evidences it

Agent-specific control definitions; policy-as-code for agent scope and tools; runtime guardrails.

What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.

Data table: every relation

Relations of AIGE-OBL-CSA-AICM-AGENTIC
Family	Item	Relation
Open controls	AIGE-CTL-AGENT-025 Accountability across hops	Direct
Open controls	AIGE-CTL-EVAL-001 Authorization Boundary	Direct
Open controls	AIGE-CTL-AGENT-015 Checkpoints on irreversible actions, failing closed	Direct
Open controls	AIGE-CTL-AGENT-022 Delegation, never impersonation	Direct
Open controls	AIGE-CTL-AGENT-002 Its own identity	Direct
Open controls	AIGE-CTL-AGENT-020 MCP authorisation (spec 2026-07-28)	Direct
Open controls	AIGE-CTL-AGENT-017 Output and egress filter	Direct
Open controls	AIGE-CTL-AGENT-021 Replace long-lived secrets with short-lived credentials	Direct
Open controls	AIGE-CTL-AGENT-039 Restrictions tested by attempting what is denied	Direct
Open controls	AIGE-CTL-AGENT-007 Runtime guardrail on every tool call	Direct
Open controls	AIGE-CTL-AGENT-026 Stopping third-party agents at your boundary	Direct
Open controls	AIGE-CTL-AGENT-037 The person types the secrets	Direct
Open controls	AIGE-CTL-AGENT-005 Tool allow-list, deny by default	Direct
Open controls	AIGE-CTL-AGENT-036 Typed messages and limited shared memory between agents	Direct

Patterns that build it

No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

AIGE-CTL-EVAL-001 Authorization Boundary (Evaluation environment profile)
AIGE-CTL-AGENT-002 Its own identity (Agent runtime profile)
AIGE-CTL-AGENT-005 Tool allow-list, deny by default (Agent runtime profile)
AIGE-CTL-AGENT-007 Runtime guardrail on every tool call (Agent runtime profile)
AIGE-CTL-AGENT-015 Checkpoints on irreversible actions, failing closed (Agent runtime profile)
AIGE-CTL-AGENT-017 Output and egress filter (Agent runtime profile)
AIGE-CTL-AGENT-020 MCP authorisation (spec 2026-07-28) (Agent runtime profile)
AIGE-CTL-AGENT-021 Replace long-lived secrets with short-lived credentials (Agent runtime profile)
AIGE-CTL-AGENT-022 Delegation, never impersonation (Agent runtime profile)
AIGE-CTL-AGENT-025 Accountability across hops (Agent runtime profile)
AIGE-CTL-AGENT-026 Stopping third-party agents at your boundary (Agent runtime profile)
AIGE-CTL-AGENT-036 Typed messages and limited shared memory between agents (Agent runtime profile)
AIGE-CTL-AGENT-037 The person types the secrets (Agent runtime profile)
AIGE-CTL-AGENT-039 Restrictions tested by attempting what is denied (Agent runtime profile)

Source

Chapter 08, section CSA AICM and STAR for AI, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-csa-aicm-agentic.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). AICM: agent controls with the CSA Agentic Trust Framework and AARM specification (AIGE-OBL-CSA-AICM-AGENTIC). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm-agentic. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{AICM: agent controls with the CSA Agentic Trust Framework and AARM specification (AIGE-OBL-CSA-AICM-AGENTIC)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm-agentic},
  note         = {Version 0.5.0}
}