{
  "name": "Runtime control specifications mapped to the Control Gap Classification",
  "as_of": "2026-09-28",
  "classification_version": "0.2",
  "note": "This is the External Control Layer reference's reading of each document's published text on the date above. It is not a claim made by the projects. Corrections are welcome.",
  "license": "CC-BY-4.0",
  "levels": {
    "addressed": {
      "label": "Addressed",
      "definition": "The document requires or provides a control aimed squarely at the gap."
    },
    "partial": {
      "label": "Partly",
      "definition": "The document covers part of the gap, makes the control optional, or leaves a named part of it open."
    },
    "none": {
      "label": "Not addressed",
      "definition": "The editor found nothing in the document aimed at the gap."
    }
  },
  "specifications": [
    {
      "id": "aarm",
      "name": "AARM",
      "full_name": "Autonomous Action Runtime Management",
      "kind": "System specification",
      "steward": "Cloud Security Alliance technical working group",
      "version": "1.0, February 2026",
      "license": "CC BY 4.0",
      "url": "https://aarm.dev/spec",
      "repository": "https://github.com/aarm-dev/aarm",
      "text_read": "AARM v1.0 as published at aarm.dev/spec, with the paper on arXiv.",
      "maintained_by_this_site": false
    },
    {
      "id": "acs",
      "name": "OWASP ACS",
      "full_name": "Agent Control Standard",
      "kind": "Wire protocol specification",
      "steward": "OWASP GenAI Security Project",
      "version": "0.1.0 (repository release 0.1.2), donated to OWASP in September 2026",
      "license": "Repository release 0.1.2: Apache 2.0 for schemas and code, CC BY-SA 4.0 for prose. Releases up to and including v0.1.0 were published under MIT.",
      "url": "https://github.com/GenAI-Security-Project/agent-control-standard",
      "repository": "https://github.com/GenAI-Security-Project/agent-control-standard",
      "text_read": "The ACS v0.1.0 specification and conformance profiles in the project repository, release 0.1.2.",
      "maintained_by_this_site": false
    },
    {
      "id": "openshell",
      "name": "NVIDIA OpenShell",
      "full_name": "OpenShell and the Open Agent Safety Platform",
      "kind": "Open-source runtime",
      "steward": "NVIDIA, with maintainers from NVIDIA and Red Hat under a published governance model and contributor ladder",
      "version": "0.1, September 2026",
      "license": "Apache 2.0",
      "url": "https://docs.nvidia.com/openshell/latest/index.html",
      "repository": "https://github.com/NVIDIA/OpenShell",
      "text_read": "The OpenShell 0.1 documentation and repository, and NVIDIA's 28 September 2026 announcement of the Open Agent Safety Platform, which adds the Sentry reference design.",
      "maintained_by_this_site": false
    }
  ],
  "not_mapped": [
    {
      "id": "ecl1",
      "name": "ECL-1",
      "reason": "ECL-1 is maintained by G-14, Inc., which also maintains this site. It will be added to this page once someone outside G-14 has done the mapping."
    }
  ],
  "mapping": [
    {
      "gap": "G1",
      "label": "Instruction-only limit",
      "entries_coded": 6,
      "specifications": {
        "aarm": {
          "level": "addressed",
          "refs": "R1, R3",
          "note": "A control plane that sits between the agent and its environment intercepts every action and evaluates it against policy."
        },
        "acs": {
          "level": "addressed",
          "refs": "Guardian; design principle 2",
          "note": "A separate Guardian decides each hooked step, and the agent has no knowledge of the hooks. The agent's framework must wait for the decision and apply it."
        },
        "openshell": {
          "level": "addressed",
          "refs": "Sandbox and supervisor",
          "note": "Kernel controls in the sandbox and a supervisor outside it enforce the policy, whatever the agent has been told."
        }
      }
    },
    {
      "gap": "G2",
      "label": "Direct access",
      "entries_coded": 14,
      "specifications": {
        "aarm": {
          "level": "partial",
          "refs": "R1, R9",
          "note": "No action may bypass the control plane, and R9, which is recommended but not required (a SHOULD), scopes credentials to each action. The spec does not require that the agent hold no credentials, and it notes that SDK instrumentation may miss paths it does not instrument."
        },
        "acs": {
          "level": "partial",
          "refs": "toolCallRequest",
          "note": "The Guardian can deny or modify each tool call, but the agent's framework holds the tools and applies the verdict. Version 0.1 does not require keeping credentials away from the agent, and the project's work on identity lists this as still open."
        },
        "openshell": {
          "level": "addressed",
          "refs": "Providers",
          "note": "Agents never see real credentials. The supervisor adds them only to requests bound for approved endpoints."
        }
      }
    },
    {
      "gap": "G3",
      "label": "Unchecked statement",
      "entries_coded": 5,
      "specifications": {
        "aarm": {
          "level": "none",
          "refs": "Definitions",
          "note": "AARM governs autonomous actions, which it defines as distinct from advisory or informational outputs. A chatbot's answer is outside its scope unless it is sent through a tool."
        },
        "acs": {
          "level": "addressed",
          "refs": "agentResponse",
          "note": "The agentResponse hook sends the agent's output to the Guardian before it reaches the user, and the Guardian can deny or modify it."
        },
        "openshell": {
          "level": "partial",
          "refs": "Supervisor middleware",
          "note": "Middleware that a deployment attaches in policy can inspect, change, or block what an agent sends to an outside service, including content the organization prohibits. It covers only traffic that leaves through the supervisor, and the only built-in middleware is a demonstration redactor."
        }
      }
    },
    {
      "gap": "G4",
      "label": "Boundary not enforced",
      "entries_coded": 9,
      "specifications": {
        "aarm": {
          "level": "partial",
          "refs": "R3, R9",
          "note": "Each action is checked for alignment with the agent's stated intent, and R9 scopes tool access. The spec does not require a written list of the systems and data the agent may act on."
        },
        "acs": {
          "level": "partial",
          "refs": "Intent",
          "note": "If a deployment sets an Intent (a capability list fixed before untrusted data arrives), requests outside it are asked about or denied. Intent is optional in the core."
        },
        "openshell": {
          "level": "addressed",
          "refs": "Policies; policy prover",
          "note": "A policy lists the files, processes, destinations, and API calls an agent may use, and other network egress is denied. The prover can check a policy against a wider boundary."
        }
      }
    },
    {
      "gap": "G5",
      "label": "Blind to the total",
      "entries_coded": 8,
      "specifications": {
        "aarm": {
          "level": "partial",
          "refs": "R2, R7",
          "note": "Policy sees the actions taken so far in the session, and R7, a SHOULD, tracks drift from the stated intent. Limits on volume, rate, or value are not specified, and nothing spans sessions."
        },
        "acs": {
          "level": "partial",
          "refs": "SessionContext",
          "note": "The Guardian keeps a record of the whole session and can decide on what it adds up to. Nothing spans sessions, and no limits on totals are defined."
        },
        "openshell": {
          "level": "partial",
          "refs": "Sentry",
          "note": "OpenShell checks each request against policy on its own. In NVIDIA's reference design, Sentry correlates an agent's interactions and its tool and data access to help identify drift. Neither describes a limit on what an agent's requests add up to."
        }
      }
    },
    {
      "gap": "G6",
      "label": "No independent evidence",
      "entries_coded": 7,
      "specifications": {
        "aarm": {
          "level": "none",
          "refs": "",
          "note": "The spec does not address what evidence an approval is based on."
        },
        "acs": {
          "level": "partial",
          "refs": "ACS-Provenance profile",
          "note": "Field-level provenance, filled in by framework code rather than the model, lets a Guardian tell data the agent generated from data that came from elsewhere. The profile is optional."
        },
        "openshell": {
          "level": "partial",
          "refs": "Policy advisor; policy prover",
          "note": "When an agent asks for new access, the reviewer sees the prover's findings, which the agent did not produce. There is no approval step for actions that policy already allows."
        }
      }
    },
    {
      "gap": "G7",
      "label": "Review in name only",
      "entries_coded": 9,
      "specifications": {
        "aarm": {
          "level": "partial",
          "refs": "R4, STEP_UP",
          "note": "STEP_UP sends an action to a person before it runs. The spec does not say what the person must be shown."
        },
        "acs": {
          "level": "partial",
          "refs": "ASK; approver model",
          "note": "ASK routes a step to an authenticated approver, along with a required question and time limit. The approver may be a person, an agent, or a service. The spec does not say what evidence the approver must be given."
        },
        "openshell": {
          "level": "partial",
          "refs": "Policy advisor",
          "note": "A reviewer sees each proposed rule, the agent's reason, and the results of the risk checks. Automatic approval can be turned on for proposals the checks do not flag."
        }
      }
    },
    {
      "gap": "G8",
      "label": "No human decision",
      "entries_coded": 5,
      "specifications": {
        "aarm": {
          "level": "addressed",
          "refs": "R4, STEP_UP",
          "note": "Policy can require human approval before an action executes."
        },
        "acs": {
          "level": "addressed",
          "refs": "ASK; approver-incapable clients",
          "note": "ASK pauses a step for approval. A client that cannot route an approval must be sent defer or deny instead, so the step is not silently allowed."
        },
        "openshell": {
          "level": "partial",
          "refs": "Policy advisor",
          "note": "New network access waits for review by default. Actions that policy already allows run without one."
        }
      }
    },
    {
      "gap": "G9",
      "label": "Warning with no authority",
      "entries_coded": 9,
      "specifications": {
        "aarm": {
          "level": "partial",
          "refs": "R4, R7, R8",
          "note": "R7 flags drift and R8 exports telemetry. Neither is required to hold the next action, though a policy can defer one."
        },
        "acs": {
          "level": "partial",
          "refs": "SessionContext; DEFER",
          "note": "The Guardian decides each step with the whole session record in view and can deny or defer the next step when it finds trouble. The spec defines no detector of its own, and no way for an alert from outside the hook traffic to hold the next step."
        },
        "openshell": {
          "level": "partial",
          "refs": "Sentry",
          "note": "In NVIDIA's reference design, Sentry, an optional out-of-band watchdog on BlueField-4 hardware, quarantines an agent that tries to move outside its boundary. OpenShell itself describes no monitor whose findings hold the next action."
        }
      }
    },
    {
      "gap": "G10",
      "label": "No independent stop",
      "entries_coded": 3,
      "specifications": {
        "aarm": {
          "level": "partial",
          "refs": "R1",
          "note": "Every action passes the control plane, so it can refuse all of them. The spec sets no requirement for stopping an agent or revoking its access."
        },
        "acs": {
          "level": "partial",
          "refs": "Honoring decisions",
          "note": "A Guardian can deny every step, but ACS defines no stop or revocation. By default, a step proceeds when the Guardian cannot be reached."
        },
        "openshell": {
          "level": "addressed",
          "refs": "Gateway; supervisor; Sentry",
          "note": "Operators can stop a sandbox from the gateway, and the agent is frozen if the supervisor's connection drops. In the reference design, Sentry can quarantine an agent."
        }
      }
    },
    {
      "gap": "G11",
      "label": "Safeguard off",
      "entries_coded": 8,
      "specifications": {
        "aarm": {
          "level": "partial",
          "refs": "R1",
          "note": "No action may bypass the control plane. The spec does not say what happens when the control plane is unavailable or switched off."
        },
        "acs": {
          "level": "partial",
          "refs": "Honoring decisions",
          "note": "By default a step proceeds when the Guardian fails (fail-open), and every such step must be recorded. A deployment can set failure to deny."
        },
        "openshell": {
          "level": "partial",
          "refs": "Supervisor; enforcement modes",
          "note": "The agent does not start until the supervisor confirms the boundary, and it is frozen if the connection drops. Request rules on an inspected endpoint default to audit, which logs a violation and lets the request through. Filesystem rules default to best effort, so a sandbox can run without them after logging a high-severity finding."
        }
      }
    },
    {
      "gap": "G12",
      "label": "Unreviewed change",
      "entries_coded": 8,
      "specifications": {
        "aarm": {
          "level": "none",
          "refs": "",
          "note": "The spec does not address review of changes to the agent, its tools, or its policies. Receipts record the policy context of each decision."
        },
        "acs": {
          "level": "partial",
          "refs": "ACS-Inspect profiles; skill hooks",
          "note": "An inventory of the agent's models, tools, and servers, with events when one changes mid-session, lets a Guardian see a change and refuse it. A skill the Guardian denies cannot load. Review of changes to prompts or code is outside the spec."
        },
        "openshell": {
          "level": "partial",
          "refs": "Policy prover; policy advisor",
          "note": "Network rules an agent proposes are checked by formal verification and wait for review by default, and an operator can check a whole policy against a boundary with the prover. An operator's own policy changes apply without an automatic check, and changes to the agent itself are outside its scope."
        }
      }
    },
    {
      "gap": "G13",
      "label": "Self-reported record",
      "entries_coded": 2,
      "specifications": {
        "aarm": {
          "level": "addressed",
          "refs": "R5, R6",
          "note": "Every evaluated action produces a tamper-evident receipt, cryptographically bound to the agent's identity."
        },
        "acs": {
          "level": "addressed",
          "refs": "Chain head publication; ACS-Audit and ACS-Crypto profiles",
          "note": "The Guardian publishes the signed head of a hash-chained session record with each decision. Proof against a compromised Guardian needs the optional Crypto profile."
        },
        "openshell": {
          "level": "partial",
          "refs": "Logging",
          "note": "Network allows and denies, process events, and policy changes are recorded as structured OCSF events. The documentation does not describe tamper evidence. In the reference design, Sentry adds attested telemetry."
        }
      }
    }
  ]
}