How outside checks relate to existing frameworks
Many frameworks already ask for the kind of evidence an outside check produces. This page shows which of their requirements such a check helps an organization meet.
Supporting a provision does not by itself satisfy it. Each framework has requirements that controls of this kind do not address, and nothing on this page determines whether an organization complies. Property numbers refer to the nine properties.
NIST AI Risk Management Framework
NIST AI 100-1, AI RMF 1.0 (January 2023). NIST is revising the framework under the 2025 AI Action Plan, and no draft revision had been published as of 2 November 2026. Subcategory numbers are from version 1.0.
| Subcategory | What it asks | What the layer contributes | Property |
|---|---|---|---|
| GOVERN 1.6 | Mechanisms are in place to inventory AI systems, resourced according to organizational risk priorities. | The register of actions with external effects (clause C-1) extends the inventory to what each system can do. | P9 |
| GOVERN 3.2 | Roles and responsibilities for human-AI configurations and oversight of AI systems are defined and differentiated. | The layer records which people or roles may permit each class of action. | P5 |
| MAP 3.5 | Processes for human oversight are defined, assessed, and documented. | Held actions route to named people, and each oversight decision is recorded. | P5 P7 |
| MEASURE 2.4 | The functionality and behavior of the AI system and its components are monitored in production. | Every proposal and decision is recorded, and sequences of actions are monitored for drift. | P7 P8 |
| MEASURE 2.6 | The system is evaluated for safety risks, shown to be safe, and able to fail safely. | Errors, timeouts, and missing evidence end in denial and a defined safe state. | P3 |
| MEASURE 2.8 | Risks associated with transparency and accountability are examined and documented. | Each decision is bound to the policy version, evidence, and authority behind it. | P4 P7 |
| MANAGE 2.4 | Mechanisms are in place, with responsibilities assigned, to supersede, disengage, or deactivate AI systems whose performance or outcomes are inconsistent with intended use. | Authorized people can stop, revoke, or quarantine at the layer without the AI system’s cooperation. | P5 |
| MANAGE 4.1 | Post-deployment monitoring plans include user input, appeal and override, decommissioning, incident response, recovery, and change management. | Overrides are recorded decisions, records help reconstruct incidents, and policy changes are versioned. | P4 P5 P7 |
| MANAGE 4.3 | Incidents and errors are communicated, and processes for tracking, responding to, and recovering from them are followed and documented. | The linked decision records give an account of the incident that does not depend on the AI system’s own report. | P7 |
The Generative AI Profile (NIST AI 600-1) addresses risks in generated content and complements the layer, which addresses actions.
NIST work on AI agents
CAISI’s AI Agent Standards Initiative (17 February 2026) covers industry-led agent standards, open agent protocols, and research on agent security and identity. The NCCoE concept paper Accelerating the Adoption of Software and AI Agent Identity and Authorization (5 February 2026) examines how existing identity standards apply to agents. An external control layer uses those identity assertions when it checks each action. NIST summarized responses to its January 2026 RFI on agent security in NIST AI 800-5 (18 May 2026).
NIST SP 800-53
NIST SP 800-53 Rev. 5, release 5.2.0 (August 2025). NIST’s planned control overlays for securing AI systems include single-agent and multi-agent overlays. No public draft of the agent overlays had been released as of 2 November 2026.
| Control | Title | What the layer contributes | Property |
|---|---|---|---|
| AC-3 | Access Enforcement | Each action is authorized individually at the point of effect. | P1 |
| AC-3(2) | Access Enforcement | Dual Authorization | Held actions can require the approval of two authorized people, and the record shows both. | P5 P6 |
| AC-5 | Separation of Duties | The system that proposes an action cannot approve it. | P2 P6 |
| AC-6 | Least Privilege | The AI system holds no standing credentials for the point of effect, and a permit covers one action. | P1 |
| AC-25 | Reference Monitor | The layer is a reference monitor for AI actions: always invoked, tamperproof, and small enough to analyze and test. AC-25 is not in the SP 800-53B baselines, so select it through tailoring. | P1 P2 |
| AU-2, AU-3, AU-12 | Event Logging; Content of Audit Records; Audit Record Generation | A record of every decision, with defined content, generated by the layer and not by the AI system. | P7 |
| AU-9, AU-10 | Protection of Audit Information; Non-repudiation | Records are signed and hash-linked with keys the AI system cannot reach. | P6 P7 |
| CM-3 | Configuration Change Control | Policy is versioned, and policy changes are controlled and recorded. | P4 |
| IR-4 | Incident Handling | Quarantine and revocation at the layer, with records to reconstruct what happened. | P5 P7 |
| SC-3 | Security Function Isolation | The layer is isolated from the AI system’s runtime. | P2 |
| SC-7 | Boundary Protection | The point of effect is a managed boundary that accepts calls only from the layer. | P1 |
| SC-24 | Fail in Known State | Failures end in denial and a defined safe state. | P3 |
| SI-4 | System Monitoring | Proposals and decisions are monitored individually and in sequence. | P8 |
| SI-6 | Security and Privacy Function Verification | The layer’s checks are verified in operation, and a failed verification stops the affected actions instead of letting them through. | P3 |
EU AI Act
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. The amending regulation has been in force since 27 July 2026. The Chapter III requirements for high-risk systems, including Articles 12, 14, 15, 19, and 26, apply from 2 December 2027 for Annex III systems and 2 August 2028 for systems covered by Annex I, Section A.
| Article | What it requires | What the layer contributes | Property |
|---|---|---|---|
| Art. 12 | High-risk systems technically allow the automatic recording of events (logs) over their lifetime. | The layer automatically records each decision on an action with external effects. | P7 |
| Art. 14(4)(b) | People assigned to oversight remain aware of the tendency to rely, or over-rely, on the system’s output (automation bias). | Held actions show the reviewer evidence the AI system did not produce, and the records show how often holds are approved unchanged. | P5 P7 |
| Art. 14(4)(d) | People assigned to oversight can decide not to use the system, or can disregard, override, or reverse its output. | Hold and deny decisions made by those people, each recorded. | P5 |
| Art. 14(4)(e) | They can intervene in or interrupt the system through a “stop” button or a similar procedure that lets it come to a halt in a safe state. | A stop control at the layer that works without the AI system’s cooperation, with defined safe states. | P3 P5 |
| Art. 15(4) | Systems are as resilient as possible to errors and faults. Technical redundancy may include backup or fail-safe plans. | A fail-closed layer can form part of a fail-safe plan. | P3 |
| Art. 19, 26(6) | Providers and deployers keep automatically generated logs for at least six months. | Records retained for at least six months, or longer where other law requires. | P7 |
| Art. 26(2) | Deployers assign oversight to people with the necessary competence, training, authority, and support. | The layer’s records name those people and the actions each may permit. | P5 |
| Art. 26(5) | Deployers monitor operation, suspend use where there is a risk, and report serious incidents. | Suspension at the layer by action class, and records that support reporting. | P5 P7 |
| Art. 73 | Serious incidents are reported to market surveillance authorities. | Record chains help reconstruct what happened for the report. | P7 |
These obligations depend on a system’s risk classification, and many agent deployments are not high-risk. Where they do apply, the layer can supply evidence for some of them, mainly records and human oversight.
OMB M-25-21 and M-25-22
Applies to US federal agencies. OMB M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust (3 April 2025), sets minimum risk management practices for high-impact AI. Agencies had until 3 April 2026 to document implementation. If a high-impact use case does not meet the minimum practices, the agency must safely discontinue use of the AI functionality, unless the Chief AI Officer has granted a waiver.
| Requirement | What the layer contributes | Property |
|---|---|---|
| Ongoing monitoring | Every proposal and decision is recorded, and sequences are monitored for drift. | P7 P8 |
| Human oversight, intervention, and accountability, with an appropriate fail-safe where practicable | Holds for designated actions, a stop control, named authorities, and fail-closed behavior. | P3 P5 |
| Timely human review and appeals | Records give a reviewer the decision, the policy, and the evidence behind it. | P7 |
| Safe discontinuation of non-compliant use | Denying an action class at the layer stops that AI function at once without taking down the rest of the system. | P5 |
Footnote 31 of M-25-21 notes that an AI-enabled safety mechanism may need to act immediately to prevent harm, which can make prior human approval impracticable. Agencies must still determine appropriate oversight and accountability. A layer can permit such actions under pre-approved policy and keep a record of each decision. Pre-deployment testing, impact assessment, operator training, and public feedback are outside the layer’s scope.
OMB M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government (3 April 2025), governs how agencies buy AI. The procurement clauses on this site are written for that setting.
ISO/IEC 42001
ISO/IEC 42001:2023, AI management system, first edition. It is a management-system standard, and the layer is one of the technical controls that a conforming organization can adopt. The controls below are from Annex A.
| Control | Title | What the layer contributes | Property |
|---|---|---|---|
| A.3.2 | AI roles and responsibilities | The layer records who may permit what. | P5 |
| A.6.2.5 | AI system deployment | Changes to an AI system’s policy, prompts, and tools pass change control at the layer before they go live. | P4 |
| A.6.2.6 | AI system operation and monitoring | The layer’s decisions and records form part of operation and monitoring. | P7 P8 |
| A.6.2.8 | AI system recording of event logs | A record of each decision on an action with external effects. | P7 |
| A.8.4 | Communication of incidents | Records back up what is communicated about an incident, and when. | P7 |
| A.9.2 | Processes for responsible use of AI systems | Policy defines which actions are permitted, held, or denied. | P4 |
| A.9.4 | Intended use of the AI system | Actions outside the intended use are denied at the layer. | P3 P4 |
| A.10.3 | Suppliers | Suppliers deliver the register, the records, and a verifier. See the procurement clauses. | P7 P9 |
Sector rules
Rules in several sectors already require controls at the point of effect, and the layer extends such controls to actions that an AI system initiates.
| Rule | Provision | What the layer contributes | Property |
|---|---|---|---|
| 21 CFR 11.10 | (d) limit system access to authorized individuals; (e) secure, computer-generated, time-stamped audit trails; (f) operational checks that enforce permitted sequencing; (g) authority checks. | For actions an AI system takes on regulated records, the layer applies authority and sequence checks before the change and records it. | P1 P5 P7 P8 |
| EU GMP Annex 22 (draft) | Generative AI and large language models should not be used in critical GMP applications. In other uses, appropriately qualified personnel are responsible for confirming that outputs are fit for purpose. | Deny LLM-originated actions on critical records, and hold other actions for a recorded decision by qualified personnel. | P4 P5 |
| CMS Medicare Advantage: CMS-4201-F and the FAQ of 6 February 2024 | An algorithm may assist a coverage determination, but may not decide it from a larger data set in place of the individual patient’s history, the physician’s recommendations, or clinical notes, and may not alone end post-acute care or deny an admission. | Hold every model-recommended denial for a clinician reviewer, with the individual record attached as evidence. | P4 P5 |
| California SB 1120 (2024); similar rules in Texas, Maryland, Arizona, Washington, and Iowa | Only a licensed physician or licensed health care professional may deny, delay, or modify care based on medical necessity. | No automated adverse determination: each one is held for a licensed reviewer. | P5 |
| IEC 62443-3-3:2013 | SR 2.1 authorization enforcement; SR 2.8 auditable events; SR 2.12 non-repudiation; SR 3.6 deterministic output; SR 5.2 zone boundary protection; SR 6.2 continuous monitoring. | For AI commanding industrial equipment: per-command authorization, signed records, predetermined output states on failure, and the layer as a zone boundary. | P1 P3 P7 P8 |
| SEC Rule 15c3-5 | Pre-trade controls that reject orders exceeding price or size parameters, under the broker-dealer’s direct and exclusive control. | Where AI agents originate orders, the layer can host those controls, provided they stay under the broker-dealer’s direct and exclusive control. | P1 P2 |
| DoD AI Ethical Principles (2020) | Governable: the ability to detect and avoid unintended consequences, and to disengage or deactivate deployed systems that demonstrate unintended behavior. | Stop, revoke, and quarantine at the layer. | P5 |
Under its 2003 Part 11 scope and application guidance, FDA exercises enforcement discretion on the audit trail requirements of 11.10(e). The record-keeping requirements of the underlying predicate rules still apply. EU GMP Annex 22 is a consultation draft and may change before adoption.
OWASP risk lists
OWASP Top 10 for LLM Applications 2026 (August 2026) and OWASP Top 10 for Agentic Applications for 2026 (December 2025). In the 2026 LLM list, excessive agency moved from LLM06 to LLM03.
| Item | Risk | What the layer contributes | Property |
|---|---|---|---|
| LLM01:2026 | Prompt Injection | Limits what an injected instruction can make the system do. | P1 P4 |
| LLM03:2026 | Excessive Agency | Narrows agency to permitted actions, decided one at a time. | P1 P3 |
| LLM07:2026 | Misinformation | Statements that commit the organization are registered as actions and checked against approved text before they are sent. | P4 P9 |
| ASI01 | Agent Goal Hijack | A hijacked goal still has to pass the layer’s policy before any action goes through. | P1 P4 |
| ASI02 | Tool Misuse and Exploitation | Every tool call that changes something goes through the layer. | P1 |
| ASI03 | Identity and Privilege Abuse | The agent holds no standing credentials for the point of effect, and authority is checked for each action. | P1 P6 |
| ASI08 | Cascading Failures | Fleet-wide quarantine and sequence monitoring. | P5 P8 |
| ASI09 | Human-Agent Trust Exploitation | Approvals are based on evidence the agent did not produce, and each decision is recorded with that evidence. | P5 P6 |
| ASI10 | Rogue Agents | Revocation and quarantine that do not need the agent’s cooperation. | P5 |
The Agent Control Standard, donated to the OWASP GenAI Security Project on 1 September 2026, extends OWASP’s agentic guidance toward runtime enforcement. The specifications page compares it with AARM and NVIDIA OpenShell, gap by gap.