Try Replit, G7, refund, approval, or EU AI Act. Use the arrow keys to move and Enter to open.
Runtime control specifications, mapped to the gaps
Several groups have written specifications, or built software, for checking an AI agent’s actions before they happen. This page maps three published specifications to the 13 gaps in the record, showing which gaps each leaves open and what happened in the incidents involving those gaps. ECL-1, which G-14 maintains, is described but not mapped.
Mapping as of 28 September 2026. The editor made this comparison from each document’s published text. The projects themselves have not made these claims. Propose a correction
The specifications
The specifications work at different layers and can be combined. AARM specifies what a runtime security system must do to control an agent’s actions. OWASP’s Agent Control Standard defines the messages between an agent and a separate component that decides on its steps. OpenShell is software that confines an agent and checks what leaves it. A fourth, ECL-1, is described here but not mapped, because it is maintained by G-14, which also maintains this site, and no one outside G-14 has mapped it yet.
System specification
AARM Autonomous Action Runtime Management
Defines the capabilities a runtime security system for AI agents must have, and leaves the implementation open. A control plane intercepts every action an agent initiates and evaluates it against policy and the agent’s stated intent. It then makes a decision and records a tamper-evident receipt. The spec has nine requirements, six of them mandatory, and 11 threat classes.
Steward
Cloud Security Alliance technical working group
Version
1.0, February 2026
License
CC BY 4.0
Take part
Join the Cloud Security Alliance working group, or open issues on GitHub.
Defines the messages between an agent and a separate Guardian agent that inspects each step and allows, denies, or changes it before it happens. A mandatory core covers the handshake, the hook points, five decision types, a hash-chained session record, and signatures. Optional profiles add telemetry, a component inventory, data provenance, stronger signatures, and a stronger audit chain.
Steward
OWASP GenAI Security Project
Version
0.1.0 (repository release 0.1.2), donated to OWASP in September 2026
License
Repository release 0.1.2: Apache 2.0 for schemas and code, CC BY-SA 4.0 for prose. Releases up to and including v0.1.0 were published under MIT.
Take part
Open issues and pull requests in the project repository.
NVIDIA OpenShell OpenShell and the Open Agent Safety Platform
An open-source implementation. Each agent runs in a sandbox where kernel controls limit the files and system calls it can use. The sandbox’s only network path is a supervisor that checks each connection against a declared policy and supplies credentials only to approved destinations. Network rules an agent proposes are checked by formal verification and, by default, wait for review. The platform’s Sentry reference design adds an optional out-of-band watchdog on BlueField-4 hardware.
Steward
NVIDIA, with maintainers from NVIDIA and Red Hat under a published governance model and contributor ladder
Version
0.1, September 2026
License
Apache 2.0
Take part
GitHub issues and discussions, and the project’s RFC board.
A runtime control standard for AI actions that have effects in the world. It says what an operating environment must provide so those actions can be controlled from outside the model, and what a conformance claim must state about its boundary.
Steward
G-14, Inc., which maintains it with an open working group and also maintains this site
Version
1.0, Publication date to be announced
License
CC BY 4.0 for the text, and Apache-2.0 for schemas, registries, tests, and code, with a royalty-free pledge not to assert essential patent claims against conforming implementations.
Take part
Join the ECL-1 Working Group, free to anyone, or raise issues and pull requests in the repository. Each new version has a public review.
Not mapped on this page.ECL-1 is maintained by G-14, Inc., which also maintains this site. It will be added to this page once someone outside G-14 has done the mapping. See the governance rule on mapping ECL-1.
A gap addressed in a document is not necessarily controlled in a running system, and the three are at different stages. AARM is a published version 1.0 with a conformance review. The Agent Control Standard is at version 0.1, with conformance self-declared for now. OpenShell is software in use.
A control plane between the agent and the environments it can affect. The spec recognizes four architectures: a protocol gateway, SDK instrumentation, kernel eBPF hooks, and interception built into the vendor’s platform.
A separate Guardian decides. The agent’s own framework sends each hooked step to it, waits for the decision, and applies it.
Kernel controls inside the sandbox, and a supervisor outside it that every network request must pass.
Decisions
Allow, deny, modify, step up to a person, or defer.
Allow, deny, modify, ask, or defer.
Allow or deny each network connection and request, with optional middleware that can also change a request or response. File and process limits are fixed when the sandbox starts. New network access is proposed and approved.
Human approval
STEP_UP requires human approval before the action runs.
ASK pauses a step for an authenticated approver, who may be a person, an agent, or a service.
By default, proposed new network access waits for review by a person or, as NVIDIA describes it, by an AI agent approver. Automatic approval of proposals that pass the risk checks is optional.
If the check fails
Not stated. The spec says no action may bypass the control plane.
Proceeds by default (fail-open) when the Guardian fails to answer, and records each such step. A deployment can set failure to deny.
Fails closed at the boundary: the agent does not start until the supervisor confirms it, and it is frozen if the connection drops. Request rules on inspected endpoints default to audit mode, which logs violations without blocking them. Filesystem rules default to best effort.
Record of decisions
A tamper-evident receipt for every evaluated action, bound to the agent’s identity.
A hash-chained session record. The Guardian publishes its signed head with each decision. Optional profiles add request hashes and asymmetric signatures.
Network and HTTP allows and denies, process events, and policy changes, recorded as structured OCSF events.
Conformance
Two levels, Core (R1 to R6) and Extended (R1 to R9). Claims need an evidence package reviewed by the working group. On 28 September 2026 its registry listed 108 companies building on AARM, 9 of them with a completed conformance review.
Self-declared in version 0.1. The project states that it ships no conformance test suite, no registry of conformant implementations, and no steward body to settle a disputed claim yet.
None. OpenShell is an implementation rather than a specification.
Mapped to the 13 gaps
Each row is one gap from the classification, with the number of incidents in the record in which it was found. Select a mark to read what the document says about that gap.
AddressedThe document requires or provides a control aimed squarely at the gap.
PartlyThe document covers part of the gap, makes the control optional, or leaves a named part of it open.
Not addressedThe editor found nothing in the document aimed at the gap.
Each gap, and how far each specification addresses it
Only OpenShell fully addresses direct access (G2), which was found in all 13 agent incidents in the record. In each, the agent held the credentials or connection to act on its own. OpenShell keeps credentials out of the sandbox and adds them only to requests bound for approved endpoints. AARM requires each action to pass through its control plane, and the Agent Control Standard requires the agent’s framework to wait for the Guardian’s decision. Neither requires that the agent hold no credentials of its own.
The specifications differ most in what happens when the check fails. OpenShell will not start an agent until its supervisor confirms the boundary, and it freezes the agent if the connection drops. Its request rules, however, default to audit mode, which logs a violation and lets the request through, and its filesystem rules default to best effort. The Agent Control Standard proceeds by default when its Guardian cannot answer, and records each step that went ahead, so that an outage does not halt production. AARM says no action may bypass the control plane but does not say what happens when the plane is down. None of the three fully addresses a safeguard that is off or not working (G11), a gap found in eight incidents in the record, including six of the 13 agent incidents.
Six gaps (G5, G6, G7, G9, G11, and G12) are not fully addressed by any of the three. Together they appear in 24 of the 32 incidents in the record. Many of those incidents involve predictive models, generative models in workflows, vehicles, and conventional automation, for which these specifications were not written.
Among the 13 agent incidents, the open gaps found most often are safeguards that were off (G11, in six), changes that went live without review (G12, in four), and totals nobody tracked (G5, in four). In the four agent incidents with G12, malicious code went into a coding assistant’s release automatically; a malicious version of a tool that let agents send email arrived as an ordinary update; test environments were put into use without a check that they were sealed; and a judgment about open internet access was not revisited as models grew more capable. In the four agent incidents with G5, the harm, or in one case the near miss, came from the combined effect of many actions.
What the actions add up to (G5)
AARM and the Agent Control Standard give the policy a view of the whole session, and in NVIDIA’s reference design Sentry correlates an agent’s activity to help identify drift. None sets limits on volume, rate, or value, and AARM and the Agent Control Standard look only within a session. In the Hugging Face incident, agents in separate runs pooled their work through a shared message board.
The evidence behind an approval (G6)
The Agent Control Standard can mark which data the agent generated, and OpenShell shows a reviewer the findings of a formal check the agent did not produce. None says that an approval must be based on evidence from outside the system.
What a reviewer sees (G7)
AARM’s STEP_UP and the Agent Control Standard’s ASK send a step to an approver, and OpenShell sends proposed new network access to one. OpenShell shows the reviewer the proposed rule, the agent’s reason, and the results of its risk checks, and the Agent Control Standard requires a question and a time limit. None says what evidence the approver must have to judge the step, and in both the Agent Control Standard and OpenShell the approver can be an agent rather than a person.
What holds the next action (G9)
AARM and the Agent Control Standard let the policy defer or deny the next step, AARM’s R7 flags drift, and NVIDIA’s optional Sentry quarantines an agent that leaves its boundary. None requires that a detection hold the next action.
Review of changes (G12)
OpenShell checks network rules an agent proposes with formal verification before they apply, and the Agent Control Standard lets a Guardian see, and refuse, a new or changed model, tool, server, or skill. None covers review of changes to the agent’s prompts or code.
Gap by gap
Each gap is shown with its question from the classification, what each document provides, and a reference to the part of the document consulted.
The question: If the AI ignored every instruction it had been given, what would stop this action?
AARM
AddressedR1, R3
A control plane that sits between the agent and its environment intercepts every action and evaluates it against policy.
OWASP ACS
AddressedGuardian; design principle 2
A separate Guardian decides each hooked step, and the agent has no knowledge of the hooks. The agent’s framework must wait for the decision and apply it.
NVIDIA OpenShell
AddressedSandbox and supervisor
Kernel controls in the sandbox and a supervisor outside it enforce the policy, whatever the agent has been told.
The question: Which credentials, sessions, or connections does the AI hold that reach records, money, messages, or equipment without passing a check it does not control?
AARM
PartlyR1, R9
No action may bypass the control plane, and R9, which is recommended but not required (a SHOULD), scopes credentials to each action. The spec does not require that the agent hold no credentials, and it notes that SDK instrumentation may miss paths it does not instrument.
OWASP ACS
PartlytoolCallRequest
The Guardian can deny or modify each tool call, but the agent’s framework holds the tools and applies the verdict. Version 0.1 does not require keeping credentials away from the agent, and the project’s work on identity lists this as still open.
NVIDIA OpenShell
AddressedProviders
Agents never see real credentials. The supervisor adds them only to requests bound for approved endpoints.
The question: What does this system say that a customer, a court, or the public could hold you to, and what checks it before it is sent?
AARM
Not addressedDefinitions
AARM governs autonomous actions, which it defines as distinct from advisory or informational outputs. A chatbot’s answer is outside its scope unless it is sent through a tool.
OWASP ACS
AddressedagentResponse
The agentResponse hook sends the agent’s output to the Guardian before it reaches the user, and the Guardian can deny or modify it.
NVIDIA OpenShell
PartlySupervisor middleware
Middleware that a deployment attaches in policy can inspect, change, or block what an agent sends to an outside service, including content the organization prohibits. It covers only traffic that leaves through the supervisor, and the only built-in middleware is a demonstration redactor.
The question: What stops this system from acting on data, systems, or conditions outside the ones it was approved for?
AARM
PartlyR3, R9
Each action is checked for alignment with the agent’s stated intent, and R9 scopes tool access. The spec does not require a written list of the systems and data the agent may act on.
OWASP ACS
PartlyIntent
If a deployment sets an Intent (a capability list fixed before untrusted data arrives), requests outside it are asked about or denied. Intent is optional in the core.
NVIDIA OpenShell
AddressedPolicies; policy prover
A policy lists the files, processes, destinations, and API calls an agent may use, and other network egress is denied. The prover can check a policy against a wider boundary.
The question: What is the most this system could do in an hour if each action passed its checks?
AARM
PartlyR2, R7
Policy sees the actions taken so far in the session, and R7, a SHOULD, tracks drift from the stated intent. Limits on volume, rate, or value are not specified, and nothing spans sessions.
OWASP ACS
PartlySessionContext
The Guardian keeps a record of the whole session and can decide on what it adds up to. Nothing spans sessions, and no limits on totals are defined.
NVIDIA OpenShell
PartlySentry
OpenShell checks each request against policy on its own. In NVIDIA’s reference design, Sentry correlates an agent’s interactions and its tool and data access to help identify drift. Neither describes a limit on what an agent’s requests add up to.
The question: When this system’s output is approved, what evidence does the approver have that did not come from the system?
AARM
Not addressed
The spec does not address what evidence an approval is based on.
OWASP ACS
PartlyACS-Provenance profile
Field-level provenance, filled in by framework code rather than the model, lets a Guardian tell data the agent generated from data that came from elsewhere. The profile is optional.
NVIDIA OpenShell
PartlyPolicy advisor; policy prover
When an agent asks for new access, the reviewer sees the prover’s findings, which the agent did not produce. There is no approval step for actions that policy already allows.
The question: For each approval step, what does the approver see, how long do they have, and how often do they say no?
AARM
PartlyR4, STEP_UP
STEP_UP sends an action to a person before it runs. The spec does not say what the person must be shown.
OWASP ACS
PartlyASK; approver model
ASK routes a step to an authenticated approver, along with a required question and time limit. The approver may be a person, an agent, or a service. The spec does not say what evidence the approver must be given.
NVIDIA OpenShell
PartlyPolicy advisor
A reviewer sees each proposed rule, the agent’s reason, and the results of the risk checks. Automatic approval can be turned on for proposals the checks do not flag.
The question: When this system’s own monitoring detects trouble, what holds the next action automatically?
AARM
PartlyR4, R7, R8
R7 flags drift and R8 exports telemetry. Neither is required to hold the next action, though a policy can defer one.
OWASP ACS
PartlySessionContext; DEFER
The Guardian decides each step with the whole session record in view and can deny or defer the next step when it finds trouble. The spec defines no detector of its own, and no way for an alert from outside the hook traffic to hold the next step.
NVIDIA OpenShell
PartlySentry
In NVIDIA’s reference design, Sentry, an optional out-of-band watchdog on BlueField-4 hardware, quarantines an agent that tries to move outside its boundary. OpenShell itself describes no monitor whose findings hold the next action.
The question: If this system stopped responding to you, how would you stop it, and how long would that take?
AARM
PartlyR1
Every action passes the control plane, so it can refuse all of them. The spec sets no requirement for stopping an agent or revoking its access.
OWASP ACS
PartlyHonoring decisions
A Guardian can deny every step, but ACS defines no stop or revocation. By default, a step proceeds when the Guardian cannot be reached.
NVIDIA OpenShell
AddressedGateway; supervisor; Sentry
Operators can stop a sandbox from the gateway, and the agent is frozen if the supervisor’s connection drops. In the reference design, Sentry can quarantine an agent.
The question: Which of this system’s safeguards can be switched off, set to approve automatically, or stop working without anyone noticing?
AARM
PartlyR1
No action may bypass the control plane. The spec does not say what happens when the control plane is unavailable or switched off.
OWASP ACS
PartlyHonoring decisions
By default a step proceeds when the Guardian fails (fail-open), and every such step must be recorded. A deployment can set failure to deny.
NVIDIA OpenShell
PartlySupervisor; enforcement modes
The agent does not start until the supervisor confirms the boundary, and it is frozen if the connection drops. Request rules on an inspected endpoint default to audit, which logs a violation and lets the request through. Filesystem rules default to best effort, so a sandbox can run without them after logging a high-severity finding.
The question: Who reviews a change to this system’s prompts, tools, models, and dependencies before it goes live, and where is that review recorded?
AARM
Not addressed
The spec does not address review of changes to the agent, its tools, or its policies. Receipts record the policy context of each decision.
OWASP ACS
PartlyACS-Inspect profiles; skill hooks
An inventory of the agent’s models, tools, and servers, with events when one changes mid-session, lets a Guardian see a change and refuse it. A skill the Guardian denies cannot load. Review of changes to prompts or code is outside the spec.
NVIDIA OpenShell
PartlyPolicy prover; policy advisor
Network rules an agent proposes are checked by formal verification and wait for review by default, and an operator can check a whole policy against a boundary with the prover. An operator’s own policy changes apply without an automatic check, and changes to the agent itself are outside its scope.
The question: If this system’s own logs and reports were wrong, what independent record would show what it did?
AARM
AddressedR5, R6
Every evaluated action produces a tamper-evident receipt, cryptographically bound to the agent’s identity.
OWASP ACS
AddressedChain head publication; ACS-Audit and ACS-Crypto profiles
The Guardian publishes the signed head of a hash-chained session record with each decision. Proof against a compromised Guardian needs the optional Crypto profile.
NVIDIA OpenShell
PartlyLogging
Network allows and denies, process events, and policy changes are recorded as structured OCSF events. The documentation does not describe tamper evidence. In the reference design, Sentry adds attested telemetry.
Using the mapping
Building a control
Use the self-check to find the gaps your system is most exposed to, and then use the rows above to see which document gives requirements for each of them. Where a row says Partly or Not addressed, the classification and the architecture page describe what a control for that gap has to do.
Buying a control
Ask a vendor which of these documents it implements and at what level, and how it closes the gaps that the document leaves open. The procurement page has model contract clauses, and the classification lists the clauses that apply to each gap.
Writing a specification
Each gap links to the incidents in which it was found, with the evidence for each finding. If a row understates or overstates what your document covers, propose a correction.
Related work
Risk frameworks and regulations, such as the NIST AI Risk Management Framework, the EU AI Act, and ISO/IEC 42001, set duties for organizations rather than runtime requirements for a system. They are mapped to the gaps on the frameworks page. Protocols for particular kinds of action are also relevant to the gaps. Google’s Agent Payments Protocol, now at the FIDO Alliance, records a user’s authorization for a purchase in signed mandates, as described in the purchasing case study.
Propose a correction
If you work on one of these projects, or read a requirement differently, tell us which cell you would change and where the text says so. We answer each correction request in writing. Corrections go into the next update and are noted in the change log. If you maintain a specification whose full text is public and belongs on this page, send it, and we will map it the same way.
Email ecl@g14.ai with “ECL mapping” in the subject line.