Least privilege
When an agent needs a small subset of a service’s capabilities.
- Expected behavior
- Provide only the tools, resources, and credential scope needed for the task.
- Prepare
- List allowed operations and destinations. Test refusal outside the intended scope.
Receipt before action
When a specific tool call must be authorized at the point of execution.
- Expected behavior
- Use a governed executor that verifies the receipt against the exact call and configured trust.
- Prepare
- Configure identity, actor/action/argument binding, signatures, and consumption where required.
Fail closed
When uncertainty about a required governance check must stop execution.
- Expected behavior
- Refuse the governed action when a required decision, verification, or evidence step fails.
- Prepare
- Define failure conditions, permitted retries, observability, and a recovery path.
Reversible changes
When a change can be staged before it becomes difficult to undo.
- Expected behavior
- Prefer drafts, isolated branches, checkpoints, and bounded intermediate changes.
- Prepare
- Inspect the difference, retain recoverable state, and verify the rollback procedure.
Separate review
When self-approval would weaken the decision boundary.
- Expected behavior
- Assign proposing, reviewing, and executing to explicit roles with separate responsibilities.
- Prepare
- Define who may act in each role and how identity is authenticated outside the library.
Audit logging
When a reviewer needs to reconstruct a consequential decision later.
- Expected behavior
- Record the request context, policy version, decision, and execution evidence appropriate to the task.
- Prepare
- Configure full audit mode, storage, access, retention, and independent anchoring as needed.
Task-local context
When sensitive information should remain within one task or tenant.
- Expected behavior
- Keep only authorized context in the task and define what may be retained or shared.
- Prepare
- Set context boundaries, expiration, export permissions, and a reset procedure.
Credential isolation
When a tool requires secrets that should not enter ordinary agent context.
- Expected behavior
- Keep key custody and scoped credential delivery in an explicit infrastructure layer.
- Prepare
- Choose the credential owner, approved destinations, lifetime, logging redaction, and rotation path.
Simulate before execution
When the planned action can be inspected using a fixture, plan, or dry run.
- Expected behavior
- Evaluate representative inputs before giving the workflow operational access.
- Prepare
- State what the simulation covers, what it cannot show, and which live checks remain.
Verify before claims
When reporting completion, performance, deployment, or assurance status.
- Expected behavior
- Attach the actual artifact and method to the claim, with a date and explicit scope.
- Prepare
- Separate proposed, attempted, completed, tested, and independently assured outcomes.