# AATS v0.9 control catalog

Each `MUST` is independently assessable. The listed evidence is a minimum example, not a requirement to buy a particular product. An assessor tests actual operation as well as policy documents. For every domain, the operator retains dated evidence identifying the system boundary and configuration version.

## AATS-01 — AI System Identity

- **AATS-01.1** Every material AI application and agent MUST have a unique, stable identity bound to organization, owner, operator, version, runtime environment, and provenance; identities MUST not be reused for unrelated deployments.
- **AATS-01.2** Identities MUST support authentication and revocation, and revoked identities MUST be denied at enforcement points within the documented propagation interval.
- **Test/evidence:** Compare deployed inventory with identity registry; inspect provenance and binding records; revoke a test identity and verify denial and propagation time.

## AATS-02 — Human Accountability

- **AATS-02.1** Every autonomous system MUST have a responsible organization, business owner, technical owner, and escalation authority recorded before operation.
- **AATS-02.2** Ownership changes MUST trigger reassignment and review; an agent without a reachable escalation authority MUST be suspended from consequential action.
- **Test/evidence:** Sample inventory-to-owner mappings, on-call route, ownership-change records, and a simulated escalation.

## AATS-03 — Agent Authorization

- **AATS-03.1** Each agent MUST have an explicit, time-bounded authorization describing resources, tools, scopes, action classes, delegated authority, and issuer.
- **AATS-03.2** Enforcement MUST deny absent, expired, revoked, or out-of-scope authority; delegation MUST be no broader than the delegator's effective authority.
- **Test/evidence:** Inspect signed grants and policy decisions; exercise denied resource, expired grant, and over-delegation cases.

## AATS-04 — Least Privilege

- **AATS-04.1** Filesystem, shell, browser, API, SaaS, financial, database, cloud, infrastructure, and physical-device privileges MUST be limited to the authorized task and environment.
- **AATS-04.2** Broad or standing privileged access MUST have documented justification, expiry, compensating monitoring, and approval; unused access MUST be removed during periodic review.
- **Test/evidence:** Compare effective IAM/tool scopes with approved task needs; attempt a disallowed operation; inspect privilege review and expiry logs.

## AATS-05 — Data Privacy

- **AATS-05.1** Each data flow MUST record data class, purpose, lawful/consent basis where applicable, collection, sharing, subprocessor, residency, retention, deletion, encryption, and training-use status.
- **AATS-05.2** Runtime routing and storage MUST enforce declared privacy restrictions; deletion requests MUST reach connected memory, caches, and processors under documented timelines.
- **Test/evidence:** Data map, provider terms, encryption configuration, route-denial test, and sampled deletion trace.

## AATS-06 — AI Data Isolation

- **AATS-06.1** Tenant, user, session, memory, prompt, vector-store, and cache data MUST have enforced access boundaries.
- **AATS-06.2** Operators MUST test cross-boundary retrieval and write paths, including embeddings and fallback caches, before release and after material topology changes.
- **Test/evidence:** Isolation architecture, ACL tests, adversarial cross-tenant probes, and failure/remediation history.

## AATS-07 — Memory Governance

- **AATS-07.1** Persistent and ephemeral memory stores MUST be inventoried with owner, data class, access policy, provenance, expiry, and deletion method.
- **AATS-07.2** Agents MUST not use memory outside its authorized user/tenant/purpose boundary; users MUST receive applicable access and deletion controls.
- **Test/evidence:** Memory inventory, policy configuration, provenance sample, expiry/deletion test, and cross-user denial test.

## AATS-08 — Model Governance

- **AATS-08.1** Operators MUST record active model/provider/version, fallback and routing rules, context limits, fine-tuning lineage, system-prompt version, and policy-layer version for each assessed deployment.
- **AATS-08.2** Model or prompt changes MUST be versioned, evaluated against acceptance criteria, and linked to the resulting deployed configuration.
- **Test/evidence:** Deployment manifests, prompt hashes, evaluation runs, route logs, and change approvals.

## AATS-09 — Provider Governance

- **AATS-09.1** Every inference and external processing provider MUST be authorized for the data class, purpose, retention terms, jurisdiction, and applicable subprocessors.
- **AATS-09.2** The system MUST log which provider processed each request or batch and prevent unauthorized fallback.
- **Test/evidence:** Provider register/agreements, per-request route traces, and simulated failover to an unapproved provider.

## AATS-10 — Model Routing Integrity

- **AATS-10.1** Cost, latency, availability, benchmark ranking, or model preference MUST NOT override data, residency, provider, model, or trust policy.
- **AATS-10.2** Routing decisions MUST record applicable policy and deny reason, including failed fallback attempts.
- **Test/evidence:** Policy precedence configuration and tests that induce cost/latency/failover pressure with protected data.

## AATS-11 — Tool Security

- **AATS-11.1** MCP servers, APIs, browsers, databases, shells, plugins, SaaS connectors, and external services MUST be inventoried with owner, identity, version, capabilities, data access, and trust decision.
- **AATS-11.2** Unverified or changed tools MUST be blocked pending assessment when they add access or action capability; inputs and outputs MUST be treated as untrusted instructions.
- **Test/evidence:** Tool register, integrity/authentication checks, allowlist decisions, and an unauthorized MCP invocation denial.

## AATS-12 — Agent-to-Agent Trust

- **AATS-12.1** Agent peers MUST authenticate mutual identities before delegation or sensitive data exchange.
- **AATS-12.2** Delegated capability MUST carry issuer, audience, scope, expiry, and provenance; receivers MUST reject impersonated, replayed, expired, or over-broad grants.
- **Test/evidence:** Protocol traces and negative tests for spoofing, replay, wrong audience, and excess scope.

## AATS-13 — Agent Containment

- **AATS-13.1** Agents with execution capability MUST run under enforceable filesystem, network, process, credential, and privilege boundaries appropriate to their level.
- **AATS-13.2** Escape and privilege-escalation attempts MUST generate a denial and security event; containment controls MUST remain active across local, edge, delegated, and fallback execution paths.
- **Test/evidence:** Sandbox/policy configuration, boundary tests, denied action logs, and edge/fallback parity test.

## AATS-14 — Prompt / Instruction Security

- **AATS-14.1** Systems MUST separate trusted instructions from untrusted user, retrieval, document, tool, and peer content and MUST prevent lower-trust content from authorizing privileged action.
- **AATS-14.2** Evaluations MUST include direct and indirect injection, tool poisoning, malicious documents, retrieval poisoning, and instruction-hierarchy attacks relevant to the deployment.
- **Test/evidence:** Threat model, test corpus and results, defense configuration, and sampled blocked action trace.

## AATS-15 — Autonomous Action Controls

- **AATS-15.1** Operators MUST classify actions by reversibility and impact, including destructive, administrative, financial, account, deployment, infrastructure, and physical actions.
- **AATS-15.2** Consequential actions MUST be checked against identity, authority, policy, destination, amount/impact threshold, and current trust state before execution; idempotency or rollback MUST be used where feasible.
- **Test/evidence:** Action taxonomy, policy matrix, transaction trace, threshold-denial test, and rollback exercise.

## AATS-16 — Human Oversight

- **AATS-16.1** The operator MUST define which action classes require pre-approval, threshold approval, post-review, or emergency escalation and identify authorized approvers.
- **AATS-16.2** Required approval MUST be bound to the exact action parameters and expire; approval of one action MUST NOT authorize materially different actions.
- **Test/evidence:** Oversight policy, approval records, modified-transaction denial, and escalation exercise.

## AATS-17 — Observability

- **AATS-17.1** Event trails MUST permit reconstruction of agent identity, owner, input reference, accessed resources, tools, policy decisions, permissions, model/provider, resulting action, and outcome, subject to privacy controls.
- **AATS-17.2** Security-relevant events MUST be time-synchronized, integrity protected, and retained for the declared evidence period; hidden reasoning is not required.
- **Test/evidence:** Trace reconstruction of a sampled action, log integrity check, retention policy, and missing-event alert test.

## AATS-18 — Change Management

- **AATS-18.1** Model, provider, prompt, MCP, tool, permission, memory, code, policy, and data-route changes MUST be versioned and classified for trust impact before deployment or immediately on emergency change.
- **AATS-18.2** Material change MUST trigger reassessment and certificate state transition under the assurance rules; undeclared changes MUST be detected.
- **Test/evidence:** Change ledger, configuration diff, approval, reassessment results, and unauthorized-change detection test.

## AATS-19 — Behavioral Assurance

- **AATS-19.1** Operators MUST define measurable checks for unsafe execution, policy adherence, exfiltration, deception indicators, unauthorized action, privilege abuse, and falsely claimed actions.
- **AATS-19.2** Checks MUST run on representative workflows and after material changes; critical failures MUST create incidents and affect trust state.
- **Test/evidence:** Evaluation plan, baselines, sampled test runs, runtime alerts, and linked state transitions.

## AATS-20 — Adversarial Evaluation

- **AATS-20.1** L2–L5 systems MUST receive risk-based automated adversarial tests; L4–L5 MUST also receive independent human red teaming before initial certification and after material expansion.
- **AATS-20.2** Findings MUST have severity, reproducible evidence, owner, remediation, and retest; unresolved critical findings preclude ACTIVE.
- **Test/evidence:** Test plan, tester independence record, findings, remediation tickets, and retest results.

## AATS-21 — Incident Detection

- **AATS-21.1** Operators MUST detect and triage policy violations, anomalous tool use, unauthorized routing, identity misuse, data exfiltration indicators, and containment failures.
- **AATS-21.2** Detection coverage and response latency targets MUST be defined by level; monitoring gaps MUST be surfaced as assurance failures.
- **Test/evidence:** Detection rules, signal coverage map, injected-event test, alert timestamps, and gap reports.

## AATS-22 — Incident Response

- **AATS-22.1** Operators MUST maintain tested procedures for quarantine, agent suspension, credential revocation, kill switch, containment, investigation, and evidence preservation.
- **AATS-22.2** Critical incidents MUST promptly affect certificate state and public status without publishing sensitive incident detail; recovery MUST require documented reassessment.
- **Test/evidence:** Runbooks, tabletop/live exercises, revocation timing, incident timeline, preserved evidence, and reinstatement approval.

## AATS-23 — Supply Chain Trust

- **AATS-23.1** Models, libraries, tools, MCP servers, datasets, external APIs, and plugins MUST have provenance, version, owner, approved source, and vulnerability/risk review.
- **AATS-23.2** Material dependency changes or compromise notices MUST trigger impact analysis, remediation, and certificate change review.
- **Test/evidence:** SBOM/AI component inventory, signed artifacts where available, vulnerability review, and compromise drill.

## AATS-24 — Reliability

- **AATS-24.1** Operators MUST define availability, safe degradation, failover, recovery, and capacity objectives appropriate to impact.
- **AATS-24.2** Safety and authorization policies MUST remain deterministic and fail closed during provider outage, observability loss, or partial control-plane failure for consequential actions.
- **Test/evidence:** SLOs, failover/restore tests, fault injection, and proof that policy-denied actions stay denied during outage.

## AATS-25 — Continuous Assurance

- **AATS-25.1** Operators MUST continuously ingest or promptly receive signals for identities, grants, tools, models/providers, policy, runtime events, incidents, and evidence freshness relevant to the assessed scope.
- **AATS-25.2** The assurance engine MUST apply defined transition precedence, emit explainable state events, and prevent stale or failed critical evidence from leaving a certificate ACTIVE.
- **AATS-25.3** The public verification endpoint MUST expose current state, scope, version, latest verification time, and revocation/expiry status; it MUST not infer ACTIVE from an unreachable monitor.
- **Test/evidence:** Inject unauthorized MCP and stale-evidence events, verify ACTIVE→SUSPENDED/DEGRADED as applicable, inspect signed event and registry update latency.