Disciplines
Eight disciplines, 44 named implementations, nine of them Chinese
| Discipline | What it bounds | Attack surface dimension | Failed in registry | Implementations tracked |
|---|---|---|---|---|
| Identity and Cryptographic Attestation | Who or what is acting, proven cryptographically | Identity and authentication | 1 | 7 |
| Behavioral Envelopes | Hard limits on action enforced outside the model | Behavioral and policy boundary | 12 | 7 |
| Access Control and Permissions | What an agent can reach and on whose authority | Integrations and permissions | 7 | 6 |
| Telemetry Integrity | Whether the data feeding an agent has been tampered with | Perception and sensors | 0 | 4 |
| Consent and Capture | What always-on devices record, signal and keep | Data capture and retention | 3 | 5 |
| Monitoring and Anomaly Detection | Seeing failures and misuse while they happen | Multi-agent coordination | 6 | 5 |
| Human Oversight | Human authority to approve, intervene and stop | Command and control channels | 11 | 5 |
| OT and ICS Integration | How agents connect to industrial control systems | Physical access, Connectivity surface | 0 | 5 |
Registry
Behavioral envelopes fail most often in physical agents; access and authorization in software agents
Counts are failed controls recorded in the 137AI Incident Registry. One incident can fail several controls. "Other disciplines" covers supply chain, model safety and alignment, which sit under Risks and Trust.
| Discipline | Physical | Personal and ambient | Software |
|---|---|---|---|
| Identity and attestation | 0 | 0 | 1 |
| Behavioral envelopes | 7 | 2 | 3 |
| Access and authorization | 0 | 0 | 7 |
| Telemetry integrity | 0 | 0 | 0 |
| Consent and capture | 0 | 3 | 0 |
| Monitoring | 2 | 0 | 4 |
| Human oversight | 6 | 1 | 4 |
| OT and ICS integration | 0 | 0 | 0 |
| Other disciplines | 0 | 0 | 5 |
Implementations
Vendors, standards bodies and regulators all ship agent controls now
| Implementation | Control | Vendor or body | Country | What it enforces | Status |
|---|---|---|---|---|---|
| Agent Pay agentic tokens | Identity and attestation | Mastercard | United States | Agents registered before they transact; tokenized credentials | Oct 2025 |
| Agent SSO and Cross App Access | Identity and attestation | Okta | United States | Registers agents in the directory; swaps stored credentials for short-lived tokens | GA Aug 24, 2026 |
| Confidential Computing with remote attestation | Identity and attestation | NVIDIA | United States | Model keys released only after GPU and CPU attestation passes | Jul 2026 |
| Entra Agent ID | Identity and attestation | Microsoft | United States | Own directory identity, lifecycle and Conditional Access for each agent | GA with Agent 365, May 2026 |
| GB/Z 185-2026 agent interconnection series | Identity and attestation | SAMR and SAC | China | Unique hierarchical identity code per agent; issue, suspend and revoke | Published May 22, 2026 (guidance) |
| Model signing v1.0 | Identity and attestation | OpenSSF (Google, NVIDIA, HiddenLayer) | United States | Sigstore signatures for model files of any format | Released Apr 4, 2025 |
| Trusted Agent Protocol | Identity and attestation | Visa with Cloudflare | United States | Signed agent requests (RFC 9421) checked against an agent registry | Launched Oct 14, 2025 |
| ASL-3 classifiers | Behavioral envelopes | Anthropic | United States | Input and output classifiers that block weapons content | Since May 2025; RSP v3 Feb 24, 2026 |
| Bedrock Guardrails | Behavioral envelopes | AWS | United States | Content, topic, sensitive-data and grounding filters on model output | GA |
| Claude Code sandbox | Behavioral envelopes | Anthropic | United States | Writes limited to the working directory; network through an allowlist proxy | Oct 20, 2025 |
| Emergency geofence exit | Behavioral envelopes | California DMV | United States | Fleet leaves an emergency zone within two minutes; responder link answered in 30 seconds | Adopted Apr 28, 2026 |
| Force and pressure limits | Behavioral envelopes | ISO/TS 15066, now within ISO 10218:2025 | International | Contact force limits for 29 body regions | Folded into ISO 10218 in 2025 |
| Level 4 truck ODD conditions | Behavioral envelopes | FMCSA | United States | Validated roads only; no hazmat, passengers or triples; cab beacons | Oct 7, 2026 to Oct 7, 2031 |
| OpenClaw isolation guideline | Behavioral envelopes | CNCERT/CC and CSAC | China | Agents on dedicated devices, VMs or containers; no admin rights | Mar 2026 |
| Agent 365 with Entra Agent ID | Access and authorization | Microsoft | United States | Per-agent identity and access policy across the agent registry | GA May 1, 2026 |
| Copilot coding agent firewall | Access and authorization | GitHub | United States | Default-on outbound allowlist for the agent shell; MCP servers not covered | Current |
| MCP Enterprise-Managed Authorization | Access and authorization | MCP project and Okta | United States | Central authorization of MCP servers with single sign-on | Stable Jun 18, 2026 |
| MCP specification 2026-07-28 | Access and authorization | MCP project (Agentic AI Foundation) | International | Deprecates dynamic client registration; issuer validation; credentials bound to issuer | Released Jul 28, 2026 |
| MCP-scan and Invariant Guardrails | Access and authorization | Invariant Labs | Switzerland | Audits agent-to-MCP traffic; per-session repository limits | May 2025 |
| Practice guide for OpenClaw-class agents | Access and authorization | TC260 | China | Install-to-removal lifecycle controls; governance of shadow agents | Draft Apr 2026 |
| Automated-driving data storage system (GB 44497-2024) | Telemetry integrity | MIIT, SAMR and SAC | China | Mandatory recording of automated-driving operating and event data | Effective Jan 1, 2026 |
| Cybersecurity management system (UN R155) | Telemetry integrity | UNECE WP.29 | International | Fleet attack monitoring across the vehicle lifecycle | All new EU vehicles from Jul 1, 2024 |
| Software update management system (UN R156) | Telemetry integrity | UNECE WP.29 | International | Software IDs and validated, documented updates | Jul 1, 2024 |
| Standing General Order crash reporting | Telemetry integrity | NHTSA | United States | Reports of crashes within 30 seconds of ADS or Level 2 use | Third amendment effective Jun 16, 2025 |
| Echo local processing removed | Consent and capture | Amazon | United States | Control withdrawn: all voice requests now go to the cloud | Mar 28, 2025 |
| Face data filing and on-device storage | Consent and capture | CAC and MPS | China | Separate consent; on-device storage by default; non-face alternative; filing above 100,000 people | Effective Jun 1, 2025 |
| Private Cloud Compute | Consent and capture | Apple | United States | Stateless processing with verifiable transparency; extended to Google Cloud | Expanded Jun 8, 2026 |
| Recall opt-in design | Consent and capture | Microsoft | United States | Off unless chosen; Windows Hello; enclave processing; filters passwords and card numbers | Sep 2024 |
| Recording LED tamper check | Consent and capture | Meta | United States | Camera stops if the LED is covered at any point during recording | Rolling out Aug 28, 2026 |
| Agent 365 observability and Defender mapping | Monitoring | Microsoft | United States | Agent registry, observability, mapping of agents, MCP servers and identities | GA May 1, 2026 |
| GenAI and agent semantic conventions | Monitoring | OpenTelemetry | International | Common trace spans for agent runs and tool calls, MCP included | v1.42.0, still in development |
| Malicious network disruption | Monitoring | OpenAI | United States | 40+ networks disrupted since Feb 2024 | 2026 |
| National incident reporting system | Monitoring | CAC | China | Four incident grades; first report in one, two or four hours by operator type | Effective Nov 1, 2025 |
| Threat intelligence account enforcement | Monitoring | Anthropic | United States | 832 accounts banned for malicious cyber use, mapped to MITRE ATT&CK | Mar 2025 to Mar 2026 |
| Chase-car supervision | Human oversight | Tesla | United States | Trailing vehicles monitor unsupervised robotaxis in Austin | From Jan 22, 2026 |
| Fleet response and Emergency Response Team | Human oversight | Waymo | United States | About 70 remote agents on duty for about 3,000 vehicles; advise, do not drive | Disclosed Mar 2026 |
| Monitoring platform and manual takeover duty | Human oversight | Beijing municipal government | China | Real-time monitoring; safety officer takes over on fault or leaving the permitted area | Effective Apr 1, 2025 |
| Remote operations personnel licensing | Human oversight | California DMV | United States | Licensing and training for remote drivers and assistants | Adopted Apr 28, 2026 |
| Three-tier decision authority | Human oversight | CAC, NDRC and MIIT | China | Routine actions automated; significant ones need approval; hard-to-reverse ones not automated | Effective Jul 15, 2026 |
| CIP-015 internal network security monitoring | OT and ICS integration | NERC and FERC | United States | Monitoring of traffic inside the grid electronic security perimeter | FERC Order 907, Jun 26, 2025 |
| Eigen Engineering Agent | OT and ICS integration | Siemens | Germany | AI agent inside TIA Portal engineering | Hannover Messe 2026 |
| FactoryTalk Conductor | OT and ICS integration | Rockwell Automation | United States | Verified agents and skills; option for locally hosted models | Announced Oct 21, 2026; GA Q1 2027 |
| Principles for the Secure Integration of AI in OT | OT and ICS integration | CISA, NSA, FBI, ASD ACSC, BSI, NCSC and others | International | No AI safety decisions; manual fallback; push-only data export; AI off switch | Dec 3, 2025 |
| TPT model with Inspur appliances | OT and ICS integration | SUPCON and Inspur Information | China | On-premises process-industry AI; no published human-confirmation controls | May 2026 |
Row color shows the agent class served: orange physical, teal personal and ambient, blue software.
Rules
China's agent rules are in force; most EU control duties wait until December 2027
| Rule | Jurisdiction | What it requires | Status |
|---|---|---|---|
| EU AI Act Articles 12, 14, 15, 72 and 73 | EU | Logging, human oversight, robustness, monitoring and incident reports for high-risk systems | Mostly delayed to Dec 2027 |
| China agent Implementation Opinions (CAC, NDRC, MIIT) | China | Agent boundaries, approval tiers, filing, testing and recall | Effective Jul 15, 2026 |
| China national incident reporting measures | China | First report in one to four hours | Effective Nov 1, 2025 |
| California DMV AV regulations | California | Geofence exit, responder link, remote operator licensing | Adopted Apr 28, 2026 |
| NIST CAISI AI Agent Standards Initiative | US | Voluntary agent security and identity standards | Feb 2026 |
| OWASP Top 10 for Agentic Applications | International | Common agent risks and mitigations | Dec 2025 |
Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.
Record
Page Record
- Datasets
- ai_control_implementations.csv (44 rows); ai_incident_controls.csv (45 rows)
- Sources
- Listed on each control page
- Last verified
- October 2026