Elements & requirements
ATF contains five elements with five canonical requirements in each. Assess the requirement itself, then use the target-level matrix to determine whether it is a MUST, SHOULD or MAY for the selected agent.
Identity
Section titled “Identity”| ID | Requirement | Assessor focus |
|---|---|---|
| ATF-I-1 | Unique Identifier | A globally unique, immutable identifier distinguishes each agent instance and persists through logs and decisions |
| ATF-I-2 | Credential Binding | The agent identity is bound to suitable credentials and credential lifecycle controls |
| ATF-I-3 | Ownership Chain | Human and organisational ownership, operational responsibility and escalation are documented |
| ATF-I-4 | Purpose Declaration | Intended purpose, operating scope, prohibited uses and boundary are explicit |
| ATF-I-5 | Capability Manifest | Tools, systems, actions, approvals, limits and known constraints are machine-readable and current |
Inspect the identity from registration through every downstream action. An identifier in one user interface is insufficient if tool calls or asynchronous jobs lose attribution.
Behavior
Section titled “Behavior”| ID | Requirement | Assessor focus |
|---|---|---|
| ATF-B-1 | Structured Logging | Material prompts, approvals, tool calls, actions, outputs and failures are machine-parseable |
| ATF-B-2 | Action Attribution | Each action retains agent, session, initiator, approval and target context |
| ATF-B-3 | Behavioral Baseline | Normal activity is established by agent, workload and environment |
| ATF-B-4 | Anomaly Detection | Deviations, abuse and drift create timely, actionable detection |
| ATF-B-5 | Explainability | Governance-grade rationale and execution context are retrievable without exposing unnecessary sensitive content |
Do not confuse a log volume with useful observability. Reconstruct a representative transaction end-to-end and verify that responders can distinguish authorised variation from anomalous behaviour.
Data Governance
Section titled “Data Governance”| ID | Requirement | Assessor focus |
|---|---|---|
| ATF-D-1 | Schema Validation | Inputs and tool responses are validated at each trust boundary |
| ATF-D-2 | Injection Prevention | Prompts, retrieved content, attachments and tool responses are treated as untrusted and defended in depth |
| ATF-D-3 | PII/PHI Protection | Sensitive data and secrets are detected and handled according to policy |
| ATF-D-4 | Output Validation | Natural-language output, structured output and tool arguments are checked before release or execution |
| ATF-D-5 | Data Lineage | Sources, transformations, retrievals and destinations are traceable |
Test the complete data path. A front-door check does not cover data introduced by retrieval, plugins, tools, agents, queues or downstream services.
Segmentation
Section titled “Segmentation”| ID | Requirement | Assessor focus |
|---|---|---|
| ATF-S-1 | Resource Allowlist | Permitted systems, tools, APIs, datasets and destinations are explicit and enforced |
| ATF-S-2 | Action Boundaries | Read, write, send, delete, execute and administrative actions are independently constrained |
| ATF-S-3 | Rate Limiting | Frequency limits exist for ordinary and high-impact operations |
| ATF-S-4 | Transaction Limits | A single action cannot exceed approved value, volume or impact |
| ATF-S-5 | Blast Radius Containment | Cumulative and cascading impact is constrained across time, systems and tenants |
Test both one large action and many individually acceptable actions. Per-transaction limits do not prevent cumulative harm.
Incident Response
Section titled “Incident Response”| ID | Requirement | Assessor focus |
|---|---|---|
| ATF-R-1 | Circuit Breaker | Defined unsafe or repeated-failure conditions actually stop or pause operation |
| ATF-R-2 | Kill Switch | Authorised responders can terminate active execution rapidly through tested primary and fallback paths |
| ATF-R-3 | Session Revocation | Tokens, sessions, delegated contexts and cached authority can be revoked |
| ATF-R-4 | State Rollback | Reversible actions can be restored and irreversible actions have tested compensation |
| ATF-R-5 | Graceful Degradation | Loss of trust materially reduces authority, resources or action capability |
An alert is not a circuit breaker, a status flag is not degradation, and a visible stop button is not a kill switch if background work retains authority.
Requirement language by target level
Section titled “Requirement language by target level”ATF uses normative language:
- MUST — required for conformance at the selected level.
- SHOULD — expected unless a documented, justified exception is accepted.
- MAY — optional at that level, although context or another obligation may still require it.
The matrix becomes stricter as autonomy increases. By Senior, most requirements are MUST; at Principal, all 25 are MUST.
Do not treat SHOULD and MAY as automatically met. Record the actual implementation result, explain any SHOULD exception and assess the resulting exposure. Other legal, contractual or organisational requirements may make an ATF MAY mandatory for the selected agent.
Cross-element challenge questions
Section titled “Cross-element challenge questions”- Can every action be linked to the immutable identity and current capability manifest?
- Are boundaries enforced independently of the agent’s own instructions?
- Can retrieved or tool-supplied content expand authority?
- Does anomaly detection trigger containment, or only notification?
- Does revocation reach downstream sessions and queued work?
- Can an agent repeat bounded actions until the cumulative impact becomes unacceptable?
- Would loss of a monitoring service cause fail-safe degradation?
- Is re-promotion prevented until incident remediation has been verified?