Agentic AI needs a control plane. ACR defines the standard.
ACR: Agentic Control at Runtime
The ACR Runtime Control Plane Standard v1.0.2 defines the normative requirements for a mandatory enforcement layer governing autonomous AI agent actions at runtime. It establishes the minimum technical conditions under which an AI system may be classified as a controlled system.
Agentic AI changed the control problem.
Speed asymmetry
Agents act in milliseconds. Human review cycles operate in hours or days. By the time a governance committee reviews an action, the agent has already executed thousands more.
Bypass risk
If agents can reach tools without traversing the control plane, governance is theater. Policy documents do not prevent unauthorized execution at runtime.
Post-hoc is too late
Monitoring what happened after execution cannot prevent harm. Observability without enforcement records damage but does not stop it.
The control plane is the mandatory trust path.
“If agents can reach tools without traversing the control plane, governance is theater.”
Define. Enforce. Preserve.
Follow one customer-support agent through the four decision paths shown above. ACR allows a routine lookup, denies a forbidden deletion, redacts an email before a refund executes, and holds a $150 refund for human approval, with every step linked to the same recorded trace.
A narrated customer-support workflow showing all four ACR runtime decisions (ALLOW, DENY, MODIFY and ESCALATE) and the trace records the operator console keeps for each one.
Development demonstration with synthetic customer data. It does not establish production readiness or conformance to the ACR Standard. It shows selected controls from four pillars (P1, P2, P4, P6). Drift detection, timed containment and kill-switch behavior are not shown.
Duration 3:17, narrated, with on-screen captions. Customer-support screens illustrate the agent workflow; console screens show the recorded decision traces.
Transcript
- 0:00Define what an agent may do. Enforce it when it acts. Preserve the evidence. That's ACR. Here's how it works in a customer support workflow.
- 0:11A customer asks for a one hundred and fifty dollar refund. Identity and Purpose Binding connects this registered support agent to its approved tools.
- 0:22Behind the workflow is the ACR operator console. This is Execution Observability: each request has a recorded decision and a unique trace ID.
- 0:35First, the agent requests the customer record. The policy allows this read, so the lookup runs and returns the information needed to continue. Here is that same request in the console. The saved decision is allow, and its trace ID links the action to the evidence.
- 0:55Next, consider a forbidden action: deleting a customer. This is Behavioral Policy Enforcement. ACR denies the request before the protected tool runs. The customer record stays untouched. The console shows the exact reason: this support agent is not allowed to delete customers. There is no successful deletion.
- 1:20Now a separate fifty dollar refund contains an email address in its note. ACR removes the private email before execution, while preserving the amount and the purpose of the request. The saved trace shows modify, the redacted note, and the unchanged fifty dollar amount. This is email redaction, applied before the tool receives the request.
- 1:47Back to the one hundred and fifty dollar refund. This policy requires approval above one hundred dollars. Human Authority takes over. ACR pauses execution, and the agent waits for an authorized review. The recorded decision is escalate. This approval request ID connects the paused action to the review that follows.
- 2:12An authorized approval is recorded for this request. That approval releases only the waiting action. ACR then executes the approved request and records the result. The same trace ID connects the decision, approval, and execution.
- 2:31Here is the actual approval API response. Its status is approved. The execution result records refund issued for one hundred and fifty dollars, linked to that same request.
- 2:45This workflow highlights selected controls from four ACR pillars. The full framework also includes Autonomy Drift Detection, and Self-Healing and Containment. Those are separate control paths, beyond the actions shown here.
- 3:02Allow routine work. Deny forbidden actions. Modify sensitive details. Escalate exceptions for approval. Define what an agent may do. Enforce it when it acts. Preserve the evidence.
Operational controls, not just principles.
Identity & Purpose Binding
Every agent must have a unique identity and a declared purpose. Constraints are tied to that purpose. No anonymous or unscoped execution.
Behavioral Policy Enforcement
Machine-enforceable runtime policies at Input, Execution, and Output Boundaries. Documentation-only policies do not satisfy this requirement.
Autonomy Drift Detection
Behavioral baselines, thresholded response tiers, and evidence of calibration. Anomalous behavior triggers proportionate containment responses.
Execution Observability
Complete decision trails: who acted, what was proposed, what controls applied, what disposition produced, and what downstream execution occurred.
Self-Healing & Containment
Externally operable kill capability, graduated isolation, documented safe-states, and quarterly containment testing. Independent of agent runtime.
Human Authority
Risk-tiered action classification, escalation authority matrices, approval gating, break-glass capability, and timeout enforcement.
Each pillar maps to controls from ISO/IEC 42001, NIST AI RMF, NIST CSF 2.0, ISO 27001, and NIST SP 800-207.
Standard, reference implementation, and threat model.
ACR Standard v1.0.2
The normative specification defining required control outcomes, decision semantics, evidence properties, and conformance criteria. Implementation-independent and testable.
View StandardReference Implementation
Open-source reference implementation for evaluating ACR runtime-control patterns. Review implemented controls, test evidence, and known limitations before making a conformance claim.
Release v1.1.3; reviewed source snapshot main at 7095383. Using this repository does not establish conformance or certification.
View on GitHubSTRIKE Threat Model
Threat taxonomy for agentic AI: Spoofing, Tampering, Reflection Abuse, Information Leakage, Kill Chain Extension, and Emergence.
Explore STRIKEFind your entry point.
Security & Architecture
Start with the Architecture page to understand the 7-layer control stack and the enforcement boundary. Then review the Control Plane for trust path mechanics.
ArchitectureGRC & Compliance
Start with the informative Standards Crosswalk to orient ACR against ISO/IEC 42001, NIST AI RMF, NIST CSF 2.0, ISO/IEC 27001 and NIST SP 800-207. Mappings are under review and do not establish compliance. Then review the conformance requirements.
Standards CrosswalkEngineering & Platform
Watch the reference demo, follow the local setup guide, and choose a contribution. Review the Control Specs for the requirements behind each behavior.
Start building