Agents must be registered and monitored before they run.

Agents run under org-issued identity, not personal accounts or static keys.

Agents may not execute with root or admin privileges.

Consequential tool calls require a human approval before agents proceed.

Agents may only invoke tools on the approved list.

Agents may only connect to approved MCP servers.

Agent code execution is confined to a sandbox at or above the required level.

Secrets and credential files stay out of model context.

Sensitive content is detected and redacted in prompts and responses.

Agent traffic may only reach approved destinations.

Connections below the TLS baseline are refused.

Inbound prompts are scanned for injection patterns — detect & contain.

Agent output is checked before it reaches downstream tools.

Models and tools must match pinned, verified sources.

Fleet and per-agent spend stays under explicit ceilings.

Agents respect provider quotas instead of burning through them.

No agent operates below the minimum security-posture score.