VOCE Agent Conformance · AUTH-01

Default-deny policy

Is agent authority denied unless a specific action/resource/context rule allows it?

Authorization & authorityA2+CriticalPermanent control URL
Normative wording

AUTH-01 · Default-deny policy

Is agent authority denied unless a specific action/resource/context rule allows it?

DomainAuthorization & authority
Expected ownerIAM / Risk
Minimum maturityA2+
CriticalityCritical
Target evidence stateTested
Expected evidence

Expected evidence

  • Policy definition
  • Negative authorization test
Method

How to read this control.

This control belongs to VOCE Agent Conformance. Its identifier and normative wording remain identical across language versions so there is one reference, not three variants. Status depends on dated evidence, not a vendor declaration or aggregate score.

Open Agent Conformance →