VOCE Agent Conformance · Shareable lens
Audit lens · A3
An audit view of whether execution can be reconstructed, authority attributed, data verified, evidence retained and controls tested.
Priority domains
Audit lens
An audit view of whether execution can be reconstructed, authority attributed, data verified, evidence retained and controls tested.
Observability & audit5 applicable controls
Authorization & authority5 applicable controls
Data, RAG & memory5 applicable controls
European regulatory overlay6 applicable controls
Evaluation & assurance5 applicable controls
Normative controls remain in English so the framework has one reference wording.
Applicable controls
26 applicable controls · 16 critical controls
AUTH-01Default-deny policyA2+ · critical · tested→AUTH-02Purpose-bound delegationA2+ · critical · tested→AUTH-03Step-up approvalA2+ · critical · tested→AUTH-04Segregation of dutiesA2+ · critical · tested→AUTH-05Emergency revocationA2+ · critical · tested→DATA-01Source provenanceA0+ · major · documented→DATA-02Access-control propagationA1+ · critical · tested→DATA-03Deletion and tombstone propagationA1+ · critical · tested→DATA-04Memory retention and expiryA1+ · major · documented→DATA-05Regional routing and residencyA1+ · major · documented→OBS-01End-to-end task traceA1+ · critical · verified_in_operation→OBS-02Model and version traceabilityA0+ · major · verified_in_operation→OBS-03Tool execution evidenceA1+ · critical · verified_in_operation→OBS-04Approval evidenceA2+ · critical · verified_in_operation→OBS-05Telemetry privacy policyA1+ · major · tested→ASSURE-01Task-level evaluation suiteA0+ · major · tested→ASSURE-02Permission-abuse testsA2+ · critical · tested→ASSURE-03Prompt-injection and tool-manipulation testsA1+ · critical · tested→ASSURE-04Change-triggered re-evaluationA1+ · major · verified_in_operation→ASSURE-05Kill switch and recovery testA2+ · critical · tested→EU-01AI Act role mappingA0+ · major · documented→EU-02Risk-classification recordA0+ · critical · documented→EU-03Transparency and human-oversight mappingA1+ · critical · tested→EU-04GPAI/downstream documentation reviewA1+ · major · documented→EU-05Sector overlay applicabilityA0+ · major · documented→EU-06Third-party ICT and model dependency registerA3+ · critical · verified_in_operation→
VOCE
This page describes a VOCE lens on the framework. It contains no private self-assessment data and is not an EU or ISO certification.