VOCE Agent Conformance · Shareable lens
Board lens · A2
A board-level view of where authority sits, which controls condition delegation and what must be evidenced before the system can be treated as controlled.
Priority domains
Board lens
A board-level view of where authority sits, which controls condition delegation and what must be evidenced before the system can be treated as controlled.
Authorization & authority5 applicable controls
Identity & workload trust4 applicable controls
Evaluation & assurance5 applicable controls
European regulatory overlay5 applicable controls
Economic authority & FinOps2 applicable controls
Normative controls remain in English so the framework has one reference wording.
Applicable controls
21 applicable controls · 13 critical controls
ID-01Unique workload identityA2+ · critical · verified_in_operation→ID-02Short-lived credentialsA2+ · critical · tested→ID-03Human-to-agent bindingA2+ · critical · verified_in_operation→ID-04Environment and trust-domain separationA2+ · major · tested→AUTH-01Default-deny policyA2+ · critical · tested→AUTH-02Purpose-bound delegationA2+ · critical · tested→AUTH-03Step-up approvalA2+ · critical · tested→AUTH-04Segregation of dutiesA2+ · critical · tested→AUTH-05Emergency revocationA2+ · critical · tested→ASSURE-01Task-level evaluation suiteA0+ · major · tested→ASSURE-02Permission-abuse testsA2+ · critical · tested→ASSURE-03Prompt-injection and tool-manipulation testsA1+ · critical · tested→ASSURE-04Change-triggered re-evaluationA1+ · major · verified_in_operation→ASSURE-05Kill switch and recovery testA2+ · critical · tested→FIN-01Cost per completed taskA1+ · major · verified_in_operation→FIN-02Budget and retry authorityA2+ · major · tested→EU-01AI Act role mappingA0+ · major · documented→EU-02Risk-classification recordA0+ · critical · documented→EU-03Transparency and human-oversight mappingA1+ · critical · tested→EU-04GPAI/downstream documentation reviewA1+ · major · documented→EU-05Sector overlay applicabilityA0+ · major · documented→
VOCE
This page describes a VOCE lens on the framework. It contains no private self-assessment data and is not an EU or ISO certification.