VOCE Agent Conformance · Shareable lens
Board lens · A4
A board-level view of where authority sits, which controls condition delegation and what must be evidenced before the system can be treated as controlled.
Priority domains
Board lens
A board-level view of where authority sits, which controls condition delegation and what must be evidenced before the system can be treated as controlled.
Authorization & authority5 applicable controls
Identity & workload trust5 applicable controls
Evaluation & assurance5 applicable controls
European regulatory overlay6 applicable controls
Economic authority & FinOps3 applicable controls
Normative controls remain in English so the framework has one reference wording.
Applicable controls
24 applicable controls · 14 critical controls
ID-01Unique workload identityA2+ · critical · verified_in_operation→ID-02Short-lived credentialsA2+ · critical · tested→ID-03Human-to-agent bindingA2+ · critical · verified_in_operation→ID-04Environment and trust-domain separationA2+ · major · tested→ID-05Third-party identity federationA3+ · major · documented→AUTH-01Default-deny policyA2+ · critical · tested→AUTH-02Purpose-bound delegationA2+ · critical · tested→AUTH-03Step-up approvalA2+ · critical · tested→AUTH-04Segregation of dutiesA2+ · critical · tested→AUTH-05Emergency revocationA2+ · critical · tested→ASSURE-01Task-level evaluation suiteA0+ · major · tested→ASSURE-02Permission-abuse testsA2+ · critical · tested→ASSURE-03Prompt-injection and tool-manipulation testsA1+ · critical · tested→ASSURE-04Change-triggered re-evaluationA1+ · major · verified_in_operation→ASSURE-05Kill switch and recovery testA2+ · critical · tested→FIN-01Cost per completed taskA1+ · major · verified_in_operation→FIN-02Budget and retry authorityA2+ · major · tested→FIN-03Supplier concentration and exitA3+ · major · documented→EU-01AI Act role mappingA0+ · major · documented→EU-02Risk-classification recordA0+ · critical · documented→EU-03Transparency and human-oversight mappingA1+ · critical · tested→EU-04GPAI/downstream documentation reviewA1+ · major · documented→EU-05Sector overlay applicabilityA0+ · major · documented→EU-06Third-party ICT and model dependency registerA3+ · critical · verified_in_operation→
VOCE
This page describes a VOCE lens on the framework. It contains no private self-assessment data and is not an EU or ISO certification.