VOCE Agent Conformance · Shareable lens
Risk lens · A4
A risk view of authorization, data, assurance, observability and European obligations that can create material exposure.
Priority domains
Risk lens
A risk view of authorization, data, assurance, observability and European obligations that can create material exposure.
Authorization & authority5 applicable controls
Evaluation & assurance5 applicable controls
European regulatory overlay6 applicable controls
Data, RAG & memory5 applicable controls
Observability & audit5 applicable controls
Normative controls remain in English so the framework has one reference wording.
Applicable controls
26 applicable controls · 16 critical controls
AUTH-01Default-deny policyA2+ · critical · tested→AUTH-02Purpose-bound delegationA2+ · critical · tested→AUTH-03Step-up approvalA2+ · critical · tested→AUTH-04Segregation of dutiesA2+ · critical · tested→AUTH-05Emergency revocationA2+ · critical · tested→DATA-01Source provenanceA0+ · major · documented→DATA-02Access-control propagationA1+ · critical · tested→DATA-03Deletion and tombstone propagationA1+ · critical · tested→DATA-04Memory retention and expiryA1+ · major · documented→DATA-05Regional routing and residencyA1+ · major · documented→OBS-01End-to-end task traceA1+ · critical · verified_in_operation→OBS-02Model and version traceabilityA0+ · major · verified_in_operation→OBS-03Tool execution evidenceA1+ · critical · verified_in_operation→OBS-04Approval evidenceA2+ · critical · verified_in_operation→OBS-05Telemetry privacy policyA1+ · major · tested→ASSURE-01Task-level evaluation suiteA0+ · major · tested→ASSURE-02Permission-abuse testsA2+ · critical · tested→ASSURE-03Prompt-injection and tool-manipulation testsA1+ · critical · tested→ASSURE-04Change-triggered re-evaluationA1+ · major · verified_in_operation→ASSURE-05Kill switch and recovery testA2+ · critical · tested→EU-01AI Act role mappingA0+ · major · documented→EU-02Risk-classification recordA0+ · critical · documented→EU-03Transparency and human-oversight mappingA1+ · critical · tested→EU-04GPAI/downstream documentation reviewA1+ · major · documented→EU-05Sector overlay applicabilityA0+ · major · documented→EU-06Third-party ICT and model dependency registerA3+ · critical · verified_in_operation→
VOCE
This page describes a VOCE lens on the framework. It contains no private self-assessment data and is not an EU or ISO certification.