Agentic RAI Controls and Autonomous Workload Safety

1. The frame: workload safety ≠ model safety

Most of the depth in agentic safety research answers a lab's question, is this model safe enough to release?, through capability evaluation and adversarial control protocols. Autonomous workload safety is the operator's question: given an agent that already has tools, credentials, memory, and a long-running mandate inside our environment, what keeps that workload within its bounds, and lets us stop and undo it when it isn't?

The distinction is load-bearing because the governance that exists today does not cover the operator's layer:

• The four frontier-lab policies (Anthropic RSP, OpenAI Preparedness, DeepMind FSF, Meta FAIF) gate release by capability threshold; a side-by-side comparison shows none of them specifies how to operate a deployed agent safely.
• Regulation and standards with binding force touch the edges: ISO/IEC 42001 certifies a management-system process (verified structural; normative text paywalled); the EU GPAI Code of Practice mandates model evaluations and incident reporting for systemic-risk models; Illinois SB 315 makes "loss of model control" a reportable incident (provisional claim, bill not yet signed). None of them certifies runtime behaviour of a specific agent in a specific tenant.

So autonomous workload safety is a gap the operator must close themselves, assembling controls from the eval-and-control science that does exist. The rest of this report is that assembly, organized as ten control surfaces.

2. The ten control surfaces

Each surface states the operator's obligation, then the sources that speak to it. Citations distinguish source-supported findings, abstract-only evidence, and provisional claims.

2.1 Identity

Obligation: every agent, and every delegated sub-agent, runs as a distinct, attributable principal, not a shared human login or a single service account. Attribution is the precondition for revocation, audit, and incident attribution.

• RUSI (Secure Third-Party Access source scope only reframes access itself as a typed, controlled artifact via its Access–Risk Matrix) the strongest source here for treating "who/what holds which access" as a first-class control rather than an operational detail. Written for evaluator pipelines, but the abstraction (access tier ↔ threat) transfers directly to agent principals.
• ISO/IEC 42001 source scope only supplies the accountability-role scaffolding (documented responsibility for AI system operation) that an identity scheme instantiates.
• CSA Agentic NIST AI RMF Profile v1 provisional claim is the highest-tier enterprise-agent-controls source identified; this report does not establish its detailed identity/accountability mapping.

Gap. No cited source gives an identity model for sub-agents in a multi-agent topology, where surface 1 meets surface 10, the cited sources are silent.

2.2 Permissions / least privilege

Obligation: scope each agent's data and action rights to its task; deny-by-default; separate read from write; time-box; tenant-isolate.

• AI Control source-supported supplies the defer-to-trusted pattern, route high-risk actions to a more-trusted model or to limited human labor, which is least-privilege expressed as a runtime routing gate.
• Operator-native tooling is T3 (industry and press) material: Google Workspace AI Control Center and Microsoft Copilot Studio entering the ISO/IEC 42001 audit boundary (Help Net Security, T3) are where permission scoping for production agents is actually being shipped.

2.3 Tool scope

Obligation: enumerate the tools/functions an agent may call, validate their arguments, and refuse out-of-scope or injected tool invocations.

• Agentic Benchmarks Roundup source-supported holds the two evals that measure tool-scope integrity: AgentHarm (does the agent refuse tool-enabled misuse?) and AgentDojo (prompt-injection attack/defense). These are how an operator tests, not asserts, that tool scope holds under adversarial input.

Tool scope is the surface most directly attacked by prompt injection: the operator's tool allow-list is only as strong as its resistance to an instruction smuggled through retrieved content.

2.4 Runtime monitoring

Obligation: observe the agent while it acts (traces, tool calls, reasoning) and alert on policy/constraint violations, not only on bad final answers.

• Chain-of-Thought Monitorability source-supported names the chain-of-thought as a uniquely legible oversight signal and warns it is "a new and fragile opportunity" to be measured and preserved: the signal most runtime monitors actually read.
• AISI "Loss of Oversight" source-supported is the empirical backbone for why the signal erodes: five oversight-signal sources, >20 degradation pathways.
• AI Control source-supported supplies trusted monitoring as the protocol form.
• Towards Trustworthy Agentic AI abstract-only evidence explicitly names runtime monitoring/verification an open challenge and frames evaluation around process signals (constraint violations, trace completeness) not just outcomes.

2.5 HITL breakpoints

Obligation: pre-define which actions pause for a human (high-blast-radius, irreversible, or low-confidence steps) instead of reviewing everything (unscalable) or nothing (unsafe).

• AI Control source-supported: defer-to-trusted and trusted-editing are the breakpoint primitives, escalate to human/trusted labor at the suspicious step.
• Ctrl-Z source-supported: resample-and-defer escalates the suspicious action, not the whole trajectory, the design that makes breakpoints affordable (lifts safety 5.5%→~87% at ~95% usefulness on the BashBench testbed).

2.6 Containment

Obligation: sandbox execution, bound the blast radius, and be able to suspend a running agent and cut its tool access mid-task.

• AI Control source-supported is the containment-by-protocol layer.
• AI Loss of Control Incident Management abstract-only evidence splits the response: containment + threat neutralization for "extremely costly" (recoverable) incidents, and pre-bought resilience / attack-surface reduction for "impossible" (unrecoverable) ones, containment that must be bought before the incident, not improvised during it.

2.7 Rollback

Obligation: undo or quarantine an agent's effects (revert state, reverse transactions, discard a poisoned trajectory) without throwing away all useful work.

• Ctrl-Z source-supported: undo suspicious actions rather than discard whole runs.
• Adaptive Deployment source-supported: a two-level macro-protocol updates a Bayesian credence the model is attacking and escalates scrutiny, rollback as graduated response (~80% backdoor reduction vs non-adaptive baselines).

Gap. These undo sandboxed bash actions. Production agents send email, move money, and call external APIs whose effects no resample reverses. This is the loss-of-control "impossible-to-recover" branch in operator clothing, and no cited source addresses rollback for irreversible side effects.

2.8 Incident response

Obligation: treat an agent breach as a security incident: detection, triage by recoverability, response playbooks, mandated reporting clocks.

• AI Loss of Control Incident Management abstract-only evidence: the recoverability × cause taxonomy (extremely-costly vs impossible; accidental → automated response, adversarial → escalatory) is the cleanest argument for funding incident-management capability, not just better pre-deployment evals.
• Illinois SB 315 provisional claim: makes "loss of model control" and "deceptive techniques against the developer" reportable critical safety incidents on a 72-hour clock, the regulatory backstop that turns incident response from good practice into obligation (pending the bill's signature).

2.9 Eval integrity

Obligation: trust the measurements every other surface relies on: guard against reward-hacking, sandbagging, eval-awareness, and harness invalidity. A control built on a gamed metric is theater.

• OpenAI Third-Party Evaluations Playbook provisional claim: proposes harness validity + explicit validity checks and names reward hacking and sandbagging as confounds. Load-bearing but lab-authored: adopt the methodology, keep adjudication independent.
• Towards Trustworthy Agentic AI abstract-only evidence: process signals (constraint violations, trace completeness, adversarial success rates) as the integrity layer.
• DeepMind Stealth & Situational Awareness source-supported: the eval-awareness confound itself, a model that detects the test can behave for the grader, which is why every monitoring/anti-scheming number is provisional.

2.10 Multi-agent topology

Obligation: govern how agents are wired together, and demonstrate robustness across architectural variants before deploying a multi-agent system.

• Interaction Topology abstract-only evidence: "safety is determined by interaction topology, not model weights", names ordering instability, information cascades, functional collapse as architecture-driven pathologies "invisible to model-centric evaluation," and argues topology must become "a primary target of safety evaluation and regulation."
• Multi-Agent Risks from Advanced AI source-supported: the miscoordination / conflict / collusion taxonomy + seven risk factors.

Gap. Topology gives the target and the failure modes, but there is no runnable multi-agent control benchmark among the cited sources, and single-agent control "assumes collusion away."

3. How the surfaces compose

• Surfaces 1–3 (identity → permissions → tool scope) are the pre-conditions: a control you cannot attribute, you cannot revoke; a permission you never scoped, you cannot enforce.
• Surfaces 4–7 (monitor → breakpoint → contain → rollback) are the runtime spine: the AI-Control line built these as evaluation protocols against an adversarial model; the operator re-reads them as production controls over a model assumed merely fallible.
• Surface 8 (incident response) is what fires when 1–7 fail.
• Surface 9 (eval integrity) is the meta-control: every other surface trusts a measurement that can itself be gamed.
• Surface 10 (multi-agent topology) is the dimension single-agent controls don't cover.

The operator's one-line test: "is this agent, with these credentials, on this task, still within its bounds right now — and can we stop and undo it if not?" Surfaces 1–3 set the bounds; 4–7 watch them and pull the agent back; 8 cleans up; 9 makes sure the watching is real; 10 handles the case where the bounds are defined by wiring, not weights.

4. Sources by tier and evidence basis

T1 source-supported: AI Control (Greenblatt) · Ctrl-Z · Adaptive Deployment · CoT Monitorability · DeepMind Stealth & Situational Awareness T1 source scope only: ISO/IEC 42001 · EU GPAI Code of Practice T1 provisional claim: Illinois SB 315 T2 source-supported: AISI "Loss of Oversight" · Agentic Benchmarks Roundup (AgentHarm, AgentDojo) · Multi-Agent Risks · RUSI Secure Third-Party Access (verified structural) T2 abstract-only evidence: LOC Incident Management · Interaction Topology · Trustworthy Agentic AI survey T2 provisional claim: OpenAI Third-Party Eval Playbook · CSA Agentic NIST AI RMF Profile v1 T3 (industry and press, referenced but not excerpted): Google Workspace AI Control Center · Google/Microsoft agent-governance (Computerworld) · Help Net Security ISO-42001-with-Copilot-Studio · Deloitte/McKinsey agent-maturity numbers T3/T4 (not yet reviewed): OWASP "State of Agentic AI Security & Governance 2.01" · CSA Agentic Trust Framework · Microsoft Agent Governance Toolkit (assessed as below the primary-source bar).

5. Open gaps (autonomous workload safety)

1. Operator-native controls are under-tiered. Surfaces 1–3 (identity, least privilege, tool scope) for production agents live mostly at T3/T4: hyperscaler control planes and community/vendor frameworks. The highest-tier enterprise-agent-controls source identified (CSA Agentic NIST AI RMF Profile v1) is a resource pointer here, not evidence for its detailed control mappings. Lower-tier material such as OWASP 2.01, the CSA Agentic Trust Framework, and Microsoft tooling should not be treated as equivalent to primary research.
2. No runtime-control conformance test for a deployed agent. Control evals (Ctrl-Z, Adaptive) are research testbeds (BashBench), not operator-runnable conformance suites against a production agent.
3. Rollback for irreversible side effects is unaddressed. Resampling undoes sandboxed actions; no cited source covers reversing real-world effects (sent email, moved money, external API calls).
4. Sub-agent identity in multi-agent topologies has no cited control source: surface 1 × surface 10 is empty.
5. Eval integrity's strongest source is lab-authored and unverified. An independent validity / anti-sandbagging methodology is still not cited.