Agentic RAI Controls and Autonomous Workload Safety

1. The frame: workload safety ≠ model safety

Most of the depth in agentic safety research answers a lab's question, is this model safe enough to release?, through capability evaluation and adversarial control protocols. Autonomous workload safety is the operator's question: given an agent that already has tools, credentials, memory, and a long-running mandate inside our environment, what keeps that workload within its bounds, and lets us stop and undo it when it isn't?

The distinction is load-bearing because the governance that exists today does not cover the operator's layer:

• The four frontier-lab policies (Anthropic RSP, OpenAI Preparedness, DeepMind FSF, Meta FAIF) gate release by capability threshold; a side-by-side comparison shows none of them specifies how to operate a deployed agent safely.
• Regulation and standards with binding force touch the edges: ISO/IEC 42001 certifies a management-system process (verified structural; normative text paywalled); the EU GPAI Code of Practice mandates model evaluations and incident reporting for systemic-risk models; Illinois SB 315 makes "loss of model control" a reportable incident (not yet independently verified, bill not yet signed). None of them certifies runtime behaviour of a specific agent in a specific tenant.

So autonomous workload safety is a gap the operator must close themselves, assembling controls from the eval-and-control science that does exist. The rest of this report is that assembly, organized as ten control surfaces.

2. The ten control surfaces

Each surface states the operator's obligation, then the sources that speak to it. Sources are tagged with their verification status so the reader knows what is quotable vs. provisional.

2.1 Identity

Obligation: every agent, and every delegated sub-agent, runs as a distinct, attributable principal, not a shared human login or a single service account. Attribution is the precondition for revocation, audit, and incident attribution.

• RUSI (Secure Third-Party Access source confirmed reframes access itself as a typed, controlled artifact via its Access–Risk Matrix) the strongest source here for treating "who/what holds which access" as a first-class control rather than an operational detail. Written for evaluator pipelines, but the abstraction (access tier ↔ threat) transfers directly to agent principals.
• ISO/IEC 42001 source confirmed supplies the accountability-role scaffolding (documented responsibility for AI system operation) that an identity scheme instantiates.
• CSA Agentic NIST AI RMF Profile v1 not yet independently verified is the highest-tier enterprise-agent-controls source identified; its identity/accountability mapping is not yet quotable pending verification.

Gap. No cited source gives an identity model for sub-agents in a multi-agent topology, where surface 1 meets surface 10, the cited sources are silent.

2.2 Permissions / least privilege

Obligation: scope each agent's data and action rights to its task; deny-by-default; separate read from write; time-box; tenant-isolate.

• AI Control verified against source supplies the defer-to-trusted pattern, route high-risk actions to a more-trusted model or to limited human labor, which is least-privilege expressed as a runtime routing gate.
• Operator-native tooling is T3 (industry and press) material: Google Workspace AI Control Center and Microsoft Copilot Studio entering the ISO/IEC 42001 audit boundary (Help Net Security, T3) are where permission scoping for production agents is actually being shipped.

2.3 Tool scope

Obligation: enumerate the tools/functions an agent may call, validate their arguments, and refuse out-of-scope or injected tool invocations.

• Agentic Benchmarks Roundup verified against source holds the two evals that measure tool-scope integrity: AgentHarm (does the agent refuse tool-enabled misuse?) and AgentDojo (prompt-injection attack/defense). These are how an operator tests, not asserts, that tool scope holds under adversarial input.

Tool scope is the surface most directly attacked by prompt injection: the operator's tool allow-list is only as strong as its resistance to an instruction smuggled through retrieved content.

2.4 Runtime monitoring

Obligation: observe the agent while it acts (traces, tool calls, reasoning) and alert on policy/constraint violations, not only on bad final answers.

• Chain-of-Thought Monitorability verified against source names the chain-of-thought as a uniquely legible oversight signal and warns it is "a new and fragile opportunity" to be measured and preserved: the signal most runtime monitors actually read.
• AISI "Loss of Oversight" verified against source is the empirical backbone for why the signal erodes: five oversight-signal sources, >20 degradation pathways.
• AI Control verified against source supplies trusted monitoring as the protocol form.
• Towards Trustworthy Agentic AI abstract verified explicitly names runtime monitoring/verification an open challenge and frames evaluation around process signals (constraint violations, trace completeness) not just outcomes.

2.5 HITL breakpoints

Obligation: pre-define which actions pause for a human (high-blast-radius, irreversible, or low-confidence steps) instead of reviewing everything (unscalable) or nothing (unsafe).

• AI Control verified against source: defer-to-trusted and trusted-editing are the breakpoint primitives, escalate to human/trusted labor at the suspicious step.
• Ctrl-Z verified against source: resample-and-defer escalates the suspicious action, not the whole trajectory, the design that makes breakpoints affordable (lifts safety 5.5%→~87% at ~95% usefulness on the BashBench testbed).

2.6 Containment

Obligation: sandbox execution, bound the blast radius, and be able to suspend a running agent and cut its tool access mid-task.

• AI Control verified against source is the containment-by-protocol layer.
• AI Loss of Control Incident Management abstract verified splits the response: containment + threat neutralization for "extremely costly" (recoverable) incidents, and pre-bought resilience / attack-surface reduction for "impossible" (unrecoverable) ones, containment that must be bought before the incident, not improvised during it.

2.7 Rollback

Obligation: undo or quarantine an agent's effects (revert state, reverse transactions, discard a poisoned trajectory) without throwing away all useful work.

• Ctrl-Z verified against source: undo suspicious actions rather than discard whole runs.
• Adaptive Deployment verified against source: a two-level macro-protocol updates a Bayesian credence the model is attacking and escalates scrutiny, rollback as graduated response (~80% backdoor reduction vs non-adaptive baselines).

Gap. These undo sandboxed bash actions. Production agents send email, move money, and call external APIs whose effects no resample reverses. This is the loss-of-control "impossible-to-recover" branch in operator clothing, and no cited source addresses rollback for irreversible side effects.

2.8 Incident response

Obligation: treat an agent breach as a security incident: detection, triage by recoverability, response playbooks, mandated reporting clocks.

• AI Loss of Control Incident Management abstract verified: the recoverability × cause taxonomy (extremely-costly vs impossible; accidental → automated response, adversarial → escalatory) is the cleanest argument for funding incident-management capability, not just better pre-deployment evals.
• Illinois SB 315 not yet independently verified: makes "loss of model control" and "deceptive techniques against the developer" reportable critical safety incidents on a 72-hour clock, the regulatory backstop that turns incident response from good practice into obligation (pending the bill's signature).

2.9 Eval integrity

Obligation: trust the measurements every other surface relies on: guard against reward-hacking, sandbagging, eval-awareness, and harness invalidity. A control built on a gamed metric is theater.

• OpenAI Third-Party Evaluations Playbook not yet independently verified: proposes harness validity + explicit validity checks and names reward hacking and sandbagging as confounds. Load-bearing but lab-authored: adopt the methodology, keep adjudication independent.
• Towards Trustworthy Agentic AI abstract verified: process signals (constraint violations, trace completeness, adversarial success rates) as the integrity layer.
• DeepMind Stealth & Situational Awareness verified against source: the eval-awareness confound itself, a model that detects the test can behave for the grader, which is why every monitoring/anti-scheming number is provisional.

2.10 Multi-agent topology

Obligation: govern how agents are wired together, and demonstrate robustness across architectural variants before deploying a multi-agent system.

• Interaction Topology abstract verified: "safety is determined by interaction topology, not model weights", names ordering instability, information cascades, functional collapse as architecture-driven pathologies "invisible to model-centric evaluation," and argues topology must become "a primary target of safety evaluation and regulation."
• Multi-Agent Risks from Advanced AI verified against source: the miscoordination / conflict / collusion taxonomy + seven risk factors.

Gap. Topology gives the target and the failure modes, but there is no runnable multi-agent control benchmark among the cited sources, and single-agent control "assumes collusion away."

3. How the surfaces compose

• Surfaces 1–3 (identity → permissions → tool scope) are the pre-conditions: a control you cannot attribute, you cannot revoke; a permission you never scoped, you cannot enforce.
• Surfaces 4–7 (monitor → breakpoint → contain → rollback) are the runtime spine: the AI-Control line built these as evaluation protocols against an adversarial model; the operator re-reads them as production controls over a model assumed merely fallible.
• Surface 8 (incident response) is what fires when 1–7 fail.
• Surface 9 (eval integrity) is the meta-control: every other surface trusts a measurement that can itself be gamed.
• Surface 10 (multi-agent topology) is the dimension single-agent controls don't cover.

The operator's one-line test: "is this agent, with these credentials, on this task, still within its bounds right now — and can we stop and undo it if not?" Surfaces 1–3 set the bounds; 4–7 watch them and pull the agent back; 8 cleans up; 9 makes sure the watching is real; 10 handles the case where the bounds are defined by wiring, not weights.

4. Source inventory by tier and verification status

T1 verified against source: AI Control (Greenblatt) · Ctrl-Z · Adaptive Deployment · CoT Monitorability · DeepMind Stealth & Situational Awareness T1 source confirmed: ISO/IEC 42001 · EU GPAI Code of Practice T1 not yet independently verified: Illinois SB 315 T2 verified against source: AISI "Loss of Oversight" · Agentic Benchmarks Roundup (AgentHarm, AgentDojo) · Multi-Agent Risks · RUSI Secure Third-Party Access (verified structural) T2 abstract verified: LOC Incident Management · Interaction Topology · Trustworthy Agentic AI survey T2 not yet independently verified: OpenAI Third-Party Eval Playbook · CSA Agentic NIST AI RMF Profile v1 T3 (industry and press, referenced but not excerpted): Google Workspace AI Control Center · Google/Microsoft agent-governance (Computerworld) · Help Net Security ISO-42001-with-Copilot-Studio · Deloitte/McKinsey agent-maturity numbers T3/T4 (not yet reviewed): OWASP "State of Agentic AI Security & Governance 2.01" · CSA Agentic Trust Framework · Microsoft Agent Governance Toolkit (assessed as below the primary-source bar).

5. Open gaps (autonomous workload safety)

1. Operator-native controls are under-tiered. Surfaces 1–3 (identity, least privilege, tool scope) for production agents live mostly at T3/T4: hyperscaler control planes and community/vendor frameworks. The highest-tier enterprise-agent-controls source identified (CSA Agentic NIST AI RMF Profile v1) is not yet verified. A dedicated review of lower-tier enterprise-controls material (OWASP 2.01, CSA Agentic Trust Framework, Microsoft toolkit), with honest T3/T4 tagging, remains to be done.
2. No runtime-control conformance test for a deployed agent. Control evals (Ctrl-Z, Adaptive) are research testbeds (BashBench), not operator-runnable conformance suites against a production agent.
3. Rollback for irreversible side effects is unaddressed. Resampling undoes sandboxed actions; no cited source covers reversing real-world effects (sent email, moved money, external API calls).
4. Sub-agent identity in multi-agent topologies has no cited control source: surface 1 × surface 10 is empty.
5. Eval integrity's strongest source is lab-authored and unverified. An independent validity / anti-sandbagging methodology is still not cited.