B.1 How to use the reference
The following 45 practices are original proposed enterprise baselines. H-identifiers are fully specified within this book and are separate from the earlier TOL catalog. Apply each practice according to the system boundary and consequences. Inapplicability needs a reason; an unmet control needs a scoped operating decision. A written practice is not evidence that its mechanism works.
| Prefix | Family | Typical operating owner | Chapters and specifications |
|---|---|---|---|
| H-GOV | Governance and accountability | Business owner and enterprise risk | 3, 15; E01, E06, E12 |
| H-DES | Design, data, identity, and architecture | Platform, security, and data owners | 5-7; E01, E02, E04, E05, E08 |
| H-EVL | Evaluation and release | Validation and business test owners | 9; E03, E06, E07, E09, E11 |
| H-RUN | Runtime execution and oversight | Platform and resource owners | 6, 10, 13; E02, E03, E04, E11 |
| H-MON | Monitoring and post-deployment evidence | Operations and assurance | 10, 12-13; E01, E07, E12 |
| H-MAS | Multi-agent coordination | Orchestrator and process owners | 11; E04, E09 |
| H-TPR | Third-party and supply chain | Procurement and service owners | 11, 16; E01, E06, E08 |
| H-ASR | Assurance, reporting, and review | Independent risk and assurance | 12, 15; E01, E06, E12 |
| H-FCO | Fairness and customer outcomes | Business, compliance, and Responsible AI | 8, 14; E10, E11 |
B.2 Governance and accountability
| Practice | Required behavior | Evidence | Starter test |
|---|---|---|---|
| H-GOV-01 Named mandate | Approve purpose, excluded uses, action classes, and accountable process owner. | Signed mandate and system boundary. | Attempt a materially different task and confirm refusal or a new mandate. |
| H-GOV-02 Impact and legal scope | Assess affected people, consequences, jurisdictions, entity roles, and data before choosing autonomy. | Impact register and scoped obligation decisions. | Introduce a covered decision and verify reassessment before use. |
| H-GOV-03 Decision rights | Assign release, exception, halt, restart, correction, and retirement authority. | RACI, delegated limits, and decision records. | Exercise an escalation when the primary approver is unavailable. |
| H-GOV-04 Risk and exceptions | Record specific failure mechanisms, residual gaps, compensating controls, owners, and expiry. | Risk register and expiring exception log. | Reach an exception expiry and verify continuation is not silently authorized. |
| H-GOV-05 Training and adoption | Demonstrate operator and reviewer competence, workload capacity, and understanding of role limits. | Training rubric, planted cases, staffing and burden evidence. | Seed a plausible error under ordinary and peak workload. |
B.3 Design, data, identity, and architecture
| Practice | Required behavior | Evidence | Starter test |
|---|---|---|---|
| H-DES-01 Configuration identity | Version model, harness, instructions, tools, permissions, memory, monitors, and fallback. | Deployment manifest and production digest. | Change one material component and require affected evidence renewal. |
| H-DES-02 Independent authority | Enforce least privilege and resource authorization outside agent-editable policy. | Effect-path inventory, grants, and negative outcomes. | Use a valid identity on an unauthorized action or tenant. |
| H-DES-03 Data and source purpose | Define permitted sources, classifications, rights, freshness, tenant scope, and egress. | Source register, access decisions, and data-flow records. | Retrieve forbidden or wrong-tenant data and verify blocked use. |
| H-DES-04 Memory stewardship | Gate admission and reuse; retain provenance, derivative lineage, revocation, and deletion policy. | Admission records, lineage, quarantine and repair evidence. | Revoke a contaminated source and test summaries, caches, and restored state. |
| H-DES-05 Failure and recovery design | Specify behavior on monitor, policy, tool, audit, provider, and identity failures. | Dependency failure matrix and reconciliation design. | Inject an outage and verify permitted degraded behavior without bypass. |
B.4 Evaluation and release
| Practice | Required behavior | Evidence | Starter test |
|---|---|---|---|
| H-EVL-01 Decision and oracle | Define authorized utility, prohibited effects, adjudication, and external success criteria. | Evaluation protocol and oracle validation. | Challenge an agent success statement with contradictory resource state. |
| H-EVL-02 Representative tasks | Cover normal work, edge cases, missing data, accessibility, and relevant customer stages. | Case register, sampling rationale, labels, and uncertainty. | Use a difficult but valid task and measure retained utility. |
| H-EVL-03 Adversarial and invariant tests | Test authority, approval, privacy, budgets, memory, and effect routes under declared attacks. | Attack model, failure cases, receipts, and coverage limits. | Try revoked credentials, payload drift, delayed injection, and an alternate route. |
| H-EVL-04 Human and monitor validity | Validate review competence, monitor timing, unfamiliar cases, thresholds, and capacity. | Confusion counts, queue tests, timing, and effective prevention. | Delay or blind the monitor and test reviewer correction with missing evidence. |
| H-EVL-05 Change interactions | Retest affected component combinations, fallback, topology, and persistent state. | Baseline/candidate results, holdout lineage, and release decision. | Combine two separately acceptable changes and inspect joint outcomes. |
B.5 Runtime execution and oversight
| Practice | Required behavior | Evidence | Starter test |
|---|---|---|---|
| H-RUN-01 Commit mediation | Send every consequential effect through current authorization and policy checks. | Route inventory, call decisions, and resource receipts. | Try a raw API, child, subprocess, or background bypass. |
| H-RUN-02 Bounded approval | Bind consent to normalized action, affected resources, permitted variation, and expiry. | Approval digest, reviewer identity, and revalidation. | Change beneficiary, amount, destination, or schema after consent. |
| H-RUN-03 Shared limits and revocation | Preserve time, cost, scope, and exposure limits across retries, restarts, and descendants. | External budget and revocation ledger. | Split consumption across children and restart the parent. |
| H-RUN-04 Effect verification | Check business postconditions and reconcile partial, duplicated, or uncertain outcomes. | Idempotency key, independent state, and outcome record. | Lose the tool response after effect and verify no blind duplicate. |
| H-RUN-05 Human intervention and halt | Give competent operators the evidence and authority to hold, correct, and stop work. | Review results, effective halt times, and remaining-effect reconciliation. | Halt with queued writes and children still active. |
B.6 Monitoring and post-deployment evidence
| Practice | Required behavior | Evidence | Starter test |
|---|---|---|---|
| H-MON-01 Correlated evidence | Join identity, configuration, authority, decision, effect, and verified outcome. | Matched event and receipt records. | Sample a completed effect and reconstruct the full chain. |
| H-MON-02 Tested monitor envelope | State observed signals, thresholds, errors, delay, blind spots, and dependency response. | Validated labels, latency distribution, and residual misses. | Use an unfamiliar schema or adaptive attack beyond training examples. |
| H-MON-03 Integrity and access | Protect authoritative evidence against agent alteration and unnecessary disclosure. | Custody record, access log, retention and loss detection. | Attempt evidence deletion or unauthorized sensitive-log access. |
| H-MON-04 Drift and evidence expiry | Track component, population, task, capacity, and policy changes that reopen claims. | Drift records and affected assurance status. | Change task mix or provider alias and inspect the reassessment. |
| H-MON-05 Outcome and incident feedback | Reconcile failures, customer outcomes, complaints, and recovery into operating decisions. | Incident register, outcome review, correction and closure evidence. | A repeated complaint triggers lookback and control revision. |
B.7 Multi-agent coordination
| Practice | Required behavior | Evidence | Starter test |
|---|---|---|---|
| H-MAS-01 Topology necessity | Compare the multi-agent design with a simpler workflow under equal authority. | Topology manifest and paired utility/complexity results. | Remove a coordinator and compare useful safe completion. |
| H-MAS-02 Constrained delegation | Bind children to narrower mandate, lineage, expiry, resources, and global limits. | Delegation grants and resource decisions. | A child tries broader scope or parent-level authority. |
| H-MAS-03 Shared state discipline | Preserve provenance, tenant separation, budgets, quarantine, and revocation across agents. | Shared ledger, artifact lineage, and state tests. | Contaminate a shared summary and test downstream reuse. |
| H-MAS-04 System-level evaluation | Vary worker compromise, coordinated violations, timing, and topology; inspect joint effects. | Threat/topology matrix and end-to-end oracles. | Split a prohibited task into locally benign steps. |
| H-MAS-05 Descendant containment | Stop child jobs, queues, retained credentials, and delayed effects during incidents. | Delegation-tree reconciliation and independent halt verification. | Revoke a parent while a background child is committing. |
B.8 Third-party and supply chain
| Practice | Required behavior | Evidence | Starter test |
|---|---|---|---|
| H-TPR-01 Dependency inventory | Identify models, tools, adapters, protocols, data, hosting, and their integrity/version policies. | Bill of materials and source/version register. | Discover an unlisted adapter and reopen the release record. |
| H-TPR-02 Evidence challenge | Obtain methods, configurations, denominators, exclusions, limitations, and independent claims. | Supplier evidence pack and local challenge decisions. | Test the supplier claim against the institution-specific resource policy. |
| H-TPR-03 Data and rights terms | Specify allowed processing, retention, training use, confidentiality, source rights, and exit handling. | Reviewed terms and tested data-flow restrictions. | Sensitive input crosses an unapproved provider boundary. |
| H-TPR-04 Change and incident notice | Agree how material changes, deprecations, and incidents trigger local reassessment. | Notice process, owner, and impact decisions. | Simulate an opaque serving change without a fixed version. |
| H-TPR-05 Exit and continuity | Demonstrate safe fallback, work reconciliation, evidence portability, and credential withdrawal. | Exit drill and fallback-specific evaluation. | Withdraw a service while effects are pending. |
B.9 Assurance, reporting, and review
| Practice | Required behavior | Evidence | Starter test |
|---|---|---|---|
| H-ASR-01 Claim register | State each material control claim, mechanism, owner, conditions, and exclusions. | Versioned assurance case and coverage boundaries. | Challenge a general safety claim against an uncovered effect route. |
| H-ASR-02 Evidence validity | Review sample grain, labels, independence, calculations, source scope, and oracle quality. | Method review and reproducible results. | Detect a pooled benchmark rate or invalid success label. |
| H-ASR-03 Independent challenge | Separate implementation, release challenge, and internal audit responsibilities. | Challenge record and disposition of disagreements. | Escalate a material unresolved finding rather than silently approve. |
| H-ASR-04 Operating and recovery proof | Join pre-release tests to production reconciliation and effective containment. | Case samples, loss checks, drills, and change decisions. | Reperform one critical claim using externally observed effects. |
| H-ASR-05 Retirement and custody | Close grants, jobs, retained memory, obligations, and custody when use ends. | Decommission checklist and continuity/evidence disposition. | Restore an old job or credential and confirm it cannot act. |
B.10 Fairness and customer outcomes
| Practice | Required behavior | Evidence | Starter test |
|---|---|---|---|
| H-FCO-01 Decision-path scope | Include evidence requests, routing, recommendations, final decisions, notices, and remedy. | Stage map and eligible-population definitions. | A group disappears before the final decision sample. |
| H-FCO-02 Fairness and burden review | Measure relevant errors, delays, exclusion, accessibility, and burden with uncertainty. | Stage-cohort analysis and alternative designs. | Small or missing cells remain uncertain rather than zero disparity. |
| H-FCO-03 Actual reasons | Preserve the factual and policy basis of consequential decisions and verify notices against it. | Decision basis, approved reason mapping, and notice check. | A fluent but incorrect reason is rejected. |
| H-FCO-04 Meaningful review | Give reviewers competence, evidence, time, and authority to correct or suspend. | Planted-case outcomes, overrides, queue and conflict evidence. | A reviewer reverses an incorrect agent recommendation. |
| H-FCO-05 Contest and remedy | Provide accessible correction, reopening, remediation, and recurring-failure lookback. | Case outcomes, notices, response timing, and closure. | Correct new evidence changes the decision and reaches affected descendants. |
B.11 Relationship to the earlier 112-control compendium
The earlier compendium has 112 identifiers across nine families. The table records that namespace for traceability. It is not a claim that five handbook practices are equivalent to every detailed control in a family. Specific E01-E12 mappings retain selected original anchors alongside explained handbook practices. No original control is renumbered. The prior index remains an optional historical reference. [S02]
| Original family | Count | Identifier range | Handbook reference |
|---|---|---|---|
| GOV | 14 | GOV-01 through GOV-14 | H-GOV-01 through H-GOV-05 |
| DES | 14 | DES-01 through DES-14 | H-DES-01 through H-DES-05 |
| EVL | 16 | EVL-01 through EVL-16 | H-EVL-01 through H-EVL-05 |
| RUN | 18 | RUN-01 through RUN-18 | H-RUN-01 through H-RUN-05 |
| MON | 12 | MON-01 through MON-12 | H-MON-01 through H-MON-05 |
| MAS | 10 | MAS-01 through MAS-10 | H-MAS-01 through H-MAS-05 |
| TPR | 8 | TPR-01 through TPR-08 | H-TPR-01 through H-TPR-05 |
| ASR | 10 | ASR-01 through ASR-10 | H-ASR-01 through H-ASR-05 |
| FCO | 10 | FCO-01 through FCO-10 | H-FCO-01 through H-FCO-05 |
The implementation mapping identifies mechanism-level relationships; it is not a statement of legal equivalence, exhaustive coverage, or certification. Use the practice descriptions and evidence here to make the local decision.