AI Control Domains
A Framework for Governing Agentic AI Systems
AI Control Domains
AI Control Domains are the architectural layers where defenders impose structure, policy, and technical controls over AI systems. Rather than describing threats, they describe where defensive mechanisms operate. Threats such as prompt injection, data leakage, excessive agency, or supply-chain compromise often span multiple control domains. The domains provide a common vocabulary for discussing AI governance, engineering, and security.
Why use AI Control Domains? Threats describe what goes wrong. Control Domains describe where defenses operate.
Identity
Identity establishes who or what is interacting with an AI system. Users, software agents, services, devices, and organizations each require verifiable identities before trust decisions can be made. Without reliable identity, every subsequent security control becomes weaker. Typical controls include identity providers, certificates, service accounts, hardware identities, federated identity systems, and cryptographic credentials.
Authentication
Authentication verifies that a given identity is genuine by answering the question, “Are you who you claim to be?” Strong authentication reduces unauthorized access and provides confidence that requests are originating from legitimate users or systems. Common controls include passwords, multi-factor authentication, hardware security keys, certificates, biometric verification, and mutual authentication between services.
Authorization
Authorization determines what an authenticated identity is permitted to do. It limits the identities access to data, models, APIs, and administrative functions according to defined policy. Proper authorization reduces excessive privilege and constrains AI behavior within approved boundaries. Typical controls include role-based access control, attribute-based policies, capability tokens, least-privilege models, and delegated permissions.
Governance
Governance defines the policies, responsibilities, and decision-making processes that guide AI deployment and operation. It establishes accountability, compliance, and oversight across technical and organizational boundaries and also ensures security controls remain aligned with legal, ethical, and operational objectives. Its common controls include policy frameworks, approval workflows, standards, audits, and organizational oversight.
Policy Enforcement
Policy enforcement ensures organizational rules are translated into technical controls that operate automatically and predictably. It provides consistent behavior regardless of user, workload, or environment. Typical controls include policy engines, rule evaluators, admission controllers, runtime enforcement, and automated compliance validation. It is important to remember that policies have little value unless they are consistently enforced.
Tool Access
Modern AI systems often interact with external tools, APIs, databases, and infrastructure. Tool Access governs which resources an AI may invoke, under what conditions, and with what permissions. Restricting tool access limits unintended actions and reduces attack surfaces. Its common controls include API allowlists, scoped credentials, sandboxing, proxy services, and capability restrictions.
Runtime Monitoring
Runtime Monitoring observes AI systems while they operate and provides visibility into behavior, detects anomalies, and supports rapid response to unexpected events. Continuous monitoring improves operational resilience and enables defenders to identify misuse before it escalates. Typical runtime monitoring controls include telemetry, behavioral analytics, alerting, logging, health monitoring, and anomaly detection.
Model Integrity
Model Integrity protects the reliability and trustworthiness of AI models throughout their lifecycle and seeks to ensure models operate as intended and have not been altered, corrupted, or replaced. Maintaining integrity supports predictable performance and trustworthy outputs. Typical controls include model signing, checksum verification, secure deployment pipelines, version control, and integrity validation.
Data Provenance
Data Provenance records where information originated and how it has been transformed over time. Understanding data lineage improves transparency, supports investigations, and increases confidence in AI outputs. Provenance is essential for auditability and regulatory compliance in the same way chain-of-custody is essential for protecting evidence. Typical controls include lineage tracking, cryptographic hashing, metadata preservation, immutable logs, and signed datasets.
Memory Custody
Memory Custody governs what an AI system is permitted to retain, derive, copy, embed, share, transfer, or permanently forget after execution. As AI systems become increasingly agentic, memory itself becomes a security boundary requiring explicit governance. Verifiable Ephemeral Data Processing and Memory Custody (VEPAM)™ (patent pending) extends this domain by introducing cryptographically verifiable evidence of retention, transfer, and deletion.
Auditability
Auditability enables organizations to reconstruct significant AI decisions and system actions after they occur. Reliable audit records improve accountability, incident response, compliance, and forensic investigations. Effective auditing requires trustworthy, tamper-resistant evidence rather than simple activity logs. Typical controls include immutable logging, signed audit records, event correlation, evidence preservation, and compliance reporting.
Shutdown Authority
Shutdown Authority provides the ability to safely suspend, isolate, or terminate AI operations when necessary. It represents the final defensive control when other safeguards fail or unacceptable risk emerges. Effective shutdown mechanisms must remain reliable under adverse conditions. Typical controls include emergency stop functions, kill switches, workload isolation, revocation mechanisms, and controlled fail-safe procedures. This domain relates to questions of dependence and potential shutdown of services.
Human Oversight
Human Oversight ensures that people remain responsible for decisions with significant operational, legal, or ethical consequences. AI may assist analysis and execution, but it does not absorb responsibility. At the end of the chain, a defined human authority must remain accountable for whether minimum duties of care were maintained. Typical controls include approval workflows, supervisory review, escalation procedures, exception handling, operator intervention, and clear assignment of responsibility.
Future Standards
AI Control Domains are presented here as an architectural vocabulary rather than a formal standard. As AI governance continues to mature, common terminology will become increasingly important for interoperability, security engineering, and policy development. The author has previously participated in standards development and intends to engage with relevant standards organizations as this framework evolves.
The United States Patent and Trademark Office
Summary
Together, these AI Control Domains provide a practical vocabulary for governing agentic AI systems. They separate threats from control points, showing where defenders can impose structure, verify behavior, preserve accountability, and respond when risk exceeds acceptable limits. The framework is intentionally architectural: anchor the domains first, then evaluate specific technologies, policies, and deployment models against them.
Consulting: Need independent analysis or security support? See AI & Cybersecurity Consulting.