FedRAMP 20x uses Key Security Indicators (KSIs) to evaluate the security posture of cloud services. It does not yet define agent-specific indicators for software that can plan, call tools, delegate work, and act on systems with limited human direction.
Agentic systems introduce a different set of assurance questions:
- What authority does an agent actually have?
- What can it reach?
- What actions did it take?
- What can it delegate to another agent?
- Can an action be stopped before it creates an unintended effect?
- If something goes wrong, can the whole workload, including descendant agents and queued work, be contained?
Those questions get harder as agents move through a task. An agent may start with a defined set of permissions, then call another tool, retrieve protected data, delegate work, or take a series of actions that are individually permitted but produce an unacceptable outcome when combined. What an agent was originally configured to do tells you only part of the story.
Agentic assurance has to account for behavior as the system operates: authority, delegation, enforcement, evidence, and recovery.
Download the full white paper: Agentic AI Assurance for FedRAMP 20x
A Framework for Those Questions
38North Security developed the Agentic AI Assurance framework as a nine-indicator augmentation framework for agentic systems operating in a FedRAMP 20x environment.
The nine indicators cover:
- Agent Inventory: whether the organization maintains a current inventory of agentic AI and can reconcile it against observed activity.
- Agent Authority and Scope: what an agent can access, delegate, and change.
- Agent Action Trail: whether its actions can be reconstructed through an immutable, attributable trail.
- Enforced Effect Boundaries: whether consequential effects are constrained before they occur.
- Human Review, Override and Halt: whether people can meaningfully approve, interrupt, or stop agent activity.
- Goal and Input Integrity: whether goals, prompts, memory, and inter-agent instructions are protected from manipulation.
- Agent Supply-Chain Vetting: whether models, tools, plugins, agents, and other dependencies are vetted and revalidated after material changes.
- Proportionate Testing and Monitoring: whether agents are tested and monitored according to the consequences of their use.
- Agent Containment and Recovery: whether an agentic workload can be contained and recovered when something goes wrong.
The indicators are defined by 38North Security and sit alongside the existing FedRAMP 20x model. They do not replace or modify FedRAMP-defined KSIs or their required validations.
The Evidence Has to Keep Up With the System
Defining the indicators is only half of the problem. The other half is deciding what evidence is strong enough to support an assurance claim. The framework separates evidence into two categories.
Observed evidence comes from the running system: cloud audit trails, identity and permission configuration, enforcement-point logs, and other operational sources.
Attested evidence comes from customer-maintained governance records such as inventories, classifications, policies, allowlists, testing records, and recovery procedures.
The framework treats them differently, as well.
Observed evidence can support a scored result. Attested evidence remains informational. If neither observed nor attested evidence can support a requirement, the result does not default to a pass. You can see why this becomes useful once agents are acting across systems.
Take logging. An agent may produce a perfectly preserved record of what it says it did. That record still needs corroboration from the systems where the activity actually occurred. As the framework puts it, an immutable record can faithfully preserve a false account. Agent action trails therefore rely on enforcement points and target systems, with attributable identities and explicit outcome states.
Authorization has a similar problem. Checks need to happen before a consequential effect occurs. Every route capable of producing that effect (API, browser, shell, code execution, or another path) has to pass through an enforcement point. Blocking one route leaves a gap if the same outcome is still reachable another way.
The framework also treats authorization as stateful. A series of permitted actions can add up to an outcome that should never have been allowed. Evaluating an agent therefore means looking at the state of the task as it moves across tools, time, and other agents.
Where the Blueprint Alliance Fits
The Agentic AI Assurance framework is aligned to the Blueprint Alliance architecture for securing agentic systems. The Blueprint Alliance organizes the problem around four questions:
- Where are my agents?
- What can they do?
- What are they doing?
- How do I respond?
Those questions give the nine indicators a useful organizing structure. Inventory, supply-chain vetting, and testing help answer where agents are. Authority and effect boundaries help establish what they can do. Action trails and runtime controls help show what they are doing. Containment and recovery address what happens when intervention becomes necessary.
38North Security uses the Blueprint architecture as a crosswalk. The Blueprint does not determine whether an indicator passes or fails and does not serve as an evidence authority. The framework’s published foundations remain NIST, OWASP, and OMB guidance.
Extending Assurance to Agentic Systems
FedRAMP 20x moves cloud assurance toward evidence that stays current as the system operates. Agentic AI adds another layer to that problem because the software itself can make decisions, invoke capabilities, delegate work, and produce effects while the task is underway. That changes what teams need to be able to see and demonstrate.
The authority an agent was given matters. So does the authority it can actually exercise. The controls surrounding an agent matter. So does what happens at the enforcement point when the agent tries to act. A recovery procedure matters. So does whether the organization can successfully stop an active workload when tested.
The Agentic AI Assurance framework is an initial model for evaluating those conditions in a FedRAMP 20x environment. The principle behind it is straightforward:
Assurance should reflect what the system can demonstrate, not merely what it claims.
NorthWatch implementation of the framework is currently in progress. The complete indicator set and scan results described in the white paper are not yet generally available production capabilities.
Download the full white paper: Agentic AI Assurance for FedRAMP 20x
Working through agentic AI in a FedRAMP environment? Talk with 38North Security about how to evaluate authority, evidence, and runtime behavior in your system. -> https://38northsecurity.com/contact/
About the Author
