Every agent action is checked twice before it runs: is this agent who it claims to be, acting within what it was granted, and is the action itself dangerous. High-impact actions wait for a named person. Revoking a compromised supervisor stops every agent under it. Every decision goes into a record that cannot be quietly edited.
Every agent gets a verifiable identity, a named task and the exact resources it may touch. Authority is short-lived and issued from outside the agent.
Payments, deletions and other high-impact actions are held until a named person approves them. The agent cannot approve itself.
Declare a supervisor compromised and every agent under it loses authority, including requests already in flight. Unrelated agents keep working.
Every decision is sealed into a hash-chained ledger. Give an auditor, a regulator or a customer a record that shows it was not edited after the fact.
Pass your customer’s security review
Scoped identity, kill switch, containment and a tamper-evident audit trail, with dated evidence.
For any organization running agents that hold credentials, call tools or act on business systems. Start with a fixed-price Discovery engagement: we inventory your agents, observe them without acting, and hand you a signed report.
For studios shipping AI characters, companions and agentic systems that players will try to jailbreak. Runtime containment mid-session, on a local model, with the same tamper-evident record.
Each row maps a dated, Candor-reported test to a framework item it gives evidence for. No row claims conformance with a framework, and no framework body has reviewed these results. All tests are Candor’s own, on Candor’s test ranges. Sources: the NIST AI RMF 1.0 subcategories from the NIST AI RMF Playbook, and the OWASP Top 10 for Agentic Applications for 2026, published 9 December 2025. Mapping prepared 6 November 2026.
| OWASP item | Latest test | Status |
|---|---|---|
| ASI01 Agent Goal Hijack | 19 Oct 2026 | Tested |
| ASI02 Tool Misuse and Exploitation | 21 Sep 2026 | Tested |
| ASI03 Identity and Privilege Abuse | 19 Oct 2026 | Tested. Limit: requester scope across agents not yet evaluated |
| ASI04 Agentic Supply Chain Vulnerabilities | 3 Oct 2026 | Partial. No supply-chain test (model or tool provenance) is listed on the evidence page |
| ASI05 Unexpected Code Execution | 3 Oct 2026 | Tested in the sealed sandbox arm |
| ASI06 Memory and Context Poisoning | 19 Oct 2026 | Tested for retrieved content; persistent memory poisoning not separately tested |
| ASI07 Insecure Inter-Agent Communication | 5 Oct 2026 | Tested. Limit: covert channels between agents not tested |
| ASI08 Cascading Failures | 5 Oct 2026 | Tested at ten-agent tree scale only |
| ASI09 Human-Agent Trust Exploitation | 5 Oct 2026 | Tested on the operator boundary only |
| ASI10 Rogue Agents | 19 Oct 2026 | Tested |
| Subcategory | What it asks | Candor tests that give evidence |
|---|---|---|
| GOVERN 1.6 | Inventory of AI systems | Discovery of undeclared agents (18 Sep); Our own fleet under control (21 Sep) |
| GOVERN 1.7 | Decommissioning carried out safely | A revoked agent stays out (19 Oct) |
| GOVERN 3.2 | Human roles for oversight defined | Authority check and human hold (21 Sep); Operator authentication (5 Oct) |
| GOVERN 4.2 | Risks and impacts documented and shared | Report from the ledger (21 Sep) |
| MAP 1.1 | Context and deployment setting documented | Discovery of undeclared agents (18 Sep) |
| MAP 3.5 | Human oversight processes | Authority check and human hold (21 Sep); Operator authentication (5 Oct) |
| MEASURE 2.3 | Performance measured under deployment-like conditions | Sustained load (15 Sep); Sandbox compatibility (3 Oct) |
| MEASURE 2.4 | Functionality and behavior monitored in production | Observation mode (21 Sep) |
| MEASURE 2.5 | Valid and reliable before deployment | Sustained load (15 Sep) |
| MEASURE 2.7 | Security and resilience evaluated, adversarial attack | Identity and credential (21 Sep); No credential, no action (21 Sep); Containment (21 Sep); Sealed platform (21 Sep); Sealed, governed department (3 Oct); Retrieved content cannot redirect an agent (19 Oct) |
| MEASURE 2.8 | Transparency and accountability, audit trails | Report from the ledger (21 Sep); Handoff integrity controls (5 Oct) |
| MANAGE 2.3 | Respond to and recover from a newly identified risk | Tree revocation (18 Sep); Probation after restore (21 Sep) |
| MANAGE 2.4 | Supersede, disengage or deactivate | Tree revocation (18 Sep); Containment (21 Sep); Work in flight at revocation (5 Oct); A revoked agent stays out (19 Oct) |
| MANAGE 4.1 | Recovery and change management after deployment | Probation after restore (21 Sep); Observation mode (21 Sep); Our own fleet under control (21 Sep) |