Security & compliance

An AI agent with shell access can do, in seconds, what would once have taken a person with bad intentions real time and effort. This dimension asks the question that follows from that fact directly: what actually stops an agent from doing something destructive, unauthorized, or simply wrong — and is that protection real, or assumed?

Where most organizations start (Nascent)

Agents act anonymously. Agent activity is indistinguishable from the human who launched it, an agent may do whatever that human may do, and nothing records what it did that it should not have. The first real step is naming the actor: a per-agent or per-session credential, or a required provenance mark in the change path, on every material action — checked by review, a stated convention, or a hook that warns — plus deterministic scanning on everything generated, with the findings actually read.

Where the real gains happen (Modeled → Integral)

The meaningful shift is from checking to declaring. A small floor that every act must carry — a named actor, an authority path, no secret leaving the repository — becomes a gate rather than a habit. Each agent role then documents its authorized extent and the minimum it actually needs, and every departure from that minimum is observed and logged rather than blocked: least privilege as a stated ideal, read as telemetry. Only the irreversible, and what an obligation names, is refused outright. The bigger gain beyond that is earning further refusals from the log — a class becomes a refusal only when the evidence shows it would fire rarely and the harm is real — and mediating them at the point of action, non-bypassably, with every control declaring the paths by which it can be crossed.

What the top of the curve actually looks like (Telemetric)

At full maturity, enforcement and observation are one motion. The organization reads both where its bounds were hit and where they never were: a control contacted often points at a broken process, and a control never contacted is reviewed for removal unless it guards an irreversible act or a stated obligation. Bounds and process co-evolve with the agents that work under them, on evidence rather than on imagined failures.

Why this dimension matters

Strong code review (D8) answers "is this code good." It does not answer "was this agent allowed to run that command in the first place" — that's a different surface entirely, and this dimension is where it's governed. No amount of maturity elsewhere compensates for this one being weak.

---

Drafted from the SDLC model's v1.3.0 content (2026-10-06), which rewrote D11 around attribution, a declared minimum and observation, and removed its deferred status. Read alongside the family's guardrail rule, guardrail_rule.md.