{"ok":true,"data":{"standard":"CG-AG — CodeGuard Agent Governance Framework","version":"1.0.0","license":"CC BY 4.0","purpose":"The open standard for AI agent governance. Every AI agent in production should satisfy these 12 controls.","mappedFrameworks":["EU AI Act 2024/1689","DORA (EU) 2022/2554","ISO/IEC 42001:2023","NIST AI RMF 1.0"],"controls":[{"id":"CG-AG-001","name":"Agent Inventory","domain":"inventory","description":"Every AI agent must be formally registered in the master agent inventory before operating.","traceability":{"aiAct":"Art. 16 (provider obligations)","iso42001":"A.6.2 (AI system inventory)","nist":"GOVERN 1.1"}},{"id":"CG-AG-002","name":"Agent Owner","domain":"ownership","description":"Every registered agent must have an identified, accountable human owner.","traceability":{"aiAct":"Art. 26 (deployer obligations)","iso42001":"A.3.2 (roles & responsibilities)","nist":"GOVERN 2.1"}},{"id":"CG-AG-003","name":"Model Registration","domain":"models","description":"Every agent's AI model must be documented with model name and provider.","traceability":{"aiAct":"Art. 11 (technical documentation)","iso42001":"A.7.2 (data & model documentation)","nist":"MAP 2.3"}},{"id":"CG-AG-004","name":"Tool Authorisation","domain":"access","description":"Every tool and external resource accessed by an agent must be explicitly authorised before use.","traceability":{"aiAct":"Art. 9 (risk management)","dora":"Art. 9 (ICT protection)","iso42001":"A.5.3 (access control)"}},{"id":"CG-AG-005","name":"Prompt Governance","domain":"prompts","description":"Prompts must be registered, versioned, and assessed for robustness and injection risk.","traceability":{"aiAct":"Art. 15 (accuracy & robustness)","nist":"MEASURE 2.7 (prompt injection)"}},{"id":"CG-AG-006","name":"MCP Server Governance","domain":"mcp","description":"All MCP server connections must be registered, classified, and periodically reviewed.","traceability":{"dora":"Art. 28 (third-party ICT)","iso42001":"A.10.3 (supplier AI)","nist":"GOVERN 6.1"}},{"id":"CG-AG-007","name":"Human Oversight","domain":"oversight","description":"Every agent must have an appropriate human oversight level calibrated to its risk.","traceability":{"aiAct":"Art. 14 (human oversight)","iso42001":"A.8.4 (human oversight)","nist":"GOVERN 3.2"}},{"id":"CG-AG-008","name":"Audit Trail","domain":"audit","description":"Agent activities and governance state changes must be captured in an immutable audit ledger.","traceability":{"aiAct":"Art. 12 (record-keeping/logs)","dora":"Art. 12 (logging)","iso42001":"A.6.7 (event logs)"}},{"id":"CG-AG-009","name":"Data Governance","domain":"data","description":"Every resource carrying PII, PHI, or financial data must undergo a mandatory data governance review.","traceability":{"aiAct":"Art. 10 (data governance)","iso42001":"A.7.3 (data quality)","nist":"MAP 2.2"}},{"id":"CG-AG-010","name":"Risk Classification","domain":"risk","description":"Every agent must be assigned both an operational risk level and an AI Act risk class.","traceability":{"aiAct":"Art. 6 + Annex III (classification)","iso42001":"A.5.2 (risk assessment)","nist":"MAP 1.5"}},{"id":"CG-AG-011","name":"Agent-to-Agent Governance","domain":"a2a","description":"All agent-to-agent relationships must be explicitly registered in the agent graph.","traceability":{"aiAct":"Art. 9 (interaction risk)","dora":"Art. 30 (chain outsourcing)","nist":"MEASURE 2.9"}},{"id":"CG-AG-012","name":"Autonomous Agent Governance","domain":"autonomous","description":"Autonomous agents require elevated oversight, fallback mechanisms, and enhanced monitoring.","traceability":{"aiAct":"Art. 14 (autonomous oversight)","iso42001":"A.8.4","nist":"GOVERN 3.2 / MANAGE 2.4"}}]}}