The framework exists because the market hasn't produced a complete AI security blueprint. NIST covers risk process, OWASP covers application threats, and cloud providers publish guidance shaped around their own services. None of them is an architecture you can hand to an engineer.
The five questions
Identity: who is this agent, and who owns it
Segmentation: where can it go, and what can it reach
Behavioral monitoring: what does normal look like for this agent
Data governance: what data can it touch, and what happens if that data leaves
Incident response: who is on call, and can they stop it inside a minute
How teams use it
The common pattern is running the five questions against one agent already in production, then treating every question nobody can answer as the finding. Security teams have adopted it live on advisory calls and integrated it into their review process for agentic systems.
It sits on top of Zero Trust rather than replacing it. Zero Trust verifies each request continuously. The framework addresses what a verified agent is accomplishing across many requests, and who answers for it.