By Josh Woodruff, Co-chair, CSA Zero Trust Working Group. Reviewed by Josh Woodruff. Published October 2026.
An AI agent security framework is the set of controls for software that takes actions on its own. It names each agent and limits what it can touch. It watches what the agent does and lets you stop it fast. NIST AI RMF, CISA's agentic guidance, OWASP, and CSA MAESTRO name the risks. The Agentic Trust Framework is the layer you run every day. It covers Identity Management, Behavioral Monitoring, Data Governance, Segmentation, and Incident Response, with autonomy each agent has to earn.
What should a CISO mean by "AI agent security framework"?
It's how you name each agent, limit what it can touch, watch what it does, and stop it when it leaves its lane. If you can't revoke one agent without calling a meeting, the framework isn't working yet.
A chatbot policy covers people typing into a box. It says what staff may paste and which tools they may use. That still counts. It just stops short of software that acts on its own.
Agents act, and a person isn't in the loop on every step. An agent might write a record, send a message, move money, or change who has access. Every one of those actions leaves through a tool or an API. That tool boundary is where the framework has to live.
Do this: Pick one live agent. Ask who owns it. Then ask how fast you can shut it off. If the answers live in someone's head, the framework isn't real yet. The shut-off has to work when the person who built the agent is offline. Our guide to building a kill switch for AI agents walks through it.
Which frameworks does a CISO already have, and what job does each do?
You likely have four on the shelf. Each one does a different job, and none of them is a day-to-day control plane by itself.
NIST AI RMF 1.0. Fact: NIST published it in January 2023. It sorts AI risk work into four functions: Govern, Map, Measure, and Manage (NIST AI 100-1). Our read: It's the risk language most executives and auditors already know. It isn't agent-specific, and it doesn't tell an engineer what to build.
CISA and partner guidance. Fact: On May 1, 2026, CISA, Australia's ASD ACSC, and other U.S. and international partners released Careful Adoption of Agentic Artificial Intelligence (AI) Services. It names risks like privilege creep and obscure event records. It says to avoid giving agents broad access and to start with low-risk use cases (CISA release).
OWASP. OWASP's agentic work is the risk catalog. It tells you what can go wrong with agents. Your red team and app security team will reach for it first.
CSA MAESTRO. MAESTRO is a threat model for multi-agent systems. You run it to find where an agent stack can break. It answers "what could go wrong?" The daily operating question needs a different tool.
The ATF framework comparison puts it in one line: "MAESTRO tells you what to worry about. ATF tells you what to build." Zero Trust sits under all of these frameworks.
Where does Forrester AEGIS fit in the program?
AEGIS is Forrester's CISO-facing model for securing AI agents. It spans six domains and gives you strong language for leadership updates. Pair it with an open control spec your engineers can build against and your auditor can check.
Fact: Forrester introduced AEGIS on August 12, 2026, in a public blog by Jeff Pollard. The name stands for Agentic AI Enterprise Guardrails For Information Security. The public post lists six domains:
Governance, risk, and compliance (GRC)
Identity and access management (IAM)
Data security and privacy
Application security
Threat management
Zero Trust architecture
Our read: That's a useful frame for a CISO. It also lines up with how security teams are already organized. The public blog is the part you can share. The full report is for Forrester clients, so your engineers still need an open spec.
Do this: Use AEGIS to talk about readiness with executives and peers. Use open specs for the controls your team builds and your auditor checks. The two fit together.
What does the Agentic Trust Framework add?
ATF is an open spec, licensed CC BY 4.0. The Cloud Security Alliance published it on February 2, 2026 (CSA). I created it and donated it. It asks five questions about every agent and turns them into 25 requirements. Autonomy runs from Intern to Principal. You earn it over time, and it can be taken back.
The five questions are short:
Who are your agents? That's Identity Management.
What are they doing? That's Behavioral Monitoring.
What data flows in and out? That's Data Governance.
Where can they go? That's Segmentation.
What if they go rogue? That's Incident Response.
Our read: The other frameworks name the risk. ATF is the part you run on Monday morning, and it maps to the work you already have. The comparison page crosswalks ATF to nine frameworks, including the CSA AI Controls Matrix, MAESTRO, OWASP, NIST, ISO 42001, ISO 27001, and the AWS scoping matrix. Send your architects there before anyone builds a new matrix by hand.
Fact: The spec is public, so anyone can test against it. In April 2026, Microsoft's Agent Governance Toolkit published a self-assessment against ATF v0.9.0. It reports all 25 requirements addressed: 18 fully met and 7 partially met. Microsoft labels it an internal self-assessment, not a third-party audit.
For the elements and the maturity levels, read our explainer on the Agentic Trust Framework.
How should a CISO sequence this without buying a platform first?
Start with a list of agents and a named owner for each. Put high-impact actions behind a gate outside the model. Give each agent an identity you can revoke. Map the work to the framework you already report on, like NIST, SOC 2, or ISO. Then score the five ATF elements and fix the thinnest one.
You can start with answers you already have.
Move one: know what's running. Build the inventory. Every agent gets an owner who can be paged. If nobody owns it, it shouldn't have tool access. Our AI agent inventory playbook lists the fields and the tiers.
Move two: gate the actions that hurt. Money moving, customer messages, permission changes, and hard-to-undo writes go through a gate the agent can't talk its way past. Each agent gets its own identity, so you can cut one off and leave the rest running.
Move three: map and score. Tie the controls to the framework your auditor already uses. That keeps audit on one rulebook. Then score the five ATF elements and fix the weakest one first.
When executives ask how this is going, you'll have a real answer. Our post on what a CISO should tell the board about AI agents shows how to frame it.
What is the difference between an assessment and the framework?
An assessment is a score at one point in time. It shows where your setup is thin today. A framework is the system you keep running: policy, permissions, evidence, and the right to demote an agent. You need both.
The score names which of the five elements is thin. The framework is what you run the next morning. It says who each agent is and what it may touch. It also says how you take autonomy back. A score with no operating rules goes stale. Rules with no score leave you guessing where to start.
Do this: Run the assessment first so you know where you stand. Then run the framework so the next score can move.
Related questions
Is NIST AI RMF enough for agents that can call tools?
It's a good start. NIST AI RMF gives you the risk functions and the shared language. It doesn't tell you how to give an agent its own identity or how to revoke it fast. Keep NIST as your reporting frame, and add an agent-level operating layer like ATF for the daily controls.
What evidence should I be able to show an auditor after I "adopt a framework"?
Show an agent inventory with owners and identities you can revoke. Show logs that tie each action to one agent. Show the gate on high-impact actions and a tested shut-off. Show a mapping to the framework you already report on. Our post on what evidence an auditor should expect for AI agents goes item by item.
Book a Consult
If you want help finding your thinnest element, book a 90-minute agent trust assessment. We'll score your agents against the five ATF elements and hand you a fix list in priority order. Book a Consult. You can also start with the free assessment.