{ "tool": "securitycontrols.ai — Agentic Security Control Matrix", "artifact": "vendor-feature coverage", "matrixVersion": "1.2", "asOf": "2026-06-26", "note": "Crosswalk of specific, named vendor product FEATURES to the controls they help satisfy. This is distinct from a control's `implementers` list (which only names a vendor) and from `implementerStatus` (which only classifies one). Each entry records which sub-aspect of a control a single feature addresses, how well it fits, whether the capability is vendor-claimed or independently validated, and the primary source that evidences it.", "neutrality": "Factual coverage, not endorsement. Listing a feature here is not a recommendation to buy it, and absence is not a judgement. An entry records what a vendor's own documentation says a feature does, mapped honestly to a control; `basis: claimed` means exactly that, a stated capability, not an independently proven one. We map adjacent vendors (whose products secure the human or the surrounding system rather than the agent itself) honestly, with `coverage: adjacent` or `supporting` and a sub_aspect that says so.", "axes": "Three orthogonal axes per entry: `coverage` (how well the feature fits the control: direct/partial/adjacent/supporting), `status` (OUR audit: did we check the cited source — verified/indicative), and `basis` (is the vendor capability independently validated or only vendor-claimed: validated/claimed). The basis axis is adapted from the MDR Technical Evaluation Framework's evidence discipline (claimed-only is never presented as proven).", "legend": { "coverage": { "direct": "feature directly addresses the sub-aspect", "partial": "covers part of the requirement", "adjacent": "related, broad/contextual", "supporting": "a dependency that helps satisfy it" }, "basis": { "claimed": "vendor-stated only", "validated": "independently validated (see validation_source)" }, "status": { "verified": "we checked the cited source", "indicative": "not yet source-checked" } }, "controls": [ { "id": "IA-01", "name": "Give every agent its own distinct identity, never a shared or human login", "layer": "Identity & Authority" }, { "id": "IA-02", "name": "Hand out short-lived, task-scoped keys (no long-lived secrets)", "layer": "Identity & Authority" }, { "id": "IA-03", "name": "Act on the user's behalf with explicit approval for sensitive steps", "layer": "Identity & Authority" }, { "id": "IA-04", "name": "Check permission continuously at run time, not just once at login", "layer": "Identity & Authority" }, { "id": "IA-05", "name": "Find and inventory every agent, surface the shadow ones", "layer": "Identity & Authority" }, { "id": "IA-06", "name": "Bind a signed, end-to-end provenance chain to every agent action", "layer": "Identity & Authority" }, { "id": "EC-01", "name": "Run the agent in a sandbox, from process isolation up to micro-VMs", "layer": "Environment & Containment" }, { "id": "EC-02", "name": "Filter the agent's outbound network traffic", "layer": "Environment & Containment" }, { "id": "EC-03", "name": "Keep memory short-lived, and validate anything written to it", "layer": "Environment & Containment" }, { "id": "EC-04", "name": "Limit filesystem and tool access to the bare minimum", "layer": "Environment & Containment" }, { "id": "EC-05", "name": "Cap spend and resource use, stop denial-of-wallet", "layer": "Environment & Containment" }, { "id": "EC-06", "name": "Contain runaway loops and over-reach (least-agency)", "layer": "Environment & Containment" }, { "id": "EC-07", "name": "Trust-rank retrieved content before it enters the agent's context", "layer": "Environment & Containment" }, { "id": "EC-08", "name": "Keep secrets out of the prompt and context", "layer": "Environment & Containment" }, { "id": "EC-09", "name": "Treat the workspace and its config and hooks as untrusted", "layer": "Environment & Containment" }, { "id": "EC-10", "name": "Verify trigger provenance and admit autonomous runs", "layer": "Environment & Containment" }, { "id": "PT-01", "name": "Authenticate and sign agent-to-agent communication", "layer": "Inter-Agent & Tool Protocols" }, { "id": "PT-02", "name": "Authorize tool calls and govern the MCP server registry", "layer": "Inter-Agent & Tool Protocols" }, { "id": "PT-03", "name": "Verify skill/tool manifest integrity and sign the supply chain", "layer": "Inter-Agent & Tool Protocols" }, { "id": "PT-04", "name": "Validate tool input/output, treat tool results as untrusted", "layer": "Inter-Agent & Tool Protocols" }, { "id": "PT-05", "name": "Encode and validate the agent's own output before it reaches other systems", "layer": "Inter-Agent & Tool Protocols" }, { "id": "PT-06", "name": "Sanitize model-generated tool parameters, not just the schema", "layer": "Inter-Agent & Tool Protocols" }, { "id": "PT-07", "name": "Verify tool descriptions for hidden instructions (description injection)", "layer": "Inter-Agent & Tool Protocols" }, { "id": "PT-08", "name": "Enforce an instruction hierarchy so tool output cannot give the agent orders", "layer": "Inter-Agent & Tool Protocols" }, { "id": "GV-01", "name": "Require a human hard-stop for irreversible actions", "layer": "Governance & Human-in-the-Loop" }, { "id": "GV-02", "name": "Keep an immutable, tamper-evident audit trail of what the agent did", "layer": "Governance & Human-in-the-Loop" }, { "id": "GV-03", "name": "Define multi-agent authority and conflict resolution explicitly", "layer": "Governance & Human-in-the-Loop" }, { "id": "GV-04", "name": "Enforce policy as code at run time, in the request path", "layer": "Governance & Human-in-the-Loop" }, { "id": "GV-05", "name": "Run an AI management system and tier agents by their autonomy", "layer": "Governance & Human-in-the-Loop" }, { "id": "GV-06", "name": "Cap the rate and volume of irreversible actions", "layer": "Governance & Human-in-the-Loop" }, { "id": "GV-07", "name": "Protect humans from being deceived by an agent", "layer": "Governance & Human-in-the-Loop" }, { "id": "GV-08", "name": "Make high-impact actions transactional, atomic, idempotent, state-checked", "layer": "Governance & Human-in-the-Loop" }, { "id": "GV-09", "name": "Anchor a named business owner to every agent (accountability)", "layer": "Governance & Human-in-the-Loop" }, { "id": "GV-10", "name": "Enable end-user responsibility and guard against automation bias", "layer": "Governance & Human-in-the-Loop" }, { "id": "GV-11", "name": "Plan recovery and compensation for actions the agent already committed", "layer": "Governance & Human-in-the-Loop" }, { "id": "RT-01", "name": "Capture OS-level telemetry of what the agent actually does", "layer": "Runtime Supervision & Detection" }, { "id": "RT-02", "name": "Detect direct and indirect prompt injection at every input and output", "layer": "Runtime Supervision & Detection" }, { "id": "RT-03", "name": "Supervise the agent's reasoning and check it matches its actions", "layer": "Runtime Supervision & Detection" }, { "id": "RT-04", "name": "Detect anomalies and trigger pause, kill switch, or containment", "layer": "Runtime Supervision & Detection" }, { "id": "RT-05", "name": "Apply data-loss prevention to agent egress and interactions", "layer": "Runtime Supervision & Detection" }, { "id": "RT-06", "name": "Map AI-native threats, extend ATT&CK/ATLAS to agentic orchestration", "layer": "Runtime Supervision & Detection" }, { "id": "RT-07", "name": "Detect multi-agent collusion and covert channels", "layer": "Runtime Supervision & Detection" }, { "id": "RT-08", "name": "Monitor latent and representation-level signals, not just visible reasoning", "layer": "Runtime Supervision & Detection" }, { "id": "AS-01", "name": "Adversarially red-team and evaluate the agent before launch", "layer": "Continuous Assurance" }, { "id": "AS-02", "name": "Statically analyze agent skills and manifests in CI", "layer": "Continuous Assurance" }, { "id": "AS-03", "name": "Gate releases on continuous adversarial validation", "layer": "Continuous Assurance" }, { "id": "AS-04", "name": "Run a bug-bounty / vulnerability reward program for agentic abuse", "layer": "Continuous Assurance" }, { "id": "AS-05", "name": "Study frontier offensive capability before public release", "layer": "Continuous Assurance" }, { "id": "AS-06", "name": "Verify model-weights and training-data provenance before load", "layer": "Continuous Assurance" }, { "id": "AS-07", "name": "Verify a skill does what it declares (behavioral integrity)", "layer": "Continuous Assurance" }, { "id": "AS-08", "name": "Harden and assure the security control plane as tier-zero infrastructure", "layer": "Continuous Assurance" } ], "vendors": { "Microsoft (Entra Agent ID)": { "status": "product", "url": "https://learn.microsoft.com/en-us/entra/agent-id/" }, "Okta (Auth0 Auth for GenAI)": { "status": "product", "url": "https://auth0.com/ai/docs" }, "Oasis Security": { "status": "product", "url": "https://www.oasis.security/" }, "HYPR": { "status": "product", "url": "https://www.hypr.com/" } }, "features": [ { "vendor": "Microsoft (Entra Agent ID)", "vendor_status": "product", "feature": "Agent identity as a first-class Entra service principal", "control": "IA-01", "control_name": "Give every agent its own distinct identity, never a shared or human login", "layer": "Identity & Authority", "coverage": "direct", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://learn.microsoft.com/en-us/entra/agent-id/what-are-agent-identities", "verified_on": "2026-06-26", "sub_aspect": "Registers each agent built in Copilot Studio or Azure AI Foundry as its own special service principal in Microsoft Entra ID, with a unique object ID, so the agent authenticates as itself rather than as a shared account or a human user.", "rationale": "Microsoft documents an agent identity as a special service principal in Microsoft Entra ID with its own object ID that uniquely identifies the account within the tenant, which is the per-agent distinct identity IA-01 requires." }, { "vendor": "Microsoft (Entra Agent ID)", "vendor_status": "product", "feature": "Unified agent directory and Agent ID inventory filter", "control": "IA-05", "control_name": "Find and inventory every agent, surface the shadow ones", "layer": "Identity & Authority", "coverage": "partial", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://techcommunity.microsoft.com/blog/microsoft-entra-blog/announcing-microsoft-entra-agent-id-secure-and-manage-your-ai-agents/3827392", "verified_on": "2026-06-26", "sub_aspect": "Surfaces agent identities registered in the tenant in one directory, with an Agent ID application-type filter in the Entra admin center to inventory the agents created across Copilot Studio and Azure AI Foundry. Covers agents registered in Entra, not the shadow agents running outside it.", "rationale": "Microsoft documents a unified directory plus an Agent ID application-type filter to inventory agents registered in the tenant, which is the discovery and inventory function IA-05 requires. It is a partial fit because it covers agents registered in Entra, not the shadow agents IA-05 also asks you to surface." }, { "vendor": "Okta (Auth0 Auth for GenAI)", "vendor_status": "product", "feature": "Asynchronous Authorization (CIBA with Rich Authorization Requests)", "control": "IA-03", "control_name": "Act on the user's behalf with explicit approval for sensitive steps", "layer": "Identity & Authority", "coverage": "direct", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://auth0.com/ai/docs/intro/asynchronous-authorization", "verified_on": "2026-06-26", "sub_aspect": "Lets an agent pause a sensitive action and request explicit human approval out of band over the CIBA backchannel, using Rich Authorization Requests to show the user the specific transaction (for example the exact payee and amount) before they approve.", "rationale": "Auth0 documents a CIBA-based decoupled approval flow, enhanced with Rich Authorization Requests, that asks a human to approve a specific agent action before it proceeds, which is the explicit per-action approval for sensitive steps IA-03 requires." }, { "vendor": "Oasis Security", "vendor_status": "product", "feature": "Agentic Access Management — JIT Session Identities (identity-to-prompt mapping)", "control": "IA-01", "control_name": "Give every agent its own distinct identity, never a shared or human login", "layer": "Identity & Authority", "coverage": "direct", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.prnewswire.com/news-releases/oasis-security-launches-agentic-access-management-the-first-identity-solution-built-for-ai-agents-302619375.html", "verified_on": "2026-06-26", "sub_aspect": "Provisions an ephemeral session identity per agent session and binds each prompt to a unique identity, so an agent acts under its own distinct, traceable identity rather than a shared service account.", "rationale": "Oasis documents JIT session identities that bind each prompt to a unique identity with a full audit trail, which is the distinct per-agent identity IA-01 requires. Basis is claimed: this is a recently launched capability with no independent validation located." }, { "vendor": "Oasis Security", "vendor_status": "product", "feature": "Agentic Access Management — ephemeral least-privilege session credentials", "control": "IA-02", "control_name": "Hand out short-lived, task-scoped keys (no long-lived secrets)", "layer": "Identity & Authority", "coverage": "direct", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.prnewswire.com/news-releases/oasis-security-launches-agentic-access-management-the-first-identity-solution-built-for-ai-agents-302619375.html", "verified_on": "2026-06-26", "sub_aspect": "Issues least-privilege credentials scoped to a seconds-to-minutes session and eliminates standing secrets, so an agent never holds a long-lived key.", "rationale": "Oasis documents ephemeral, least-privilege credentials for seconds-to-minutes sessions that eliminate standing secrets, which is the short-lived, task-scoped credential IA-02 requires." }, { "vendor": "Oasis Security", "vendor_status": "product", "feature": "Safe Secret Rotation (dependency-aware, vault-agnostic)", "control": "IA-02", "control_name": "Hand out short-lived, task-scoped keys (no long-lived secrets)", "layer": "Identity & Authority", "coverage": "partial", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.oasis.security/blog/stop-worrying-start-rotating", "verified_on": "2026-06-26", "sub_aspect": "Rotates, rekeys, and decommissions existing secrets with knowledge of the consuming identity, its consumers, and its resources, in manual, on-demand, or policy-based-automatic modes, so long-lived secrets that do exist are cycled without breaking dependencies.", "rationale": "Oasis documents dependency-aware secret rotation across manual, on-demand, and automatic modes. It is a partial fit for IA-02 because it manages and shortens the life of existing secrets rather than removing standing secrets entirely (which the JIT capability addresses)." }, { "vendor": "Oasis Security", "vendor_status": "product", "feature": "Agentic Access Management — Deterministic Policy Enforcement with human-in-the-loop", "control": "IA-03", "control_name": "Act on the user's behalf with explicit approval for sensitive steps", "layer": "Identity & Authority", "coverage": "direct", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.prnewswire.com/news-releases/oasis-security-launches-agentic-access-management-the-first-identity-solution-built-for-ai-agents-302619375.html", "verified_on": "2026-06-26", "sub_aspect": "A deterministic policy engine validates each agent access decision and escalates to a human-in-the-loop when the agent crosses a privilege boundary, gating sensitive actions on explicit human approval.", "rationale": "Oasis documents a policy engine that escalates with human-in-the-loop when privilege boundaries are crossed, which is the explicit approval for sensitive steps IA-03 requires." }, { "vendor": "Oasis Security", "vendor_status": "product", "feature": "Agentic Access Management — Intent Inference and per-decision policy validation", "control": "IA-04", "control_name": "Check permission continuously at run time, not just once at login", "layer": "Identity & Authority", "coverage": "partial", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.prnewswire.com/news-releases/oasis-security-launches-agentic-access-management-the-first-identity-solution-built-for-ai-agents-302619375.html", "verified_on": "2026-06-26", "sub_aspect": "Interprets what an agent is trying to do, who invoked it, and what data it accesses, and validates each access decision against policy at request time rather than only at session start.", "rationale": "Oasis documents per-decision policy validation driven by intent inference, which aligns with checking permission continuously at run time (IA-04). Partial because the evidence describes per-access-decision validation, not a documented continuous re-evaluation across a long-running session." }, { "vendor": "Oasis Security", "vendor_status": "product", "feature": "NHI Discovery, shadow-AI agent discovery, and AI-SPM", "control": "IA-05", "control_name": "Find and inventory every agent, surface the shadow ones", "layer": "Identity & Authority", "coverage": "direct", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.oasis.security/solutions/ai", "verified_on": "2026-06-26", "sub_aspect": "Continuously discovers non-human identities and unauthorized AI tools, agent-associated NHIs, and unmonitored agent activity across cloud, SaaS, and endpoints, including shadow AI, and assesses each agent's configuration and posture.", "rationale": "Oasis documents continuous discovery of unauthorized tools, NHIs, and unmonitored agent activity (shadow AI), which is the agent inventory including shadow agents that IA-05 requires." }, { "vendor": "Oasis Security", "vendor_status": "product", "feature": "Agentic Access Management — full session audit trail", "control": "GV-02", "control_name": "Keep an immutable, tamper-evident audit trail of what the agent did", "layer": "Governance & Human-in-the-Loop", "coverage": "partial", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.prnewswire.com/news-releases/oasis-security-launches-agentic-access-management-the-first-identity-solution-built-for-ai-agents-302619375.html", "verified_on": "2026-06-26", "sub_aspect": "Captures a full audit trail of the person, prompt, policy, actions, and teardown for each agent session, giving a reconstructable record of what the agent did.", "rationale": "Oasis documents a full audit trail of person, prompt, policy, actions, and teardown, which supports the audit-trail requirement of GV-02. Partial because the source documents capture and completeness but not the tamper-evident or immutable property GV-02 emphasizes." }, { "vendor": "Oasis Security", "vendor_status": "product", "feature": "Agentic Access Management — deterministic policy engine", "control": "GV-04", "control_name": "Enforce policy as code at run time, in the request path", "layer": "Governance & Human-in-the-Loop", "coverage": "partial", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.prnewswire.com/news-releases/oasis-security-launches-agentic-access-management-the-first-identity-solution-built-for-ai-agents-302619375.html", "verified_on": "2026-06-26", "sub_aspect": "Evaluates agent access against a deterministic, repeatable policy engine in the access path, giving predictable enforcement of policy rather than model-discretionary decisions.", "rationale": "Oasis documents predictable, repeatable policy enforcement of agent access decisions, which aligns with enforcing policy as code at run time in the request path (GV-04). Partial because it governs identity/access decisions specifically rather than general action policy." }, { "vendor": "Oasis Security", "vendor_status": "product", "feature": "Ownership Attribution for non-human identities", "control": "GV-09", "control_name": "Anchor a named business owner to every agent (accountability)", "layer": "Governance & Human-in-the-Loop", "coverage": "direct", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.oasis.security/product", "verified_on": "2026-06-26", "sub_aspect": "Builds an ownership inventory across cloud, SaaS, and on-prem (enriched with CMDB data) and uses heuristics and ML to attribute an owner to each non-human identity, resolving gaps through certification campaigns.", "rationale": "Oasis documents owner attribution and certification for non-human identities, which is the named-owner accountability GV-09 requires when applied to agent identities." }, { "vendor": "Oasis Security", "vendor_status": "product", "feature": "Oasis Scout — ITDR for non-human identities (AuthPrint anomaly detection)", "control": "RT-04", "control_name": "Detect anomalies and trigger pause, kill switch, or containment", "layer": "Runtime Supervision & Detection", "coverage": "partial", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.prnewswire.com/news-releases/oasis-security-launches-oasis-scout-the-first-itdr-solution-for-non-human-identities-with-authprint-technology-302362762.html", "verified_on": "2026-06-26", "sub_aspect": "Continuously monitors non-human identities to detect leaked credentials, unauthorized access, and account takeover, matching anomalous activity to known threat-actor fingerprints (AuthPrint) and raising high-fidelity alerts.", "rationale": "Oasis documents continuous anomaly and threat detection for NHIs with fingerprint matching, which aligns with the detection half of RT-04 (detect anomalies for an agent identity). Partial because the source emphasizes detection and alerting rather than the automated pause, kill switch, or containment response RT-04 also requires." }, { "vendor": "HYPR", "vendor_status": "product", "feature": "HYPR Authenticate — phishing-resistant FIDO2 passwordless authentication", "control": "IA-03", "control_name": "Act on the user's behalf with explicit approval for sensitive steps", "layer": "Identity & Authority", "coverage": "supporting", "basis": "validated", "status": "verified", "validation_type": "FIDO Alliance certification (FIDO2 / U2F / UAF)", "validation_source": "https://fidoalliance.org/company/hypr/", "evidence_url": "https://www.hypr.com/platform/hypr-authenticate-passwordless-mfa", "verified_on": "2026-06-26", "sub_aspect": "Secures the HUMAN approval step, not the agent: when a sensitive agent action is gated on a human, HYPR's FIDO2 passkey authentication makes that approval phishing-resistant and resistant to MFA-bombing and relay, so the human-in-the-loop gate cannot be trivially socially engineered.", "rationale": "HYPR provides FIDO2 phishing-resistant authentication for human users. This supports IA-03 by hardening the human approval gate, but it secures the human, not the agent, hence coverage is supporting. The FIDO2 capability itself is independently validated (FIDO certification)." }, { "vendor": "HYPR", "vendor_status": "product", "feature": "HYPR Affirm — identity verification with liveness / anti-deepfake proofing", "control": "GV-07", "control_name": "Protect humans from being deceived by an agent", "layer": "Governance & Human-in-the-Loop", "coverage": "adjacent", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.hypr.com/platform/hypr-affirm-identity-verification", "verified_on": "2026-06-26", "sub_aspect": "Adjacent to GV-07: defends the human identity-verification and account-recovery path against AI-generated impersonation (deepfakes, presentation attacks) and help-desk social engineering. GV-07 concerns agents deceiving humans; HYPR addresses attackers impersonating humans, a related but distinct deception surface.", "rationale": "HYPR documents anti-spoof and liveness identity proofing. It maps adjacently to GV-07 (protecting humans from deception) but targets impersonation of humans rather than deception by an agent. Basis is claimed: no independent biometric or presentation-attack benchmark (e.g. NIST FRVT, iBeta PAD) was located for the Affirm engine." }, { "vendor": "HYPR", "vendor_status": "product", "feature": "HYPR Adapt — adaptive / continuous authentication with OPA policy", "control": "IA-04", "control_name": "Check permission continuously at run time, not just once at login", "layer": "Identity & Authority", "coverage": "adjacent", "basis": "claimed", "status": "verified", "validation_type": "", "validation_source": "", "evidence_url": "https://www.hypr.com/platform/hypr-adapt", "verified_on": "2026-06-26", "sub_aspect": "Adjacent to IA-04: continuously re-scores human risk from device, behavioral, and contextual signals and adjusts authentication via an Open Policy Agent policy engine. It applies to the human user's session, not the agent's runtime authorization, so it is an adjacent rather than direct fit.", "rationale": "HYPR documents continuous, risk-based adaptive authentication with OPA-based policy. It aligns conceptually with checking permission continuously (IA-04) but operates on the human user, not the agent runtime, so coverage is adjacent. Basis is claimed: the risk-engine efficacy is vendor-stated with no independent benchmark." } ] }