Scope
AAES Govern checks permission before an AI agent uses a registered tool, such as sending a message or requesting a payment. Your team can run AAES Govern on its own infrastructure, or AAES can host it for you. It governs tool use and actions routed through AAES Govern. It also checks the model calls routed through it for spend, approvals and records, and it does not store prompts or completions.
A capability is a registered tool operation. A grant gives limited permission to use it for a task. AAES Govern can block the action only when it controls the required credentials and the agent has no other route to the same result. See the key terms for a short explanation.
These pages describe the product. They are not a certification or a legal opinion. AAES does not certify that a client has met a regulator's requirements. The client remains the regulated entity.
Looking for the pre-built vendor packs instead? Those live in the capability library: registration templates for vendors such as Stripe, Slack, and GitHub, with each pack’s review status shown. The Evidence library documents what AAES Govern controls and records; the capability library lists what ships for each vendor. Use the Evidence library to review controls and records; use the capability library to choose vendor operations.
Planning an evaluation in a regulated industry? For proposed workflow tests, see the industry evaluation scenarios covering financial services, insurance, and healthcare administration.
Product evidence
Use these pages to scope a runtime evidence pack for evaluation: what AAES Govern controls, what it records, how integrity is checked, and which tests need to be run in the client's environment.
Scope and status
Enforcement boundaries, deployment status, and what to test in your environment.
Controls
Named approval, permitted capabilities, scoped grants, budget ceilings, fail-closed journal writes, and sealed records. Budget ceilings do not cap vendor spending outside AAES.
Verification
Sealed, hash-chained action records and offline integrity checks. A valid record does not prove a complete action history or a successful external-world outcome. The default deployment has zero independent witnesses.
Trust model
What AAES Govern can and cannot enforce, what happens if a component is compromised or unavailable, and what you keep if you stop using Govern.
Capability matrix
How credentials are held, which actions AAES Govern can enforce, and what is implemented. Dated and checked by automated site tests against the daemon's custody wiring.
Evaluation
Scope one workflow, its credential path, approval chain, adverse-case checks and evidence review. Client-specific results are produced during the agreed evaluation.
Native adapters are tested against local servers speaking vendor API formats, not live vendor tenants. Live tenant validation happens during a design partnership. See security disclosures for the stated internal checks and their limits.
Frameworks
Voluntary frameworks, standards, and community awareness lists a reviewer may cite. These notes describe action-layer records a reviewer can inspect; none is a scorecard of the framework.
AIUC-1 · AAES Govern record properties
Seven selected properties, what each record shows, and the remaining gaps. Not a scorecard of the AIUC-1 standard.
ISO/IEC 42001
The certifiable AI management-system standard. Which action-layer records may serve as documented information in a client's own AI management system (AIMS). AAES is not a certified product.
NIST AI Risk Management Framework
NIST AI RMF 1.0 is voluntary technical guidance. This note describes action-layer records a reviewer can inspect.
OWASP Top 10 for LLM Applications
A community awareness list, not a standard. Where action-layer controls relate to Excessive Agency, Unbounded Consumption and Prompt Injection, with the limits stated.
Communities and Working groups
Working-group drafts, community projects and public-sector programs. These notes describe design inputs and the action-layer records a reviewer can inspect; a note's presence here does not imply membership, contribution, or endorsement in either direction. AAES builds against the CSA AARM draft. That note therefore also states AAES's dated implementation position and the requirements still open. Listed alphabetically.
CoSAI Workstream 4
Vendor-neutral agentic-security guidance: the CoSAI Principles, MCP Security v2.0 (September 2026), and the agentic identity and access management (IAM) paper (March 2026) as AAES design inputs.
CSA AARM
AARM v1.0 is the public specification; AAES maps against two pre-publication drafts it reviewed from copies. AAES's dated position: internal implementation review against the pinned draft, no independent conformance assessment, and the organizational rows still open named plainly.
IETF WIMSE · AIMS
How workloads and agents identify themselves: workload identity and proof tokens (WIT/WPT), the agent-identity draft adopted 15 September 2026, and the RFC 8693 / RFC 9396 permission flows AAES Govern mirrors.
MITRE ATLAS
The threat catalog for AI and agentic systems. Selected design themes beside AAES Govern controls, without an edition-pinned technique mapping.
NIST CAISI · NCCoE
AAES Govern controls relevant to the agent-identity concept paper’s five areas: identification, authorization, delegation, logging and transparency, and tracking data flows.
OWASP Agentic Top 10 · control mapping
AAES Govern controls mapped to ASI01 through ASI10 in the 2026 Agentic Top 10, with enforcement boundaries, remaining gaps and evaluation steps. ACS conformance remains unverified.
Jurisdictions
Narrow, dated notes on instruments a risk team in each jurisdiction may ask about, with each instrument's exact status and the limits of what AAES Govern records establish. Each note shows its own review date. Notes are listed alphabetically. Not legal advice.
Australia
Voluntary AI guidance, the Privacy Act automated-decision transparency duty commencing December 2026, and APRA's CPS 230 / CPS 234 for regulated entities.
European Union
The AI Act's staged application (the Digital Omnibus, Regulation (EU) 2026/1744, in force since July 27, 2026, deferred standalone Annex III high-risk obligations to December 2, 2027), GDPR's automated-decision rules, and DORA for financial entities.
Hong Kong
Instrument status as reviewed (PDPO, PCPD framework and compliance checks, agentic-AI guidance, the SFC circular) with the limits of what AAES Govern records establish.
Japan
The AI Promotion Act in force since September 2025 (a promotion statute without penalties) and APPI for personal data.
Singapore
Instrument status as reviewed (IMDA's agentic-AI framework, MAS's final AI risk management guidelines, PDPA, FEAT) with the limits of what AAES Govern records establish.
Switzerland
No comprehensive AI statute; the revised FADP applies to AI, FINMA Guidance 08/2024 sets expectations for supervised institutions, and Council of Europe convention implementation is pending.
United Arab Emirates
Three overlapping regimes (federal PDPL, DIFC, and ADGM) plus the Central Bank's 2026 guidance on responsible AI in financial services.
United Kingdom
Sectoral regulation without a comprehensive AI statute: FCA/PRA operational resilience, critical third parties, SM&CR accountability, and UK GDPR automated-decision rules.
United States
No comprehensive federal AI statute; an executive-order push against state laws, and binding state and municipal instruments in Texas, California, Illinois, New York City and elsewhere.
Design-partner appendix
The design-partner appendix is private material under NDA, not a public download. Instrument-specific memos (including DORA) are NDA-only.
Evaluation
Start with the evaluation scope, then examine the credential path, controls, and evidence in the client's environment. Internal checks do not establish production validation or independent certification.
Read the evaluation procedure · Discuss the appendix under NDA