The Four Dimensions Framework
TRUST, CRED, PRIV, and BEHAVE
Why Four Dimensions, Not a New Category
It’s tempting to treat AI agent governance as an entirely new discipline, requiring its own tools, its own vocabulary, its own compliance category. We don’t think that’s right. Every governance question an AI agent raises decomposes into one of four questions identity governance has always asked of every principal on a network — human, device, service account, or agent:
Has this principal been vouched for, and does that chain still hold? Can it prove who it is? What is it permitted to do? Is it behaving consistently with why it exists?
Those four questions are TRUST, CRED, PRIV, and BEHAVE. They don’t change for AI agents. What changes is the mechanism for answering them.
TRUST — Provenance and Accountability
Every agent needs an identity that can be trusted before it touches production. That means a named human or organizational sponsor — a person accountable for the agent’s deployment, its capability scope, and its actions. Another agent cannot serve as a sponsor; the accountability chain has to resolve to a person.
It also means model provenance: which foundation model underlies this agent, what fine-tuning has been applied, and whether the system prompt and tool manifest can be verified against what was actually approved. This is the AI-era equivalent of a software bill of materials — without it, an agent has no established TRUST position, no matter how sophisticated its other controls.
CRED — Proof of Claim
Traditional credentialing assumes a persistent principal: issue a credential, hold it, present it. Agents break that model. An agent may exist for seconds, spawn dozens of child processes, and authenticate to a dozen services in a single task. A long-lived API key sitting in an agent’s context is not an operational convenience — it’s a breach surface.
The correct pattern is workload identity: short-lived, cryptographically attested credentials issued at runtime and scoped to the specific task, discarded when the task completes. When an agent delegates to a sub-agent, the sub-agent’s credential should be scoped narrower than the parent’s — every hop in a delegation chain should reduce privilege, never preserve or expand it.
PRIV — Authorized Scope
An agent doesn’t have a role. It has a tool manifest, and it decides at runtime which tools to invoke, with what parameters, based on its reasoning about the current task. That tool manifest is the agent’s entitlement set, and it deserves the same governance rigor as a human access grant: who authorized this manifest, what’s the blast radius if a tool is misused, and does the agent still need it.
Just-in-time, just-enough-access should be the default: tool access granted for the task at hand and revoked when it’s done. And for actions with real consequences — sending external communications, deleting data, modifying production systems — human authorization should be required by architecture, not by a policy an agent’s reasoning could talk itself around.
It’s worth being direct about a limitation here: no finite tool manifest or authorization policy can fully anticipate every context an autonomous reasoner will encounter. PRIV controls are necessary, but they are not sufficient on their own — which is exactly why BEHAVE has to carry real weight.
BEHAVE — Runtime Conformance
Traditional behavioral monitoring compares a principal’s current activity against its historical baseline. Agents don’t have a meaningful historical baseline — they’re designed to behave differently depending on input. The right anchor isn’t history; it’s declared purpose. Is this agent acting within the scope of what it was instantiated to do?
Tool-call sequences are the primary signal — the agent equivalent of keystroke patterns for a human. When an agent drifts outside its declared purpose, the response shouldn’t default to a blunt shutdown. A tiered model works better: minor, explainable drift gets a session reset; unexplained deviation gets scope reduction and a sponsor notification; confirmed compromise gets a hard deny and credential revocation. Reflexive binary denial throws away the most useful thing BEHAVE just produced — a precise signal about what moved and by how much.
The Four Dimensions Together
These dimensions aren’t independent monitoring silos — they form a continuous loop. When BEHAVE detects drift, that signal feeds back into a live reassessment of the agent’s TRUST position. Weakness in any one dimension undermines the others: strong credentials don’t compensate for an unverified sponsor, and a clean tool manifest doesn’t compensate for a delegation chain that’s grown too deep. Governing an agent means characterizing its position across all four dimensions continuously, not certifying it once at deployment and assuming it holds.
Contact Us
Get in touch to discuss how this framework applies to the agents already running in your environment.