The runtime control plane for AI agents.
Agent Control Standard (ACS) is the open standard that defines how agent platforms expose middleware hooks and how open-source tooling enforces safety policy through those hooks. Declarative controls. Portable across frameworks. Enforced at runtime.
Agents are shipping fast. Controls are not
AI agents act across organizational boundaries. The industry standardized how agents communicate through MCP and A2A, and documented the risks through the OWASP Agentic Top 10. Runtime control never got the same treatment.
- System prompts are not controls.
- Model improvements do not cover edge cases or adversarial inputs.
- Proprietary guardrails create vendor lock-in.
Three layers, one standard
Instrument
ACS defines standardized middleware hooks at every agent decision point. A Guardian Agent intercepts the action and returns a verdict: allow, deny, or modify.
Trace
Agents emit structured trace data through OpenTelemetry, the pipeline your teams already run. ACS maps those traces to OCSF so security events land in the SIEM without a custom parser.
Inspect
Enterprises cannot secure what they cannot inventory. AgBOM captures tools, models, and dependencies as the agent acquires them, which a static SBOM cannot do.
How it works
Tier 1: Platform layer
Agent frameworks expose standardized middleware hooks.
Tier 2: Enforcement layer
An open-source SDK reads declarative policy and returns verdicts through those hooks.
Tier 3: Enterprise layer
Custom classifiers and domain-specific logic plug in behind the same interface.
Why now
The EU AI Act requires high-risk AI systems to be designed for effective human oversight, including the ability for a person to intervene in or interrupt the system (Regulation (EU) 2024/1689, Article 14). The NIST AI Risk Management Framework, which is voluntary guidance rather than regulation, describes continuous monitoring and the ability to deactivate systems operating outside intended limits (NIST AI 100-1, MANAGE 2.4).
Both describe controls that exist at runtime. Neither is satisfied by a system prompt.
Built with the community
ACS maps onto standards your teams already run. It adds a control layer rather than replacing any of them.
- OWASP ASI The agentic risk taxonomy ACS controls are written against.
- AIVSS Severity scoring for the findings ACS surfaces.
- OpenTelemetry The transport ACS emits its trace data over.
- OCSF The event schema ACS maps traces onto for the SIEM.
- CycloneDX One serialization for the Agent Bill of Materials.
- SPDX A second AgBOM serialization, for teams already standardized on it.
- MCP A tool protocol ACS hooks wrap without modifying.
- A2A An agent-to-agent protocol ACS hooks wrap without modifying.
Spec status
| Specification version | v0.1.0 |
|---|---|
| Published schemas | 44 |
Every schema resolves at the URI its $id declares. Start at
the root schema.
Workstreams
Each workstream owns a slice of the standard and runs its own review.
| Workstream | Leads |
|---|---|
| Coding Agents | Almog Langleben (@almogbhl), Stefano Amorelli (@stefanoamorelli) |
| Development (SDK) | Rock Lambros (@rocklambros), Fred Wilmot (@fewdisc) |
| Identity | Eva Benn (@evabenn), Richard Bird (@RbBuiltWrong) |
| Outreach | Eva Benn (@evabenn), Aruneesh Salhotra (@aruneeshsalhotra) |
| Spec | Bar Kaduri (@bar-capsule), Ariel Fogel (@afogel) |
Contribute
ACS is an open specification. The fastest way to shape it is to use it and tell us what breaks.
- Join owasp.slack.com and the
#team-genai-asi-acs-generalchannel. - Open an issue or a discussion on GitHub.
- General questions about the project: rock.lambros@owasp.org
Reporting a problem
Report a security vulnerability through GitHub private vulnerability reporting, which is the channel our security policy covers. Report a Code of Conduct concern through the OWASP Code of Conduct process, which handles reports independently of this project's maintainers.