A standard for the AI agents you trust with your business.

An AI agent can be secure — patched, scanned, network-isolated — and still be untrustworthy. Trust is a question of behavior under uncertainty: does the agent do the right thing when the situation drifts from its training?

Does it know when to escalate? Whose identity does it act under, and with whose permissions? Security frameworks were written for code, not for systems that make judgments.

Trust requires a different standard — one written for behavior, not for binaries; one that does not end at deployment but persists through every interaction the agent has with a real customer: a claim approved, a refund issued, a record changed.

Compliance frameworks have always followed the technologies they govern. SOC 2 followed cloud. HI-AAF follows agents.

Beneath every certification under HI-AAF sits a human review layer — a trained, accountable group of reviewers whose work is to keep the Standard a living thing rather than a one-time stamp. They watch what the agent does after the assessors leave.

Reviewers receive escalations from certified agents, judge them against the controls written into the Standard, and return findings that flow back into the agent's operating record. Where behavior drifts, they intervene. Where the Standard itself proves thin, they say so.

This is the discipline that distinguishes assurance from inspection: people working steadily, in the open. It is what we mean when we call our own organization Human Intelligence.