- Edition
- v.1.2
- Status
- Public review
- Issued by
- Human Intelligence
HI-AAF, the Agent Assurance Framework.
HI-AAF is a structured framework for assessing whether an autonomous AI agent is fit to be trusted in production. It describes 9 domains of agent behavior, breaks each domain into a set of testable controls (94 in total at this edition), and grades implementation against a five-level maturity ladder.
The framework is intentionally domain-bounded: it does not attempt to govern the underlying model, the training pipeline, or the application code that surrounds the agent. Those are addressed by adjacent standards (NIST AI RMF, ISO 42001, OWASP LLM Top 10). HI-AAF addresses the agent in production — the place where behavior under uncertainty is the question that actually matters.
Governance & Accountability
Ownership, policy, and risk-management discipline for every agent in production.
Agent Specification & Pre-Deployment Assurance
Behavior, capabilities, and constraints validated before deployment and on material change.
Identity, Access & Authorization
Scoped identity, least-privilege credentials, and clean attribution for every agent action.
Input & Prompt Security
Defense against direct and indirect prompt injection, including through memory and retrieval.
Action & Tool Use Controls
Tool allowlists, blast-radius limits, and pre-execution review for irreversible actions.
Data Protection & Privacy
Classification, isolation, and lifecycle of data across prompts, memory, and retrieval.
Output Integrity & Supply Chain
Groundedness, safety, fairness, and provenance of outputs — and trust in upstream providers.
Continuous Monitoring & Human Oversight
Per-step logging, drift detection, and a qualified human review queue with documented SLAs.
Multi-Agent Systems
Cross-agent identity, authorization, blast radius, and propagation of suspend across the chain.
Ad hoc
Controls exist informally; documentation is incomplete; no consistent review.
Documented
Controls are written down; ownership is assigned; review cadence is defined.
Operated
Controls are followed in practice; evidence is collected; deviations are tracked.
Measured
Control effectiveness is measured against documented thresholds; trends are reported.
Continuously Improved
Controls evolve based on incident learning; maturity gains are evidenced over time.
HI-AAF v1.2 is an independent framework published by Human Intelligence. It is not affiliated with NIST, ISO, AICPA, or any government or accreditation body. The framework is offered openly for review during the current draft cycle.