# ACT-08 Tool result validation

Domain: ACT Action & Tool Use Controls · HI-AAF v1.3 · Public review · https://humanintel.net/standard/act/act-08

Tool result validation is performed before consumption: schema validation, sanity checks, and screening against known malicious signatures.

Outputs returned by tools the agent calls are validated before being incorporated into further reasoning or action. Validation includes schema validation, sanity checks (e.g., result size, expected fields), and screening against known malicious signatures. This control prevents a compromised or malfunctioning tool from injecting harmful data into the agent's decision path.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for ACT-08: Validation is applied to all tool outputs; validation rules are documented per tool; validation failures are logged and surfaced; at least one validation failure has been caught in production or testing.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Validation is applied to all tool outputs.
- Validation rules are documented per tool.
- Validation failures are logged and surfaced.
- At least one validation failure has been caught in production or testing.

## Framework mappings

- NIST AI RMF: MEASURE 2.6
- ISO/IEC 42001: A.8.4
- OWASP LLM Top 10: LLM08
- SOC 2 (TSC): CC7.1
- EU AI Act: Art. 15(3)
- MITRE ATLAS: Execution
- Singapore: MAIGF Operations Management

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, ACT-08 Tool result validation. Public review edition, July 2026. https://humanintel.net/standard/act/act-08