# IAM-07 Multi-factor authentication for agent admin

Domain: IAM Identity, Access & Authorization · HI-AAF v1.3 · Public review · https://humanintel.net/standard/iam/iam-07

Multi-factor authentication or equivalent is enforced on any human authentication path that can grant or modify agent permissions.

Any human authentication path that can grant or modify agent permissions, provisioning consoles, vault access, identity-provider configuration, requires multi-factor authentication. This control prevents a single compromised credential from escalating an agent's authority or modifying its identity configuration.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for IAM-07: MFA is enforced on all authentication paths that control agent permissions; enforcement is verified by testing or audit log review; exceptions are documented and risk-accepted.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- MFA is enforced on all authentication paths that control agent permissions.
- Enforcement is verified by testing or audit log review.
- Exceptions are documented and risk-accepted.

## Framework mappings

- SOC 2 (TSC): CC6.1, CC6.6
- EU AI Act: Art. 15(2)
- Singapore: AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, IAM-07 Multi-factor authentication for agent admin. Public review edition, July 2026. https://humanintel.net/standard/iam/iam-07