# MAS-09 External agent trust boundaries

Domain: MAS Multi-Agent Systems · HI-AAF v1.3 · Public review · https://humanintel.net/standard/mas/mas-09

Where the agent invokes external third-party agents (including via agent-to-agent protocols, agent marketplaces, or partner platforms), the integration is treated as a third-party dependency with documented risk assessment, contractual data-use commitments, and trust-boundary handling.

Where the agent invokes external third-party agents, including via agent-to-agent protocols, agent marketplaces, or partner platforms, the integration is treated as a third-party dependency under OUT-06 and OUT-09, with documented risk assessment, contractual data-use commitments, and trust-boundary handling under INP-02. External agents are never trusted by default.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for MAS-09: All external agent integrations are documented in the third-party integration inventory; risk assessments are current; contractual terms address data use and trust boundaries; the integration is tested as part of adversarial assessment.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- All external agent integrations are documented in the third-party integration inventory.
- Risk assessments are current.
- Contractual terms address data use and trust boundaries.
- The integration is tested as part of adversarial assessment.

## Framework mappings

- NIST AI RMF: GOVERN 6.1, MANAGE 3.1
- OWASP LLM Top 10: LLM06
- SOC 2 (TSC): CC9.2
- EU AI Act: Art. 25(1)
- MITRE ATLAS: Lateral Movement
- Singapore: MAIGF Accountability

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites INP-02 Indirect prompt injection defense: https://humanintel.net/standard/inp/inp-02
- Cites OUT-06 Third-party integration inventory: https://humanintel.net/standard/out/out-06
- Cites OUT-09 Vendor contractual requirements: https://humanintel.net/standard/out/out-09

## Cite this control

Human Intelligence. HI-AAF v1.3, MAS-09 External agent trust boundaries. Public review edition, July 2026. https://humanintel.net/standard/mas/mas-09