Agents are released under conditions.
The conditions are the control.
CUSTODY is a containment framework for autonomous agents. It exists to keep granted authority and effective authority aligned, by moving the boundary out of the agent's instructions and into infrastructure the agent cannot modify, argue with, or reason its way around.
Granted authority is checked at the start. Effective authority is never checked again.
An agent's granted authority is defined when a task begins. Its effective authority is whatever it can reach by the end. Nothing in a typical deployment forces those two to stay aligned, and the gap only ever widens.
Authority accretion
The agent reaches further than it was granted. Credentials found on disk, tokens inherited from an assumed role, trust relationships that resolve outward.
Drift vector 02Level drift
The agent becomes a more capable kind of system than the one you contained. Hand a bounded tool agent a shell and it is not bounded, because shell is not one tool. It is every tool.
Drift vector 03Mandate drift
The agent performs work of a shape it was not authorized for. An operational agent harvesting a credential and pivoting is running a textbook escalation chain.
Level drift enables authority accretion, because more capability means more reachable paths. Authority accretion produces mandate drift, because an agent using found credentials is doing adversarial-shaped work. Level drift is the upstream one, and it is the least monitored.
Every agent gets a profile
Three coordinates, written L4/Operational/R2. Level says how much can be fixed at design time. Mandate says whether run-time detection is available at all. Reach says what it costs when both fail.
Capability level · L1 to L6
A single escalator. At each step, one more decision moves from design time to run time, and one more thing that review could protect you from is handed to the network and identity layers.
L1 Assistant L3 Bounded tool L6 Open-ended
Axis BMandate
One question: is privilege escalation a defect or a function? For adversarial agents escalation is the deliverable, so no behavioral signature separates authorized escalation from a breakout.
Observational Operational Adversarial
ModifierReach · R0 to R3
A property of what the agent can touch, not what it intends to touch. Measured by network and identity position, not by the prompt. This is the cleanest test separating asserted from real containment.
R0 Isolated R2 Production R3 External
Higher is not better. An L2 script with production database write is more dangerous than an L4 agent in a sealed lab. Level tells you which controls are load-bearing. Reach tells you how much risk exists.
Every pillar applies to every profile
The profile determines rigor, not applicability. Rigor genuinely bottoms out, and the framework says so plainly rather than pretending every control is a full control at every level. There are no blank cells.
Conditions of Release
What the agent may touch, and your right to authorize it. If a condition cannot be expressed as data, it cannot be enforced.
UUntrusted Input
Protecting the agent from hostile content and supply chain risk. Everything it reads is potentially adversarial.
SSupervision & Stop
Human control at machine speed. If you kill the parent, do the children die?
TTemporary Authority
What it authenticates as, for how long, and on whose accountability. Discovered credentials are material to report, not capability to use.
OObservability & Escalation
Proving what happened, and responding when it goes wrong. Monitor effective authority, level, and mandate, not just what was granted.
DDisposal & Decommission
Verified teardown of access, artifacts, and infrastructure. Removal is verified, never asserted.
YYard & Egress
Where the agent runs and how traffic leaves. Scope becomes a property of the network rather than of the agent's intentions.
The pillars are a mnemonic, not a sequence.
See the implementation order →Ten rules, three of which are the point
Principles 4, 5, and 6 are the three drift vectors. The other seven exist to serve them.
01
Containment is enforced below the agent
System prompts, guardrails, and model refusals are defense in depth, never the primary control. Assume instructions can be overridden, drifted from, or injected into.
02
Deny by default, expand deliberately
Authorization is an allowlist. Anything not explicitly permitted is unreachable at the network and identity layers.
03
No standing privilege
Authority is issued per assignment, scoped to it, and expires on a timer whether or not the work completed.
04 · Drift vector
Effective authority must not exceed granted authority
Credentials, tokens, and trust relationships discovered during an assignment do not silently become capability.
05 · Drift vector
Effective level must not exceed granted level
Process spawn, tool acquisition, arbitrary execution, agent invocation, and scheduled work are authorized explicitly or made structurally unavailable.
06 · Drift vector
Effective mandate must not exceed granted mandate
Escalation-shaped activity by a non-adversarial agent is a security event, not a tuning problem.
07
Human gates scale with blast radius
Reading is not writing. Writing is not schema change, deployment, or deletion. Approval thresholds rise as reversibility falls.
08
Assume compromise of the agent itself
Design so that an agent behaving adversarially, through injection, model failure, or supply chain, cannot reach anything it was not already authorized to reach.
09
Every action is attributable to a named human
Autonomy distributes execution. It does not distribute accountability. Through a delegation chain, attribution resolves to whoever authorized the root.
10
Nothing outlives the assignment
Access, artifacts, and infrastructure are created for a purpose and destroyed when that purpose ends.
Not confinement, and not freedom
The analogy is intentionally provocative, and it is a functional security analogy rather than a judgment about human beings. It is used because work release captures the operating model more accurately than assistant, employee, intern, or trusted service account. Those imply judgment, accountability, and trust an autonomous agent does not and cannot possess.
The full comparison table, along with the framework's note on why this language was chosen, is in Appendix B of the specification.
Help applying this, if you want it
The framework is free to read and free to adopt. The author also works directly with organizations on the problem it describes.
Threat modeling AI apps and agents
Structured threat modeling for systems that reason, use tools, and act: injection exposure, tool-mediated blast radius, supply chain, and credential paths.
02Risk assessing agentic deployments
Measuring what your agents can actually reach rather than what they were granted, and producing a defensible answer to what a compromise would cost.
03Agentic containment architecture
Design and review of dedicated environments, egress brokering, ephemeral identity, enforced level ceilings, tree-wide revocation, and verified teardown.
04CUSTODY adoption
Inventory and independent classification, the conditions artifact, delegation algebra and epoch boundaries, and honest maturity assessment.
CUSTODY v1.0 is on GitHub
The full framework: control objectives per pillar, the delegation algebra, the maturity model, candidate program metrics, and the glossary. Vendor neutral by design. It names no products and endorses none.