standards.sgit.ai / subsets / agentic-access
Agentic access
One problem: an organisation lets an autonomous agent hold credentials and act on real systems. Eight instruments bear on it, none of them was written with it in mind, and no single one of them answers it. This is the subset — what each requires, where they overlap, and where they diverge in ways that matter.
Read the limit first. One of these eight instruments is modelled on this site. The other seven are cited, not modelled — the rows below carry real citations and this project's own readings, and nothing here recomputes when one of those instruments changes. Why it is published anyway →
The eight
| Instrument | Kind | What it asks of agentic access | Modelled here? |
|---|---|---|---|
| EU AI Act | Law | Human oversight that can intervene and stop (Art. 14); logging with a retention minimum (Art. 26(6)); suspension and notification on a relevant condition (Art. 26(5)) — where the system is high-risk | Yes |
| GDPR | Law | A lawful basis for the processing the agent performs; data minimisation (Art. 5(1)(c)); security appropriate to the risk (Art. 32); and Art. 22 where the agent's action is a solely automated decision with legal or similarly significant effect | No — cited |
| NIS2 Directive (EU) 2022/2555 | Law | Risk-management measures covering access control and asset management; supply-chain security for the tooling the agent runs on; incident reporting on its own clock | No — cited |
| DORA Regulation (EU) 2022/2554 | Law | ICT third-party risk with contractual specificity — an agent supplied by a vendor is an ICT service, and DORA is unusually prescriptive about what the contract must say | No — cited |
| HIPAA Security Rule | Law | Access control, unique user identification, and audit controls — where the agent touches protected health information. Unique identification is the one that agentic access most often breaks | No — cited |
| ISO/IEC 27001:2022 | Standard | Annex A 5.15 access control, 5.16 identity management, 5.17 authentication information, 8.2 privileged access rights, 5.19–5.22 supplier relationships. Clause references only — the text is not reproducible | No — referenced |
| NIST CSF 2.0 · SP 800-53 | Framework | The AC and IA control families; CSF's PR.AA outcomes. Its value here is as a crosswalk target — everybody maps to NIST, which is what it is for | No — cited |
| OWASP / MITRE agentic layer Agentic Top 10 · NHI Top 10 · ATLAS | Framework | The only layer written for this problem rather than adapted to it: excessive agency, non-human identity sprawl, credential reuse across agents, and the adversarial techniques that exploit them | No — cited. CC-licensed, so it is the easiest of the seven to model next |
The throughline
The throughline across all of them is the same small set of ideas: least privilege, data minimisation, access control, supply-chain and third-party risk, traceable evidence, and accountability.
Six ideas, eight instruments. An organisation doing those six things well is in a defensible position under most of them at once — which is the reassuring half.
And where they diverge, which is the half that catches people
Six shared ideas do not mean six shared obligations. Three divergences that a merged view would hide, and a bridged one shows:
- The clocks are different. NIS2, DORA, GDPR and the AI Act each impose their own reporting timing on their own trigger, to their own addressee. One incident involving an agent can start four clocks at four different moments, and satisfying the earliest does not satisfy the others.
- “Access control” is not one requirement. HIPAA's unique user identification is a specific and awkward demand where a fleet of agents shares a service account. ISO/IEC 27001 Annex A 8.2 is about privileged access as a category. NIST's AC family is a menu with a baseline. These are three different obligations that share a phrase.
- Only one of the eight is about the agent's autonomy. Seven treat the agent as a system with credentials. The AI Act's human-oversight provisions treat it as something that acts — and the OWASP agentic material is the only framework written for that case. An organisation compliant with the other seven can still have no answer to “can a human stop it, and has anyone tried”.
The question this subset exists to make askable
Can a human meaningfully oversee it, intervene in it, and stop it — and has anyone tested that?
It is the plug question from the AI Act operator set, and the second half is what makes it useful. An oversight path in a design document is not an oversight path; it is an untested claim about one. Across all eight instruments this is the question with the fewest evidenced answers, which under this site's own rule makes it the most important output rather than the least.
What would make this a real subset
- Model OWASP next. Deep, already public, CC-licensed — no copyright problem at all — and it is the only one of the seven written for this problem. Build order 5 →
- Write one crosswalk. Any pair. Until one bridge exists this table is a list rather than a view. The five preconditions →
- Give bridges a strength. A crosswalk that can only say yes cannot express “partially, and here is why” — which is the honest answer for most of the rows above. Q4 →