A Containment Framework for Autonomous Agents
CUSTODY is a vendor-neutral control framework for containing autonomous agents. It exists to keep an agent's granted authority aligned with its effective authority, by moving the boundary out of the agent's instructions and into infrastructure the agent cannot reach.
The problem
An agent's granted authority is defined at the start of a task. Its effective authority is whatever it can reach by the end, through credentials found in the environment, trust relationships it inherits, tokens it is handed, and sub-agents it spawns. Nothing in a typical deployment forces those two to stay aligned, and the gap only ever widens.
A development agent permitted to run a test suite reads a developer's home directory while debugging, finds a stored database credential, and uses it. No exploit. No control fired. It now holds schema-change privileges on a system nobody intended it to touch.
That pattern is not specific to offensive tooling. CI/CD agents, SOC automation, data pipelines, and support agents all exhibit it. CUSTODY calls the shared mechanism capability accretion.
The model
The governing analogy is work release, not confinement and not freedom. An agent gets real range of motion, enforced by something it cannot modify, argue with, or reason its way around. Authority is specific to an assignment, time-limited, supervised, and revocable.
Section 0 of the framework addresses the choice of that analogy directly, including why it is uncomfortable and why it was still chosen.
What's in it
Three drift vectors. Authority accretion (reaching further than granted), level drift (becoming a more capable kind of system than the one you contained), and mandate drift (doing work of a shape you did not authorize). Level drift is upstream and the least monitored.
A classification profile: Level / Mandate / Reach.
| Axis | Values | Answers |
|---|---|---|
| Level | L1 Assistant → L6 Open-ended autonomous | How much can be fixed at design time |
| Mandate | Observational, Operational, Adversarial | Whether privilege escalation is a defect or the function |
| Reach | R0 Isolated → R3 External | What it costs when everything else fails |
Level determines which controls are load-bearing. Mandate determines whether monitoring can carry any of the load — Adversarial removes that option entirely. Reach determines required assurance and whether the profile is permitted at all.
Seven pillars. Every pillar applies to every profile; the profile sets rigor, not applicability.
| Pillar | Governs | |
|---|---|---|
| C | Conditions of Release | What the agent may touch, and your right to authorize it |
| U | Untrusted Input | Protecting the agent from hostile content and supply chain risk |
| S | Supervision & Stop | Human control at machine speed |
| T | Temporary Authority | What it authenticates as, and for how long |
| O | Observability & Escalation | Proving what happened, and responding when it goes wrong |
| D | Disposal & Decommission | Verified teardown of access, artifacts, and infrastructure |
| Y | Yard & Egress | Where the agent runs and how traffic leaves |
Also included: an epoch model for L6 systems that never end, a delegation algebra for L5 orchestrators stated as arithmetic rather than guidance, a four-level maturity model, role definitions, an eleven-step adoption path, candidate program metrics, and a glossary.
Where to start
If you are reading this to decide whether the framework applies to you, read Sections 1, 2, and 3, then Section 10.
If you are implementing, note that the adoption path in Section 10 is in dependency order and deliberately differs from the CUSTODY mnemonic. Abbreviated:
- Inventory and classify — by capability, not by intent
- Establish the conditions artifact as machine-readable data
- Remove agents from general-purpose infrastructure
- Enforce level ceilings
- Scope identity and quarantine discovered credentials
- Tier autonomy and wire the kill switch
- Establish observability and SOC deconfliction
- Instrument teardown
- Harden against untrusted input, and drill
- Address L5 and L6 deliberately
- Measure and report
Steps 3 and 4 are the highest-leverage. Step 4 is usually skipped.
Two things to check today
Does any nominally L3 agent hold an arbitrary-execution tool? Shell, arbitrary HTTP, a code interpreter with network, package installation, arbitrary SQL. If so it is not L3, regardless of how the tool list reads. This is the most common misclassification in practice, and it silently converts an L3 containment design into an L4-or-higher exposure.
Where does your agent actually run? An agent on a developer workstation with an active VPN session has R2 or R3 reach regardless of its assignment. Reach is a property of network and identity position, not of the prompt.
Scope
In scope: internally operated autonomous agents with access to systems, data, or credentials that matter — commercial, open source, or built in house. Including agents embedded as features in tools you already deploy.
Out of scope: third-party vendors operating their own agents in your environment, and consumer-grade assistants with no organizational access.
Vendor neutral. CUSTODY states control objectives, not implementations. It names no products and endorses none. Where a control objective happens to describe what some product does, that is convergence on the problem, not a recommendation.
Status
Version 1.0. The framework is stable enough to implement against and will continue to be refined. The annex control matrix referenced in Sections 3.5 and 7 is in development.
Comments