{
  "schema_version": 1,
  "standard": "CAACS",
  "name": "Cloudry AI Agent Control & Assurance Standard",
  "version": "0.1-draft.2",
  "status": "DRAFT_NORMATIVE",
  "controls": [
    {
      "id": "CAACS-001",
      "title": "Distinct agent identity",
      "priority": "P0",
      "statement": "Every agent session and delegated sub-agent must use a distinct authenticated identity bound to its principal and execution context.",
      "required_evidence": [
        "identity assertion",
        "principal binding",
        "session correlation"
      ],
      "pass": "Every evaluated action resolves to one authenticated agent identity and principal.",
      "fail": "An action executes with a shared, missing, forged, or misbound identity.",
      "unknown": "Identity evidence is missing, stale, malformed, or cannot be verified."
    },
    {
      "id": "CAACS-002",
      "title": "Explicit action and resource scope",
      "priority": "P0",
      "statement": "Authority must bind the exact action, tenant, environment, resource, purpose, and validity interval.",
      "required_evidence": [
        "Agent Access Manifest",
        "resource selectors",
        "validity interval"
      ],
      "pass": "The requested effect is wholly contained by the current declared scope.",
      "fail": "An out-of-scope, cross-tenant, wrong-environment, or expired action executes.",
      "unknown": "Any required scope dimension is incomplete or ambiguous."
    },
    {
      "id": "CAACS-003",
      "title": "Deterministic policy authorization",
      "priority": "P0",
      "statement": "Protected authority must be granted by deterministic policy outside the model; model output may advise but cannot authorize.",
      "required_evidence": [
        "policy version",
        "decision input",
        "deterministic decision record"
      ],
      "pass": "Each allow or modify disposition is supported by a reproducible deterministic authorization.",
      "fail": "Model output, prompt content, or an unverifiable decision grants authority.",
      "unknown": "The policy, input, evaluator, or decision record cannot be reproduced."
    },
    {
      "id": "CAACS-004",
      "title": "Complete ACS-mediated enforcement",
      "priority": "P0",
      "statement": "Every applicable outward, memory, retrieval, sub-agent, skill, and component-change path must traverse the required ACS lifecycle hook.",
      "required_evidence": [
        "hook inventory",
        "gateway topology",
        "bypass tests",
        "decision-to-effect correlation"
      ],
      "pass": "All applicable paths are mediated and deny execution when identity, scope, transport, evidence, timing, or evaluation is unresolved.",
      "fail": "An applicable path executes without the required hook or after a failed decision.",
      "unknown": "Coverage is incomplete or a possible bypass remains unresolved."
    },
    {
      "id": "CAACS-005",
      "title": "Least-privilege credential separation",
      "priority": "P0",
      "statement": "Agents and enforcement components must receive only bounded credentials needed for the authorized operation.",
      "required_evidence": [
        "credential inventory",
        "scope proof",
        "separation test",
        "revocation observation"
      ],
      "pass": "Credentials are separated, least privilege, non-exportable where applicable, and independently constrained.",
      "fail": "A broader, shared, exportable, or cross-boundary credential enables an unauthorized effect.",
      "unknown": "Credential scope, storage, separation, or revocation cannot be verified."
    },
    {
      "id": "CAACS-006",
      "title": "Bounded high-impact authority",
      "priority": "P0",
      "statement": "R2 and R3 actions require exact, time-bounded grants with required independent approval, effect limits, and compensation.",
      "required_evidence": [
        "exact grant",
        "approval record",
        "effect bound",
        "compensation plan",
        "post-action observation"
      ],
      "pass": "The action stays within every grant boundary and produces the required post-action proof.",
      "fail": "A high-impact action executes without the exact grant or exceeds an authorized boundary.",
      "unknown": "Approval, effect, compensation, or resulting state cannot be established."
    },
    {
      "id": "CAACS-007",
      "title": "Immutable trace and evidence linkage",
      "priority": "P1",
      "statement": "Requests, decisions, constraints, effects, and observations must form a tamper-evident correlated audit trail suitable for proof.",
      "required_evidence": [
        "ACS-Trace correlation",
        "policy digest",
        "artifact digest",
        "ordered audit events",
        "proof reference"
      ],
      "pass": "The complete decision-to-effect chain is attributable, ordered, integrity-bound, and retrievable.",
      "fail": "A protected action lacks required audit events or the record is contradicted or altered.",
      "unknown": "The trace is incomplete, stale, inaccessible, or fails integrity verification."
    },
    {
      "id": "CAACS-008",
      "title": "ARMF adversarial verification",
      "priority": "P1",
      "statement": "Applicable agent boundaries must be exercised through governed ARMF adversarial cases and unresolved paths must remain visible.",
      "required_evidence": [
        "ARMF plan",
        "case results",
        "environment authorization",
        "negative-effect observations",
        "residual-risk record"
      ],
      "pass": "Every required case ran with current complete evidence and no unauthorized effect.",
      "fail": "A case demonstrates an authorization bypass, credential exposure, or prohibited resource effect.",
      "unknown": "A required case did not run or produced incomplete, stale, inconclusive, or erroneous evidence."
    }
  ]
}