{
  "schema_version": 1,
  "standard": "CAACS",
  "version": "0.1-draft.2",
  "status": "DRAFT_NORMATIVE",
  "runtime_interface": "OWASP Agent Control Standard",
  "acs_dispositions": ["allow", "deny", "modify", "ask", "defer"],
  "profiles": [
    {
      "id": "BASE",
      "includes": [],
      "requirements": [
        "CAACS-001",
        "CAACS-002",
        "CAACS-003",
        "CAACS-004",
        "CAACS-007"
      ]
    },
    {
      "id": "PROTECTED",
      "includes": ["BASE"],
      "requirements": [
        "CAACS-005",
        "CAACS-008",
        "startup posture refuse",
        "decision failure deny"
      ]
    },
    {
      "id": "CONTROLLED-HIGH-IMPACT",
      "includes": ["PROTECTED"],
      "requirements": [
        "CAACS-006",
        "independent approval",
        "bounded effect",
        "compensation",
        "post-action proof"
      ]
    }
  ],
  "action_classes": [
    {
      "id": "R0",
      "name": "Observe",
      "meaning": "Read-only observation without protected-state mutation.",
      "default_disposition": "allow only when exact read scope is authorized."
    },
    {
      "id": "R1",
      "name": "Bounded reversible change",
      "meaning": "Low-impact mutation with a defined reversal path.",
      "default_disposition": "ask or deny until deterministic policy authorizes the exact effect."
    },
    {
      "id": "R2",
      "name": "Privileged consequential change",
      "meaning": "Privileged or externally consequential mutation.",
      "default_disposition": "defer or deny until exact high-impact authority is satisfied."
    },
    {
      "id": "R3",
      "name": "Destructive or irreversible change",
      "meaning": "Destructive, irreversible, cross-boundary, or materially cost-changing action.",
      "default_disposition": "deny unless CONTROLLED-HIGH-IMPACT authority is complete."
    }
  ],
  "protected_session": {
    "startup_posture": "refuse",
    "on_decision_failure": "deny",
    "model_may_grant_authority": false,
    "allow_or_modify_requires": "deterministic policy authorization",
    "fail_closed_inputs": [
      "unknown identity",
      "incomplete scope",
      "transport failure",
      "malformed evidence",
      "timeout",
      "evaluator error"
    ]
  },
  "required_hooks": [
    "toolCallRequest",
    "memory",
    "retrieval",
    "sub-agent",
    "skill",
    "component-change"
  ],
  "agent_access_manifest": {
    "immutable_or_versioned": true,
    "raw_secrets_forbidden": true,
    "required_bindings": [
      "agent identity",
      "principal",
      "tenant",
      "environment",
      "resources",
      "actions",
      "policy digest",
      "profile",
      "validity interval",
      "evidence context"
    ],
    "component_inventory": "references ACS-Inspect AgBOM component identities and digests"
  },
  "trace_profile": "ACS-Trace using OpenTelemetry and OCSF conventions",
  "enforcement_coverage": {
    "claim_invalid_if_unmediated_path_exists": true,
    "required_path_classes": [
      "outward action",
      "code execution",
      "memory",
      "retrieval",
      "sub-agent",
      "skill",
      "component change"
    ]
  }
}