82% of organizations have discovered unknown AI agents in their environments. CSA and CSAI Foundation research reveals critical governance gaps. SWT3 procedures fill them with cryptographic evidence today.
Who this is for: CISOs, security architects, cloud security teams, and AI governance committees evaluating agentic AI deployments. Assumes familiarity with identity and access management, cloud security posture management, and AI governance frameworks.
Critical Assessor Notice: Boundaries of Cryptographic Evidence
SWT3 witness anchors prove that specific governance-relevant events occurred at a specific point in time. They do not replace the assessor's independent judgment, professional expertise, or regulatory authority. The protocol does not make pass/fail compliance decisions on behalf of any regulatory body. Substance verification remains the assessor's responsibility.
| Source Research | Cloud Security Alliance (CSA), "AI Agent Governance Gap" Research Note, April 2026 |
| CSAI Foundation | "Securing the Agentic Control Plane" initiative, CVE Numbering Authority for agent vulnerabilities |
| Catastrophic Risk Annex | 4 phases, June 2026 through December 2027 |
| Key Gap | 82% of organizations have discovered unknown agents; only 18% have IAM confidence for agent governance |
| SWT3 Procedures Mapped | 16 procedures across AI, NHI, and infrastructure namespaces |
| Core Recommendation | Build governance documentation, agent inventories, and audit log infrastructure now, before sector regulations are interpreted to cover agent deployments (12-18 month timeline) |
| Coverage Model | Identity first, then authorization, then monitoring |
The Cloud Security Alliance published its AI Agent Governance Gap research in April 2026. The findings are stark: organizations are deploying autonomous AI agents faster than their governance, identity, and monitoring infrastructure can keep pace. The result is a growing population of unknown, ungoverned, and unmonitored agents operating across production environments.
Additional findings compound the problem:
CSA's central recommendation is clear: organizations should build governance documentation, agent inventories, and audit log infrastructure now, before sector-specific regulations are interpreted to cover agent deployments. The estimated timeline for regulatory interpretation is 12-18 months. Organizations that wait for explicit regulation will face retroactive compliance obligations with no evidence trail to support them.
The core problem: Traditional IAM, audit logging, and configuration management systems were designed for human operators and static infrastructure. AI agents break the assumptions behind every one of these systems. They authenticate with static credentials, operate under shared identities, take autonomous actions without human approval, and are rarely decommissioned through formal processes. The governance gap is not a future risk. It is an active, measurable deficit in 82% of organizations today.
Each CSA finding maps to one or more SWT3 procedures. The table below shows the finding, the procedure that addresses it, and the evidence artifact the procedure produces.
| CSA Finding | SWT3 Procedure | Evidence Produced | Coverage |
|---|---|---|---|
| 82% unknown agents | AI-ID.1 | Agent identity binding with creator, version, and authorized scope | Full |
| 82% unknown agents | AI-MDL.1 | Model card registry with agent inventory metadata | Full |
| 18% IAM confidence | AI-ACC.1 | Access authorization witness per AI action | Full |
| 18% IAM confidence | NHI-ID.1 | Non-human identity registration and binding | Full |
| Static API keys | NHI-ROT.1 | Credential rotation events with timestamps | Full |
| Static API keys | NHI-LCM.1 | Credential lifecycle events (create, renew, expire, revoke) | Full |
| 43% shared service accounts | AI-ID.1 | Per-agent identity, eliminating shared identity ambiguity | Full |
| 43% shared service accounts | NHI-ID.1 | Unique non-human principal per agent instance | Full |
| 65% agent incidents | AI-INCIDENT.1 | Incident response witness with timeline and chain of evidence | Full |
| 21% formal decommissioning | AI-DECOM.1 | Decommissioning event with credential revocation confirmation | Full |
| Audit log infrastructure | AI-AUDIT.1 | Tamper-evident audit trail with integrity verification | Full |
| Governance documentation | AI-GOV.1 | Governance policy attestation with version and approval chain | Full |
| Runtime tool authorization | AI-TOOL.1 | Per-tool-call witness with agent, tool, and outcome | Full |
| Agent drift / misalignment | AI-DRIFT.1 | Output drift detection with threshold and severity | Full |
| Multi-agent coordination | AI-MULTI.1 | Multi-agent coordination witness with participant roster | Full |
| Agent trust establishment | AI-TRUST.1 | Runtime trust verification with credential presentation | Full |
| Inter-agent authentication | AI-A2A.1 | Agent-to-agent authentication event with mutual verification | Full |
| Safety constraints | AI-GRD.1 | Guardrail enforcement witness with constraint evaluation | Partial |
Passive Witness Model
SWT3 witnesses events. It does not enforce policy, block actions, or make authorization decisions. Each procedure records that a governance-relevant event occurred and preserves its cryptographic fingerprint. The organization's security tooling enforces policy. SWT3 proves the enforcement happened.
AI-ID.1 witnesses the binding between an AI agent and its authorizing principal: which agent performed an action, who deployed it, what version it runs, and what scope it was authorized for. NHI-ID.1 extends this to non-human identity management, registering each agent as a distinct identity in the organization's identity fabric.
CSA found that 82% of organizations have discovered unknown agents. The root cause is simple: agents are deployed without identity registration. They authenticate with shared credentials, operate under generic service accounts, and leave no identity trail. AI-ID.1 and NHI-ID.1 together eliminate this gap by requiring that every agent have a unique, registered, cryptographically witnessed identity.
Request the AI-ID.1 anchor history for the tenant. Each anchor should show a unique agent_id, creator binding, and version. If agents share identities, the anchor trail will show identical agent_id values across different actions, which is the evidence of a shared-account problem.
AI-ACC.1 witnesses access authorization decisions for AI actions. Each anchor records which agent requested access, what resource was targeted, whether the request was authorized, and what policy governed the decision. This creates a per-action authorization evidence chain that traditional IAM audit logs do not provide.
Only 18% of organizations have high confidence that their IAM systems can govern AI agents. The gap exists because IAM was designed for human session-based access, not agent-initiated autonomous actions. AI-ACC.1 provides the evidence layer that connects agent actions to authorization decisions, regardless of the IAM system in use.
Compare AI-ACC.1 anchors against the organization's IAM policy. Each agent action should have a corresponding authorization anchor. Missing anchors indicate agent actions taken without authorization evidence, which is a control gap.
NHI-ROT.1 witnesses credential rotation events: when agent credentials were rotated, what the old and new credential fingerprints are, and whether the rotation was automatic or manual. NHI-LCM.1 witnesses the full credential lifecycle from creation through revocation.
CSA found that static API keys are the most common authentication mechanism for AI agents. Static keys never expire, are rarely rotated, and are frequently shared across agents. NHI-ROT.1 and NHI-LCM.1 create a verifiable record of credential hygiene. If rotation is not happening, the absence of NHI-ROT.1 anchors is itself the evidence of the gap.
Query NHI-ROT.1 anchors for the past 90 days. Agents with no rotation anchors are operating with static credentials. The frequency of rotation anchors reveals whether the organization's credential rotation policy is being followed for non-human identities.
AI-TOOL.1 witnesses each tool invocation by an AI agent: which tool was called, by which agent, with what parameters, and whether the call succeeded or failed. This creates a complete record of agent capability usage at the tool level.
CSA's findings show that organizations lack visibility into what their agents are doing at runtime. Static API keys grant broad access, and there is no per-action audit trail. AI-TOOL.1 provides that trail. Every tool call produces a cryptographic witness anchor, creating a forensic record of exactly what each agent did.
AI-TOOL.1 anchors map to EU AI Act Art. 12 (record-keeping), NIST AI RMF MEASURE 2.5, and OWASP Agentic Top 10 tool abuse controls. The tool-level audit trail is the evidence that runtime agent behavior is monitored.
AI-DECOM.1 witnesses agent decommissioning events: when an agent was taken out of service, who authorized the decommissioning, whether its credentials were revoked, and whether its data retention obligations were satisfied. The anchor proves the agent was formally retired, not just abandoned.
Only 21% of organizations have formal agent decommissioning processes. The remaining 79% have agents that are forgotten, left running with active credentials, or decommissioned informally without credential revocation. AI-DECOM.1 creates the evidence that a proper decommissioning process was followed.
Cross-reference AI-DECOM.1 anchors against the agent inventory (AI-MDL.1). Agents in the inventory without corresponding decommissioning anchors are either still active or were retired without formal process. Both conditions require investigation.
AI-INCIDENT.1 witnesses incident response events for AI agent security incidents: detection, classification, containment, and resolution. AI-AUDIT.1 witnesses the integrity of the audit trail itself, proving that evidence was not selectively edited or deleted during incident investigation.
65% of organizations experienced AI agent security incidents in the past 12 months. Incident response for agent-related events requires a forensic evidence chain that connects agent identity, tool usage, authorization decisions, and outputs. AI-INCIDENT.1 and AI-AUDIT.1 together provide both the incident timeline and the tamper-evident audit trail needed for post-incident analysis.
During incident response exercises, verify that AI-INCIDENT.1 anchors capture the full lifecycle from detection through resolution. The AI-AUDIT.1 trail should show continuous coverage with no gaps during the incident window.
AI-TRUST.1 witnesses runtime trust establishment between agents and infrastructure. AI-A2A.1 witnesses agent-to-agent authentication events when one agent invokes another. AI-MULTI.1 witnesses multi-agent coordination, recording participant rosters and decision attribution.
As agent systems grow more complex, trust relationships between agents become critical infrastructure. CSA's research highlights that most organizations have no mechanism for establishing or verifying trust between autonomous agents. These three procedures provide the evidence chain for agent trust, from initial trust verification through authenticated inter-agent communication to coordinated multi-agent operations.
AI-GRD.1 witnesses guardrail enforcement for AI agents: safety constraints, content filters, action boundaries, and scope limitations. AI-DRIFT.1 witnesses output drift, detecting when an agent's behavior deviates from expected baselines.
The 86% of organizations fearing increased social engineering attack surfaces from agentic AI need two things: safety constraints on agent behavior (guardrails) and detection when agents deviate from expected patterns (drift). AI-GRD.1 proves guardrails were active. AI-DRIFT.1 detects when they may not have been sufficient.
The CSAI Foundation has established "Securing the Agentic Control Plane" as its core mission. Their initiatives overlap significantly with SWT3 procedures.
CSAI advocates identity-first security for autonomous agents, treating each agent as a distinct non-human principal with its own identity, credentials, and authorization boundaries. SWT3's NHI namespace (NHI-ID.1, NHI-ROT.1, NHI-LCM.1) implements this pattern. Every agent gets a unique identity, every credential gets lifecycle management, and every identity event gets a cryptographic witness anchor.
CSAI recommends shifting from static, deploy-time authorization to runtime, per-action authorization. SWT3's AI-ACC.1 and AI-TOOL.1 procedures witness exactly this: each AI action and each tool call is individually authorized and witnessed, not blanket-authorized at deployment.
CSAI is developing an agent taxonomy to classify agent types, capability levels, and risk profiles. SWT3's AI-MDL.1 (model card) procedure witnesses the metadata that populates such a taxonomy: agent version, model provider, capability scope, and deployment context. The anchor trail becomes the authoritative source for the agent inventory that CSA found 82% of organizations lack.
CSAI's role as a CVE Numbering Authority for agent-specific vulnerabilities creates a new class of security events. SWT3's AI-INCIDENT.1 procedure witnesses the organizational response to these CVEs, creating evidence that agent vulnerabilities were detected, assessed, and remediated.
The CSAI Catastrophic Risk Annex (4 phases, June 2026 through December 2027) addresses extreme agent failure scenarios. SWT3's AI-GRD.1 (guardrails), AI-DRIFT.1 (drift), and AI-DECOM.1 (decommissioning) procedures provide the evidence chain for catastrophic risk controls: guardrails were enforced, drift was detected, and agents were properly shut down when necessary.
| CSAI Initiative | SWT3 Procedure | Alignment |
|---|---|---|
| Identity-first controls | NHI-ID.1, NHI-LCM.1, NHI-ROT.1 | Full |
| Runtime authorization | AI-ACC.1, AI-TOOL.1 | Full |
| Agent taxonomy | AI-MDL.1, AI-ID.1 | Full |
| Secure transactions | AI-A2A.1, AI-TRUST.1 | Full |
| CVE response for agents | AI-INCIDENT.1 | Full |
| Catastrophic risk controls | AI-GRD.1, AI-DRIFT.1, AI-DECOM.1 | Partial |
CSA's research reveals a clear dependency chain. Address identity first, then authorization, then monitoring. Each phase builds on the previous one.
Deploy AI-ID.1 and NHI-ID.1 to register every agent with a unique identity. Deploy NHI-LCM.1 and NHI-ROT.1 to manage credential lifecycles and enforce rotation. This phase directly addresses the 82% unknown agent problem and replaces static API keys with managed, witnessed credentials.
Procedures: AI-ID.1, NHI-ID.1, NHI-ROT.1, NHI-LCM.1
CSA gaps closed: Unknown agents, static API keys, shared service accounts
Deploy AI-ACC.1 for per-action authorization evidence. Deploy AI-TOOL.1 for tool-level audit trails. Deploy AI-GOV.1 to witness governance policy attestations. This phase addresses the 18% IAM confidence gap by creating verifiable evidence that authorization decisions are being made and recorded.
Procedures: AI-ACC.1, AI-TOOL.1, AI-GOV.1
CSA gaps closed: IAM confidence, runtime authorization, governance documentation
Deploy AI-AUDIT.1 for tamper-evident audit trails. Deploy AI-DRIFT.1 and AI-GRD.1 for behavior monitoring. Deploy AI-INCIDENT.1 for incident response evidence. Deploy AI-DECOM.1 for formal decommissioning processes. This phase addresses the 65% incident rate and the 21% decommissioning gap.
Procedures: AI-AUDIT.1, AI-DRIFT.1, AI-GRD.1, AI-INCIDENT.1, AI-DECOM.1
CSA gaps closed: Audit infrastructure, agent drift, incident response, decommissioning
Deploy AI-TRUST.1 for runtime trust verification. Deploy AI-A2A.1 for inter-agent authentication. Deploy AI-MULTI.1 for multi-agent coordination witnessing. Deploy AI-MDL.1 to maintain the complete agent inventory. This phase prepares for the CSAI Foundation's Catastrophic Risk Annex timeline.
Procedures: AI-TRUST.1, AI-A2A.1, AI-MULTI.1, AI-MDL.1
CSA gaps closed: Agent trust, inter-agent auth, multi-agent governance, agent inventory
Timeline Context
CSA estimates 12-18 months before sector regulations are interpreted to cover agent deployments. Organizations completing Phases 1-3 within that window will have a verifiable evidence trail demonstrating governance controls were in place before regulatory requirements materialized. This evidence is significantly more valuable than retroactive compliance efforts.
from swt3_ai import Witness
w = Witness(
tenant_id="YOUR_TENANT",
api_key="your-api-key",
agent_id="agent:claims-processor:v2.3",
signing_key="hmac-signing-key"
)
# Phase 1: Register agent identity (AI-ID.1)
w.record("AI-ID.1",
factor_a="agent:claims-processor:v2.3",
factor_b="deployer:platform-team@org.com",
factor_c="scope:claims_read_only")
# Phase 2: Witness tool authorization (AI-TOOL.1)
result = w.wrap_tool(search_claims)(query="pending Q3")
# Phase 2: Witness access authorization (AI-ACC.1)
w.record("AI-ACC.1",
factor_a="agent:claims-processor:v2.3",
factor_b="resource:claims-database",
factor_c="PASS:authorized")
w.flush()import { Witness } from '@tenova/swt3-ai';
const w = new Witness({
tenantId: 'YOUR_TENANT',
apiKey: 'your-api-key',
agentId: 'agent:claims-processor:v2.3',
signingKey: 'hmac-signing-key'
});
// Phase 1: Register agent identity (AI-ID.1)
w.record('AI-ID.1', {
factorA: 'agent:claims-processor:v2.3',
factorB: 'deployer:platform-team@org.com',
factorC: 'scope:claims_read_only'
});
// Phase 2: Witness tool authorization (AI-TOOL.1)
const result = w.wrapTool(searchClaims)({ query: 'pending Q3' });
// Phase 2: Witness access authorization (AI-ACC.1)
w.record('AI-ACC.1', {
factorA: 'agent:claims-processor:v2.3',
factorB: 'resource:claims-database',
factorC: 'PASS:authorized'
});
await w.flush();Both examples produce identical SWT3 Witness Anchors with cross-language fingerprint parity. The anchors are independently verifiable via the public verification endpoint.