In September, OWASP's GenAI Security Project took on the Agent Control Standard, a specification for how a separate guardian can permit, deny or modify what an AI agent does in real time, with an audit trail you can reconstruct afterward. The project is one of the most-watched efforts in the field, and its backing matters: this is the same community behind the Top 10 for LLM Applications that most security teams already cite.
It is early. The public specification is an early, still-evolving draft, published on the project's GitHub and still taking shape. That is not a reason to ignore it. It is the reason to read it now. A standard this early is one you can still understand in an afternoon, before it grows the surface area that mature standards accrete, and well before a procurement team pastes it into a requirements document and asks you whether you comply.
This post is a plain-English walk through what ACS actually asks of an agent platform, and how to use it in an evaluation today without pretending an early draft is a certification.
What ACS is, and what it is not
ACS is a specification for runtime governance hooks. It describes how a component sitting outside the agent, a guardian, can inspect an action the agent wants to take and return a decision, and how that decision is recorded. The specification documents frame it as a wire format and a set of concepts, not an implementation.
It is worth being clear about what it is not. It is not a certification you can pass or a badge you can display. It is not a product. And this early it is not finished, so no honest vendor should claim conformance to it as though the specification were stable. What it gives you today is shared vocabulary: a precise way to ask how a platform governs agents, which is more than most evaluation conversations have had so far.
The four dispositions are allow, deny, ask, and defer
The core of ACS is that a guardian's decision is one of four dispositions, and the two beyond the obvious pair are the interesting ones.
Allow and deny are what they sound like: the action proceeds, or it does not. Ask means the guardian needs a human to decide before the action runs. Defer means the decision is handed to another authority rather than resolved on the spot.
Ask and defer matter most for headless agents, the ones running on a schedule or a trigger with nobody at the keyboard. A control model with only allow and deny forces every uncertain case into one of two bad outcomes: block the agent and stall the work, or allow it and hope. Ask and defer give the system a way to pause for a human or route to a policy owner without either stalling forever or waving the action through. If you are evaluating a platform for unattended runs, this is the part of ACS to hold it against.
Audit you can reconstruct, not just logs you can grep
ACS treats audit as a first-class requirement, and it asks for more than a pile of log lines. The specification describes session context, a hash chain and signatures: the properties that let you prove, after the fact, that a sequence of decisions happened in a particular order and was not altered.
That emphasis is the right one. The question after an agent incident is never "do you have logs?" It is "can you trust them, and can you reconstruct exactly what happened?" Tamper-evident, ordered, attributable audit is the difference between a record that survives scrutiny and a text file anyone with access could have edited. When you read ACS, read this section as a bar to hold your own audit trail to, whoever built it.
The agent bill of materials is the inventory most teams lack
ACS also asks for an agent bill of materials: the models, MCP servers, tools and knowledge sources an agent is composed of.
Most teams cannot produce this today. They can tell you which agent they run, but not the exact set of MCP servers it loads, at which versions, or which knowledge sources feed it. The year's supply chain incidents, where attackers went straight for MCP configs, are an argument for exactly this inventory. You cannot answer "which sessions loaded the vulnerable component?" without it. ACS naming the bill of materials as a requirement is a useful nudge to build one regardless of which standard you eventually align to.
How to use ACS in an evaluation today
The trap is to demand conformance from an early specification. Do not. The productive move is to use ACS as a source of sharper questions, for vendors and for your own platform team:
Can the system return all four dispositions, or only allow and deny? Who gets asked when the disposition is ask, and what happens if nobody answers? Is the audit trail ordered and tamper-evident, or just a log? Can you produce an agent bill of materials on demand? Where does the audit live, and who controls it?
These are answerable today, by any serious platform, without anyone claiming to implement a draft standard. The answers tell you more than a compliance checkbox would.
Where an agent control plane fits
At the category level, an agent control plane is one way to provide what ACS describes: a guardian outside the agent that returns a disposition on each action and records a trail you own. ACS gives that category a vocabulary and a set of expectations to be measured against, which is healthy for buyers.
The spec is young enough that the right posture is to learn it, not to wave a conformance claim at it. Read the four dispositions, hold your audit trail to the reconstruction bar, and start building the bill of materials. Those three moves are worth making whether or not ACS is the standard that eventually lands in your RFP.
The Agent Control Standard is early, and its value right now is not a badge but a vocabulary: four dispositions, reconstructable audit, and an agent bill of materials. Read it before a procurement team does, and use it to sharpen the questions you ask, including the ones you ask yourself.
For the checklist version of this, aimed at the moment before you let an agent run with nobody watching, see what a CISO should require before letting agents run unattended →
Marshal governs each agent action from outside the agent and records every decision to storage you own. Book a demo →