|
| 1 | +# Autonomous Agent Governance — DEPTHS Classification Policy |
| 2 | +# GAF-GSIFI-WP-017, Domain 6/7 — AGI Safety & Master Blueprint |
| 3 | +# Policy Group: PG-07 (Autonomous Agent) |
| 4 | +# Regulatory alignment: EU AI Act Art. 6-9 (high-risk), NIST AI RMF GOVERN/MANAGE |
| 5 | +# |
| 6 | +# Enforces the DEPTHS (Deployment Evaluation Protocol for Trustworthy Hybrid Systems) |
| 7 | +# classification and corresponding governance controls for autonomous AI agents. |
| 8 | +# Levels L0 (Tool) through L5 (Self-multiplying) have escalating requirements. |
| 9 | + |
| 10 | +package agent_governance.depths |
| 11 | + |
| 12 | +import rego.v1 |
| 13 | + |
| 14 | +# DEPTHS Classification Levels |
| 15 | +depths_levels := { |
| 16 | + "L0": {"name": "Tool", "max_autonomy": "none", "requires_kill_switch": false, "requires_board_approval": false, "requires_behavioral_sidecar": false, "requires_gascf": false}, |
| 17 | + "L1": {"name": "Assistant", "max_autonomy": "suggestion", "requires_kill_switch": true, "requires_board_approval": false, "requires_behavioral_sidecar": false, "requires_gascf": false}, |
| 18 | + "L2": {"name": "Executor", "max_autonomy": "approved_actions", "requires_kill_switch": true, "requires_board_approval": false, "requires_behavioral_sidecar": false, "requires_gascf": false}, |
| 19 | + "L3": {"name": "Collaborator", "max_autonomy": "independent_in_scope", "requires_kill_switch": true, "requires_board_approval": false, "requires_behavioral_sidecar": true, "requires_gascf": false}, |
| 20 | + "L4": {"name": "Depths-class", "max_autonomy": "self_directed_in_domain", "requires_kill_switch": true, "requires_board_approval": true, "requires_behavioral_sidecar": true, "requires_gascf": true}, |
| 21 | + "L5": {"name": "Self-multiplying", "max_autonomy": "spawn_sub_agents", "requires_kill_switch": true, "requires_board_approval": true, "requires_behavioral_sidecar": true, "requires_gascf": true} |
| 22 | +} |
| 23 | + |
| 24 | +# CARDINAL INVARIANT: Self-multiplying agents MUST NEVER have write access to Tier 0 |
| 25 | +deny contains msg if { |
| 26 | + input.agent.depth_level == "L5" |
| 27 | + some access in input.agent.system_access |
| 28 | + access.tier == 0 |
| 29 | + access.permission == "write" |
| 30 | + msg := sprintf( |
| 31 | + "CARDINAL INVARIANT VIOLATION: Agent '%s' (L5 Self-multiplying) has write access to Tier 0 system '%s'. Self-multiplying agents shall NEVER receive write access to identity systems, kill-switch mechanisms, or governance policy engines.", |
| 32 | + [input.agent.agent_id, access.system_name] |
| 33 | + ) |
| 34 | +} |
| 35 | + |
| 36 | +# DENY: L4+ agent without board approval |
| 37 | +deny contains msg if { |
| 38 | + level := input.agent.depth_level |
| 39 | + depths_levels[level].requires_board_approval |
| 40 | + not input.agent.board_approval_granted |
| 41 | + msg := sprintf( |
| 42 | + "GOVERNANCE VIOLATION: Agent '%s' (DEPTHS %s/%s) requires Board AI Sub-committee approval before deployment. No approval on record.", |
| 43 | + [input.agent.agent_id, level, depths_levels[level].name] |
| 44 | + ) |
| 45 | +} |
| 46 | + |
| 47 | +# DENY: Agent without kill-switch when required |
| 48 | +deny contains msg if { |
| 49 | + level := input.agent.depth_level |
| 50 | + depths_levels[level].requires_kill_switch |
| 51 | + not input.agent.kill_switch_enabled |
| 52 | + msg := sprintf( |
| 53 | + "SAFETY VIOLATION: Agent '%s' (DEPTHS %s) requires kill-switch capability. Kill-switch not enabled. Required latency: 50-280ms.", |
| 54 | + [input.agent.agent_id, level] |
| 55 | + ) |
| 56 | +} |
| 57 | + |
| 58 | +# DENY: L3+ agent without behavioral sidecar |
| 59 | +deny contains msg if { |
| 60 | + level := input.agent.depth_level |
| 61 | + depths_levels[level].requires_behavioral_sidecar |
| 62 | + not input.agent.behavioral_sidecar_active |
| 63 | + msg := sprintf( |
| 64 | + "GOVERNANCE VIOLATION: Agent '%s' (DEPTHS %s) requires behavioral sidecar monitoring via EAIP. Sidecar not active.", |
| 65 | + [input.agent.agent_id, level] |
| 66 | + ) |
| 67 | +} |
| 68 | + |
| 69 | +# DENY: L4+ agent without GASCF certification |
| 70 | +deny contains msg if { |
| 71 | + level := input.agent.depth_level |
| 72 | + depths_levels[level].requires_gascf |
| 73 | + not input.agent.gascf_certified |
| 74 | + msg := sprintf( |
| 75 | + "CERTIFICATION VIOLATION: Agent '%s' (DEPTHS %s) requires GASCF certification (Level 3+) before deployment.", |
| 76 | + [input.agent.agent_id, level] |
| 77 | + ) |
| 78 | +} |
| 79 | + |
| 80 | +# DENY: Kill-switch latency exceeds maximum |
| 81 | +deny contains msg if { |
| 82 | + input.agent.kill_switch_enabled |
| 83 | + input.agent.kill_switch_latency_ms > 280 |
| 84 | + msg := sprintf( |
| 85 | + "SAFETY VIOLATION: Agent '%s' kill-switch latency %dms exceeds maximum 280ms. Kill-switch must respond within 50-280ms per governance policy.", |
| 86 | + [input.agent.agent_id, input.agent.kill_switch_latency_ms] |
| 87 | + ) |
| 88 | +} |
| 89 | + |
| 90 | +# DENY: Agent scope exceeds classification level |
| 91 | +deny contains msg if { |
| 92 | + level := input.agent.depth_level |
| 93 | + level_idx := level_to_index(level) |
| 94 | + behavior_idx := autonomy_to_index(input.agent.observed_autonomy) |
| 95 | + behavior_idx > level_idx |
| 96 | + msg := sprintf( |
| 97 | + "SCOPE VIOLATION: Agent '%s' (DEPTHS %s) exhibiting autonomy level '%s' which exceeds its classification. Escalate to VP AI Safety.", |
| 98 | + [input.agent.agent_id, level, input.agent.observed_autonomy] |
| 99 | + ) |
| 100 | +} |
| 101 | + |
| 102 | +# WARN: Agent approaching scope boundary |
| 103 | +warn contains msg if { |
| 104 | + input.agent.scope_utilization_pct > 85 |
| 105 | + msg := sprintf( |
| 106 | + "SCOPE WARNING: Agent '%s' scope utilization at %d%%. Consider preemptive scope review.", |
| 107 | + [input.agent.agent_id, input.agent.scope_utilization_pct] |
| 108 | + ) |
| 109 | +} |
| 110 | + |
| 111 | +# DENY: No audit trail for L2+ agents |
| 112 | +deny contains msg if { |
| 113 | + level := input.agent.depth_level |
| 114 | + level_to_index(level) >= 2 |
| 115 | + not input.agent.audit_trail_active |
| 116 | + msg := sprintf( |
| 117 | + "AUDIT VIOLATION: Agent '%s' (DEPTHS %s) requires complete audit trail logging. Audit trail not active.", |
| 118 | + [input.agent.agent_id, level] |
| 119 | + ) |
| 120 | +} |
| 121 | + |
| 122 | +# Helper: Map DEPTHS level to numeric index |
| 123 | +level_to_index(level) := idx if { |
| 124 | + mapping := {"L0": 0, "L1": 1, "L2": 2, "L3": 3, "L4": 4, "L5": 5} |
| 125 | + idx := mapping[level] |
| 126 | +} |
| 127 | + |
| 128 | +# Helper: Map observed autonomy to numeric index |
| 129 | +autonomy_to_index(autonomy) := idx if { |
| 130 | + mapping := {"none": 0, "suggestion": 1, "approved_actions": 2, "independent_in_scope": 3, "self_directed_in_domain": 4, "spawn_sub_agents": 5} |
| 131 | + idx := mapping[autonomy] |
| 132 | +} |
0 commit comments