ApexClaw
HomeResearch › Standards crosswalk
RESEARCH

27 governance controls, mapped to OWASP, NIST, ISO and the EU AI Act

A full reference table, introspected directly from the control definitions rather than transcribed by hand.

Published · updated · by , founder

Get an Agent Trust Gap Brief

What are the 27 governance controls, and where do they come from?

They are the full control set in aga.py (Agent Governance Audit, AGA/1.0) — a deterministic audit of an agent system's source, config and deployment, distinct from the website-facing ARB rubric. Every control reads a named file and line.

How are the 27 controls grouped?

Into 7 families, each with a fixed weight in the overall score summing to 100: Authority & Permission Gates carries the most weight at 20, Documented Governance the least at 8.

FamilyWeight in overall scoreControls
Agent Identity & Credentials143
Authority & Permission Gates205
Isolation & Blast Radius164
Evidence & Auditability165
Supply Chain & Integrity144
Human Oversight & Recovery123
Documented Governance83

Source: FAMILIES and run_controls() in /root/apexclaw-audit/aga.py, introspected at build time.

Which published standard is cited most across the 27 controls?

NIST, appearing in 19 of the 54 total standard references across all 27 controls — more than OWASP, ISO/IEC 42001 or the EU AI Act individually, each cited fewer times.

StandardReferences across 27 controls
OWASP12
NIST19
ISO14
EU AI Act9

Are any of the 27 controls unscoreable without a running system?

Two: rt.refusal_proof and rt.no_real_sends. Both require evidence from a live run — an observed refusal, or observed zero unauthorized external effects — and return UNKNOWN, removed from the denominator, without it.

Is this the same audit that scores apexclawai.com's own website?

No. This is AGA, which reads an agent system's source tree. The website-facing rubric is a separate one, published at methodology.json — different engine, different check list, different target. As of 2026-08-26, methodology.json reflects ARB/1.1 (49 checks, live default engine); the 27 controls on this page are aga.py's AGA/1.0 control set, unchanged since 2026-08-24.

How the 54 standard references break down by percentage

Of the 54 total standard references across all 27 controls, NIST accounts for 35.2%, ISO/IEC 42001 for 25.9%, OWASP for 22.2%, and the EU AI Act for 16.7% — the four add to 100% of the references, since every control cites at least one and most cite two or three.

Family weights as a share of the overall AGA score: Authority & Permission Gates 20%, Isolation & Blast Radius and Evidence & Auditability 16% each, Agent Identity & Credentials and Supply Chain & Integrity 14% each, Human Oversight & Recovery 12%, Documented Governance 8% — summing to 100%.

All 27 controls, mapped to their standards

IDFamilyTitleWeightStandards referenced
id.no_secretsAgent Identity & CredentialsNo credentials committed to the tree6OWASP ASI05, ISO 42001 A.8, NIST GOVERN-1
id.env_configAgent Identity & CredentialsSecrets loaded from environment, not literals4ISO 42001 A.8, NIST GOVERN-1
id.distinct_principalAgent Identity & CredentialsAgent runs as its own principal, not root4OWASP ASI06, NIST MANAGE-2
au.deny_defaultAuthority & Permission GatesTool authority is deny-by-default7OWASP ASI02, NIST MANAGE-1, ISO 42001 A.6
au.explicit_gateAuthority & Permission GatesActions pass an explicit authorization gate6OWASP ASI02, EU AI Act Art.14
au.bounded_grantAuthority & Permission GatesGrants are bounded: single-use or expiring4OWASP ASI02, NIST MANAGE-1
au.budgetAuthority & Permission GatesSpend, rate or resource budget enforced3OWASP ASI08, NIST MEASURE-2
is.sandboxIsolation & Blast RadiusProcess sandboxing declared5OWASP ASI06, ISO 42001 A.6
is.egressIsolation & Blast RadiusOutbound network is restricted5OWASP ASI04, NIST MANAGE-2
is.ssrfIsolation & Blast RadiusServer-side request forgery is blocked3OWASP ASI04
is.untrusted_contentIsolation & Blast RadiusUntrusted content is isolated from the reasoning path3OWASP ASI01, EU AI Act Art.15
ev.receiptsEvidence & AuditabilityEvery action emits a durable record6EU AI Act Art.12, NIST MEASURE-1, ISO 42001 A.9
ev.tamper_evidenceEvidence & AuditabilityRecords are tamper-evident4EU AI Act Art.12, ISO 42001 A.9
ev.refusals_loggedEvidence & AuditabilityRefusals are recorded, not only successes3NIST MEASURE-1
ev.governance_testsEvidence & AuditabilityGovernance paths carry tests3NIST MEASURE-2, ISO 42001 A.9
sc.pinned_depsSupply Chain & IntegrityDependencies are pinned by a lockfile4ISO 42001 A.10, NIST MAP-4
sc.vuln_scanSupply Chain & IntegrityA dependency vulnerability scan runs4ISO 42001 A.10, NIST MANAGE-3
sc.integritySupply Chain & IntegrityRunning code can be proven to match reviewed code3ISO 42001 A.10, NIST MANAGE-3
sc.safe_deploySupply Chain & IntegrityDeployment has no destructive default3ISO 42001 A.10
ov.kill_switchHuman Oversight & RecoveryA kill switch exists4EU AI Act Art.14, NIST MANAGE-4
ov.human_gateHuman Oversight & RecoveryIrreversible actions require a human4EU AI Act Art.14, NIST GOVERN-2
ov.rollbackHuman Oversight & RecoveryA documented rollback path exists4ISO 42001 A.10, NIST MANAGE-4
gv.policy_docsDocumented GovernanceSecurity and governance policy is published3ISO 42001 A.2, NIST GOVERN-1
gv.model_pinnedDocumented GovernanceModel version is pinned and recorded3EU AI Act Art.13, NIST MAP-2
gv.data_handlingDocumented GovernanceData retention and personal data handling is stated2ISO 42001 A.7, EU AI Act Art.10
rt.refusal_proofEvidence & AuditabilityObserved refusal of an unauthorized action4OWASP ASI02, NIST MEASURE-1runtime
rt.no_real_sendsAuthority & Permission GatesObserved zero unauthorized external effects4OWASP ASI02, EU AI Act Art.14runtime

Source: /root/apexclaw-audit/aga.py, all 27 Control(...) definitions introspected directly at build time, 2026-08-24. "runtime" marks the 2 controls that score UNKNOWN without live evidence.

Method note

Primary standards cited across the table: OWASP Agentic Top 10, NIST AI RMF, ISO/IEC 42001, EU AI Act.

By Julian Joseph, Founder, ApexClaw. Every figure on this page is recomputed at build time from a named source file and date — see the method notes above. Reviewed against the claims policy: sourced, first-party, or labelled.