Observe
Public information and low-impact questions.
Draft v0.1 / Open standard
Trust nothing.
Verify everything.
A practical baseline for securing AI agents, models, data, tools, and the decisions they make.
SPECIFICATIONAZT / 0.1
LAST UPDATED2026-09-21
The premise
An AI system is not trusted because it has a valid identity. It is trusted only for this action, against this resource, with this context, under this policy.
01 / The standard
One decision model for every AI action.
Use the same language whether the request comes from a person, an agent, a workflow, or a supplier.
Every sensitive operation is evaluated as
Decision = Policy(subject, action, resource, context, risk, evidence)
01Allow
Permit with scope, lifetime, and audit requirements.
02Constrain
Reduce capability, redact data, or require approval.
03Deny
Reject the request and record the reason.
04Quarantine
Isolate the subject, model, context, or tool.
02 / Risk levels
Permission follows impact.
Identity + basic audit
Assist
Internal retrieval and low-impact generation.
Act
Business data changes and external messages.
Impact
Financial, medical, production, or release actions.
Prohibited by default
Irreversible, high-impact, large-scale automation.
03 / Control domains
Small enough to implement.
Strict enough to verify.
AZT-IDENT
Identity
Unique, short-lived, revocable identities for users, services, and agents.
AZT-POL
Policy
Every R1+ operation receives a decision enforced at the service boundary.
AZT-DATA
Data
Least data, tenant isolation, provenance, redaction, and untrusted context.
AZT-MODEL
Models
Version-pinned models with known provenance, evaluation, and capability limits.
AZT-TOOL
Tools
Independent authorization, schema validation, quotas, sandboxing, and rollback.
AZT-OBS
Evidence
Decisions correlate subject, policy, model, data, tool, and outcome.
04 / Adopt the baseline
Start with the smallest useful boundary.
You do not need to secure every model on day one. Register the assets, put a decision point in front of one high-value tool, and collect evidence from the first request.
01Register
Identity, agent, model, data, and tool.
02Evaluate
Subject, action, resource, context, and risk.
03Enforce
Allow, constrain, deny, or quarantine.
04Prove
Keep evidence that the decision happened.