GRCLibrary.ai

Standard

AI and Agentic Development Security Standard

This standard sets the technical security requirements for systems that incorporate LLMs, RAG pipelines, autonomous or semi-autonomous agents, MCP integrations, and AI-assisted development tooling. It is the technical and agentic-runtime implementation layer for AI security in the library: the governance-level minimum requirements are set by the AI Security and Risk Standard, and both apply cumulatively to a system in scope of both.

Type
Standard
Version
1.8.54
Date
2026-11-05
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
AI Governance
Review frequency
6 to 12 months and upon material AI framework or regulatory change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • 1. Scope
  • 2. Threat model
  • 3. Trust zones
  • 4. Security architecture principles
  • 5. Secure-by-default requirements
  • 6. Threat classes
  • 7. Mandatory input and output controls
  • 8. Prohibited engineering patterns
  • 9. AI-assisted development controls
  • 10. Agent security requirements
  • 11. RAG security requirements
  • 12. MCP security requirements
  • 13. Prompt security requirements
  • 14. Context isolation requirements
  • 15. Memory security requirements
  • 16. Runtime enforcement controls
  • 17. Infrastructure security requirements
  • 18. AI supply chain security
  • 19. CI/CD pipeline controls
  • 20. AI observability and telemetry
  • 21. Security testing requirements
  • 22. Adversarial testing requirements
  • 23. Red team requirements
  • 24. Human approval boundaries
  • 25. Data security requirements
  • 26. Secret handling requirements
  • 27. Model governance requirements
  • 28. Logging and audit requirements
  • 29. Incident detection and response
  • 30. Autonomous action constraints
  • 31. Secure agent orchestration
  • 32. Sandbox and isolation
  • 33. AI-driven offensive security tooling governance
  • 34. Verification and enforcement
  • 35. Agent production authority, reversibility, and recovery
  • 36. Framework alignment

Frameworks it maps to

Related documents