Why a Runtime Control Layer, and Why Now
The Missing Piece in Agent Governance
Agentic systems don’t just answer questions anymore — they plan, call tools, write to memory, execute code, and hand off tasks to other agents, often across organizational and vendor boundaries, in milliseconds. The industry has done a reasonable job standardizing two of the three things that matter here:
How Agents Communicate
- Model Context Protocol (MCP) for tool access
- Agent-to-Agent (A2A) for inter-agent collaboration
What Can Go Wrong
- OWASP Top 10 for Agentic Applications (2026) — a peer-reviewed catalog of ten agent-specific failure modes (ASI01–ASI10)
- Published by the OWASP GenAI Security Project’s Agentic Security Initiative in December 2025
The Missing Third Piece
What has been missing is a standard way to actually stop the bad outcome at the moment it’s about to happen.
- System prompts are instructions, not controls — a sufficiently adversarial input can talk an agent out of them
- Model-level improvements don’t cover every edge case
- Every team that has tried to build its own runtime guardrails has ended up with bespoke, non-portable enforcement logic that doesn’t survive a framework migration and can’t be audited by a security team that didn’t write it
That’s the gap the Agent Control Standard (ACS) is built to close.
Regulatory Deadlines Adding Urgency
Two regulatory deadlines are adding urgency to implementing runtime control layers:
EU AI Act, Article 14 (Human Oversight)
- Requirements: High-risk AI systems must be designed so natural persons can monitor, understand, intervene in, and halt them
- Enforcement Date: August 2, 2026
- Relevance: Several of the Act’s high-risk system obligations become enforceable, including human oversight requirements
NIST AI Risk Management Framework
- Requirements: Calls for continuous monitoring and the demonstrated capacity to disengage an autonomous system operating outside acceptable parameters
- Functions: MEASURE and MANAGE functions specifically require intervention capabilities
- Relevance: Framework emphasizes the need for technical controls beyond policy documentation
The Implementation Gap
Neither framework tells you how to build the intervention capability — they specify what is required. ACS is one attempt at that implementation layer.
Why System Prompts Are Insufficient
The Problem with Instructions-Only Controls
System prompts are fundamentally different from runtime controls:
| Aspect | System Prompts | Runtime Controls |
|---|---|---|
| Nature | Instructions to the model | Technical enforcement points |
| Reliability | Can be talked around by adversarial input | Deterministic gates |
| Visibility | Hidden in model context | Audit-traceable events |
| Portability | Tied to specific model/framework | Framework-agnostic standard |
| Security Review | Difficult to audit by external teams | Standardized policy language |
The Adversarial Input Problem
A sufficiently adversarial input can talk an agent out of system prompt constraints:
- Prompt injection: Techniques that override system instructions
- Jailbreaking: Methods that bypass safety constraints
- Social engineering: Persuasive inputs that reframe the agent’s purpose
Runtime controls provide a deterministic, inline gate evaluated before the action reaches production systems, not sampled or reviewed afterward.
Why Custom Guardrails Fail at Scale
The Bespoke Guardrail Problem
Every team that has tried to build its own runtime guardrails encounters the same issues:
- Non-portable enforcement logic — doesn’t survive framework migration
- Limited auditability — security teams can’t review logic they didn’t write
- Fragmented standards — every team invents its own policy language
- Maintenance burden — keeping custom logic updated as agent capabilities evolve
The ACS Solution
ACS addresses these problems by:
- Standardizing the contract between agents and enforcement points
- Providing a framework-agnostic policy language
- Enabling cross-team collaboration through open specifications
- Creating an audit trail that integrates with existing security tooling
The ACS Value Proposition
What ACS Provides
ACS delivers the missing third piece of agent governance:
- Standardized hooks at every meaningful decision point in agent execution
- Deterministic verdicts (allow/deny/modify) evaluated before actions execute
- Structured observability through OpenTelemetry and OCSF integration
- Dynamic inventory via Agent Bill of Materials (AgBOM)
- Framework portability through the three-tier architecture
What ACS Enables
With ACS, organizations can:
- Meet regulatory requirements for human oversight and intervention
- Standardize governance across multiple agent frameworks
- Audit agent behavior with forensic-grade trace records
- Scale guardrails without multiplying custom implementations
- Integrate with existing security tooling rather than replacing it