C04 Layer 1 - Identity & Integrity

Agent Lifecycle Governance

Per-agent-instance lifecycle: Commission, Run, Quiesce, Decommission. The ABOM defines what the agent is allowed to be; the lifecycle service enforces state transitions.

Why

Without lifecycle governance, agents sprawl: unknown instances running old versions

stale permissions
missing owners This creates an unmanageable attack surface and breaks auditability.

What

A lifecycle state machine and inventory control: Commission → Attest → Run → Quiesce → Decommission with required ABOM, ownership, and retirement steps.

How

every agent version requires an ABOM and owner
ephemeral runs by default; long-lived only with explicit justification
quiesce disables side effects but preserves evidence capture
decommission revokes identities, disables keys, archives audit/replay artifacts

Evidence

authoritative agent inventory (instances, versions, owners)
decommission proofs (revocation, archival pointers)
drift events (unexpected versions/instances)

Failure modes

no central inventory
“temporary” agents that become permanent
decommission doesn’t revoke tool access
orphaned agents with no owner or purpose

NIST AI RMF alignment

C04 maps to GOVERN and MANAGE. See the framework paper for the specific subcontrol mappings.

ISO/IEC alignment

C04 maps to ISO/IEC 42001. Typical evidence: see the Evidence section above.