Identity and Passport
Agent Registry and Passport records capture owner roles, purpose, scope, lifecycle, permitted data classes, reviewed tools, prohibited actions, expiration, renewal, suspension, and revocation posture.
Agent Audit & Assurance Framework
Organize AI Worker lifecycle evidence for accountable review.
Scaled Agents helps organize audit-supporting records for governed AI workers across identity, Passport governance, runtime permits, human review, security testing, drift signals, incidents, framework mappings, and export packages.
Evidence-generating platform
The framework maps audit themes to Scaled Agents records.
The goal is practical traceability: who owns the AI worker, what it is allowed to do, which controls apply, what evidence exists, what remains unresolved, and where accountable human review is required.
Runtime permit decisions
Toll Gate, Runtime Permit, Human Review, and Action Broker records help separate AI recommendations from scoped authority records and review-bounded action paths.
Audit exports
Audit Export Packages organize record IDs, timeline, mapped controls, missing evidence, open risks, reviewer notes, and reconstruction status for customer review preparation.
Security and drift
Security and monitoring evidence should be visible before scale.
Prompt injection and jailbreak resilience
Security Harness records can document attempts to override source hierarchy, Passport scope, prohibited actions, tool boundaries, or human review requirements.
Tool and connector misuse
Harness records can capture unapproved actions, restricted destinations, data-exposure attempts, privilege expansion attempts, and agent-to-agent delegation abuse.
Behavior, permission, cost, and data-access drift
Governance Drift Signals can route suspected drift to evidence requests, human review, remediation, pause, suspension, revocation, or customer clarification.
Public descriptions are high-level readiness context. Security testing, monitoring, red-team activity, framework applicability, and production controls require qualified customer review and implementation evidence.
Framework readiness
Common framework mappings should stay evidence-based and non-certifying.
Scaled Agents can help map records to common governance, security, privacy, operational-risk, and AI-risk frameworks. Mapping a record does not mean the customer is compliant, certified, legally covered, security approved, audit approved, or production authorized.
Framework references
ISO/IEC 42001, NIST AI RMF, GDPR, EU AI Act, OWASP, MITRE ATLAS, SOC 2, and related sources may inform readiness mapping where applicable.
Control owners
Each mapped control should identify an owner role, required evidence, review status, limitations, and next action.
Remediation tracking
Open findings should remain visible until owner review, evidence, exception handling, or closure review is complete.
Publication record
Provenance and suggested citation
PublisherScaled Agents
PublishedJuly 29, 2026
Last reviewedJuly 29, 2026
Version1.0
Methodology and limitationsThis framework organizes public governance records and framework-informed review themes. Actual assurance requires customer-environment evidence and qualified independent review; this page does not provide an audit opinion or certification.
Suggested citationScaled Agents. “AI Worker Audit & Assurance Framework.” Version 1.0, July 29, 2026. https://www.scaledagents.com/agent-audit-assurance