Controls — Agent Baseline

Discover every agent and its dependencies.
Limit components, runtime, data and reach.
Bind identity, task, target and authority.
Correlate activity and prove what happened.
Admit the system and verify outcomes.
Stop, revoke, quarantine and scope impact.
The first is the form for an audit finding, a policy document or an RFP response — the identifier, and enough to resolve it. Identifiers are bare and permanent: superseded, never renumbered, never reused, and carrying no project name so that a rename or a transfer to a community body never breaks a reference you have already published.
The second is the same control as an address, for a ticket, a review comment or anywhere else a link can travel. Each identifier in the list of controls copies its address when you click it. Note that the address is the one thing here that can perish: if this work moves, the address moves with it and the bare identifier does not.
To cite the document itself: Agent Baseline, v1.0-draft, agentbaseline.org, 30 July 2026.