GOV-03: Documented purpose
In short: Write down what each agent is for, which tasks it may perform and which data it needs, before it gets access. A purpose statement is the yardstick for every later decision. Reviewers compare actual access against it, and drift becomes visible instead of silent.
1GOV-03
What does GOV-03 require?
Write down what each agent is for, which tasks it may perform and which data it needs, before it gets access.
Why does it matter?
A purpose statement is the yardstick for every later decision. Reviewers compare actual access against it, and drift becomes visible instead of silent.
How do you test it?
- Open the purpose statement for three agents.
- Compare each statement with the agent's current tools and data access.
- Check the statement predates the first access grant.
Which platforms document GOV-03?
Documented by Descope.
- 6.85Descope documentedSource: Descope Agentic Identity Hub 3.0, read
- 7.30Cyera Identity partly documentedSource: Oasis Agentic Access Management, read
- 6.55Token Security partly documentedSource: Token Security home, read
- 9.10NewCore not found in public materialChecked: NewCore: Discover; NewCore: Secure; NewCore: Govern; NewCore: Identity foundation; NewCore emerges from stealth; NewCore on AWS Marketplace, read
- 8.35Silverfort not found in public materialChecked: Silverfort: AI Agent Security; Silverfort unveils AI Agent Security; Silverfort and Google Cloud Agent Gateway; Silverfort pricing, read
- 7.30Astrix Security not found in public materialChecked: Astrix at RSAC 2026; Astrix product; Cisco and Astrix Security, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 6.35Clutch Security not found in public materialChecked: Clutch Security platform, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
- NIST AI RMFMap function: Recording the intended purpose of each system. Source: NIST AI Risk Management Framework
Which controls are related?
- GOV-02Named accountable owner
- GOV-04Least privilege at creation
- GOV-22Data access boundaries
Glossary: purpose statement, risk tier.
Reviewed by The Register desk