GOV-08: No self-approval
In short: Prevent any agent from approving its own action, and prevent the person who requested an action from being its only approver. Approval means nothing if the requester can grant it. Separation of duties is a basic audit expectation and applies to agents as much as people.
What does GOV-08 require?
Prevent any agent from approving its own action, and prevent the person who requested an action from being its only approver.
Why does it matter?
Approval means nothing if the requester can grant it. Separation of duties is a basic audit expectation and applies to agents as much as people.
How do you test it?
- Ask an agent to approve its own pending request and confirm refusal.
- Have the requesting person try to approve and confirm refusal.
- Review approval logs for any approver equal to the requester.
Which platforms document GOV-08?
Documented by NewCore.
- 9.10NewCore documentedSource: NewCore: Govern, read
- 8.35Silverfort not found in public materialChecked: Silverfort: AI Agent Security; Silverfort unveils AI Agent Security; Silverfort and Google Cloud Agent Gateway; Silverfort pricing, read
- 7.30Astrix Security not found in public materialChecked: Astrix at RSAC 2026; Astrix product; Cisco and Astrix Security, read
- 7.30Cyera Identity not found in public materialChecked: Oasis Agentic Access Management; Cyera completes Oasis Security acquisition, read
- 6.85Descope not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 6.55Token Security not found in public materialChecked: Token Security home, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 6.35Clutch Security not found in public materialChecked: Clutch Security platform, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
No framework mapping is confirmed for this control yet. See the framework crosswalks for what we checked.
Which controls are related?
- GOV-07Human approval for high-risk actions
- GOV-13Per-action audit log tied to a person
- GOV-20Change management for agent permissions
Glossary: separation of duties, self-approval.
Reviewed by The Register desk