GOV-09: Policy testing before go-live
In short: Test new or changed policies against realistic or recorded agent activity before they are enforced on live traffic in production. An untested policy either blocks legitimate work or lets risky actions through. Replaying real sessions shows both outcomes before anyone is affected.
1GOV-09
What does GOV-09 require?
Test new or changed policies against realistic or recorded agent activity before they are enforced on live traffic in production.
Why does it matter?
An untested policy either blocks legitimate work or lets risky actions through. Replaying real sessions shows both outcomes before anyone is affected.
How do you test it?
- Ask for the test result of the last policy change.
- Confirm the test used recorded or realistic sessions.
- Check that blocked and allowed counts were reviewed before enforcement.
Which platforms document GOV-09?
Documented by NewCore.
- 9.10NewCore documentedSource: NewCore: Govern, read
- 8.35Silverfort not found in public materialChecked: Silverfort: AI Agent Security; Silverfort unveils AI Agent Security; Silverfort and Google Cloud Agent Gateway; Silverfort pricing, read
- 7.30Astrix Security not found in public materialChecked: Astrix at RSAC 2026; Astrix product; Cisco and Astrix Security, read
- 7.30Cyera Identity not found in public materialChecked: Oasis Agentic Access Management; Cyera completes Oasis Security acquisition, read
- 6.85Descope not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 6.55Token Security not found in public materialChecked: Token Security home, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 6.35Clutch Security not found in public materialChecked: Clutch Security platform, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
- NIST AI RMFMeasure function: Testing and evaluating behaviour before and during use. Source: NIST AI Risk Management Framework
Which controls are related?
Glossary: policy replay, ai rmf.
Reviewed by The Register desk