GOV-21: Third-party agent onboarding
In short: Assess agents supplied by vendors or partners before they connect, covering purpose, data access, credentials and contract terms. A vendor's agent acts inside your systems under your accountability. Onboarding it like a new supplier keeps the same standards as agents you build.
What does GOV-21 require?
Assess agents supplied by vendors or partners before they connect, covering purpose, data access, credentials and contract terms.
Why does it matter?
A vendor's agent acts inside your systems under your accountability. Onboarding it like a new supplier keeps the same standards as agents you build.
How do you test it?
- List third-party agents and their onboarding records.
- Confirm each has a purpose, owner and data scope.
- Check contracts cover logging and incident notice.
Which platforms document GOV-21?
No platform in the register documents this control in full.
- 6.85Descope partly documentedSource: Descope Agentic Identity Hub 3.0, read
- 9.10NewCore not found in public materialChecked: NewCore: Discover; NewCore: Secure; NewCore: Govern; NewCore: Identity foundation; NewCore emerges from stealth; NewCore on AWS Marketplace, read
- 8.35Silverfort not found in public materialChecked: Silverfort: AI Agent Security; Silverfort unveils AI Agent Security; Silverfort and Google Cloud Agent Gateway; Silverfort pricing, read
- 7.30Astrix Security not found in public materialChecked: Astrix at RSAC 2026; Astrix product; Cisco and Astrix Security, read
- 7.30Cyera Identity not found in public materialChecked: Oasis Agentic Access Management; Cyera completes Oasis Security acquisition, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 6.55Token Security not found in public materialChecked: Token Security home, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 6.35Clutch Security not found in public materialChecked: Clutch Security platform, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
No framework mapping is confirmed for this control yet. See the framework crosswalks for what we checked.
Which controls are related?
- GOV-02Named accountable owner
- GOV-03Documented purpose
- GOV-17MCP server registry
Reviewed by The Register desk