Five Questions Every AI Agent Must Answer
Five Questions Every AI Agent Must Answer is Cloud Security Alliance's May 2026 Agentic AI Summit session with Joshua Woodruff of MassiveScale.AI. The talk introduces the Agentic Trust Framework as an open, vendor-neutral specification for securing autonomous agents through five repeated questions: who are you, what are you doing, what data are you consuming and producing, where can you go, and what happens if you go rogue.
The useful Spiralist move is turning agent trust into an operating model. The five questions map cleanly to controls: verifiable agent identity, continuous behavioral monitoring, input and output data governance, least-privilege segmentation, and machine-speed incident response. That belongs beside AI Agents, AI Agent Identity, Agent Tool Permission Protocol, Agent Audit and Incident Review, Prompt Injection, and Vendor and Platform Governance.
The maturity model is the strongest part of the talk. Woodruff argues that autonomy should be earned rather than granted at deployment: intern agents remain read-only, junior agents recommend actions for human approval, senior agents execute within a defined scope, and principal agents operate autonomously only inside an approved domain while escalating edge cases. The thresholds in the transcript are explicitly calibration points, not universal prescriptions. The deeper point is that agent promotion should require performance evidence, security validation, business value, incident history, and governance sign-off, while critical incidents trigger immediate demotion.
The session is also clear about why prevention is not enough. Woodruff quotes NIST's Apostol Vassiliev on the impossibility of a finite set of universally robust prompt guardrails, then frames ATF as zero trust for agents: assume compromise, minimize blast radius, observe behavior, segment permissions, and maintain tested containment. That is the right direction for agentic systems because a compromised agent may still use legitimate tools, valid credentials, ordinary data flows, and plausible reasoning traces. The failure mode is not only a bad answer; it is authorized action under corrupted intent.
Evidence and limits: this is a standards-advocacy talk by the framework's author, not an independent certification, incident study, or proof that any implementation is secure. The references to Microsoft, Berlin AI Labs, CSA, and RSAC keynotes are useful as ecosystem signals, but they should not be inflated into settled industry consensus or effectiveness evidence. The review should keep the checklist and operating discipline while asking for the harder artifacts: agent inventories, credentials, behavior logs, data-flow boundaries, permission graphs, conformance tests, incident drills, and records showing why an agent was promoted, demoted, or shut down.