AI and Agent Controls
Deterministic Execution for State-Changing Operations
Anything that changes state runs through a deterministic flow rather than through free-form model output. The model chooses which flow to invoke and with what inputs; the flow itself is code, with its own validation and its own permissions.
Framework requirements this speaks to
- NIST AI RMF MEASURE 2.6
- ISO 27001 A.8.28 (secure coding)
Framework references are indicative: they show which requirement a control speaks to, so you can line it up against your own checklist. The authoritative mapping is the one in our SOC 2 report and our ISO 27001 Statement of Applicability, both available under NDA.
Need the evidence behind this?
Our SOC 2 report and ISO 27001 Statement of Applicability are the authoritative record. Both are available under NDA, by email - we do not host them as downloads.