What Framework 3.0 Requires
Framework 3.0 continues its core logic of risk classification, technical response and comprehensive governance: 3 risk categories (inherent / application / derivative, 54 items), 3 technical response measures, 5 governance dimensions. The Agent chapter maps risks across 8 lifecycle stages with 4 core risk categories:Identity & privilege abuse, reasoning & planning, tool invocation, memory storage, plus new risks from communication protocols and multi-agent collaboration.
8 Stages x 4 Risk Categories Self-Check
For organisations deploying AI agents, check each cell (✓ = measure in place; — = gap, recommend remediation). Download the full checklist with governance recommendations at the bottom of this page.
| Stage | Identity & Privilege Abuse | Reasoning & Planning | Tool Invocation | Memory Storage |
|---|---|---|---|---|
| Design & Development | Least-privilege model | Task-goal anchoring | Tool allowlist | Record retention policy |
| Deployment | Deployment identity verification | Planning baseline recording | Invocation boundary declaration | Storage integrity |
| Input Processing | Delegated-authority validation | Instruction–goal consistency | Invocation parameter review | Context write review |
| Reasoning & Planning | Over-privilege planning alerts | Drift detection (fast/slow comparison) | Plan step review | Tamper-proof planning records |
| Tool Invocation | Execution identity traceability | Execution deviation alerts | Transaction-level risk scoring + audit | Tamper-proof execution trails |
| Memory Storage | No plaintext credentials | Memory consistency checks | Storage invocation review | Contamination detection + isolation |
| Output | Output actor identification | Output–intent comparison | White-box attribution evidence | Output records chained |
| Decommission | Immediate privilege revocation | Residual plan cleanup | Tool privilege revocation | Storage destroyed per policy |
Technical Response Reference (Committee Research Outcomes)
Targeting the two high-frequency risk stages in the table above — tool invocation and memory storage — the Committee's research outcomes provide the following deployable technical responses (geometric methods built on a frozen encoder and anchor artefacts, zero-gradient training throughout):
1. Transaction-level guarding: millisecond risk scoring and three-segment triage for every agent operation (file modification, API call, tool execution) — safe releases, high-risk blocks, gray-zone escalates to LLM deep audit. Audit cost tracks risk distribution, not total volume.
2. Tamper-evident audit chain: every guard decision is written to an HMAC-chained log (inputs stored as salted fingerprints only), supporting third-party independent replay — meeting the framework requirement that "AI remains under effective supervision and human oversight" with verifiable records.
3. Governance reports: periodic risk profiles, intervention attribution and audit cost bills — turning governance from an expense into a measurable management item.
Three patent applications underpinning these outcomes were accepted by the China National Intellectual Property Administration (CNIPA) in October 2026: CN202611615191.1 (agent firewall), CN202611615185.6 (tamper-evident evidence chain), CN202611615186.0 (behavioural audit).
Within the governance family, HoloGovernor provides side-channel monitoring (the speed limiter + dash cam); the research-stage HoloManager butler architecture further steers agent behaviour (goal anchoring, challenge escalation, hypergraph fleet governance), closing the "steering + monitoring" loop.
Download the full self-check checklist
Leave your organisation and contact details, and we will send you the full checklist with governance recommendations and the deployment guide (free, used for governance research statistics).
Request Checklist