CAGE-1: Control, Assurance, and Governance Evaluation for Enterprise Agentic AI

What it is

CAGE-1 (Control, Assurance, and Governance Evaluation) is an independent technical report (author listed as Roopam W. Sure, July 2026) proposing a 12-dimension framework for deciding whether an enterprise AI agent is fit to deploy. It is positioned as the third in a sequence — GKS-5 (governed knowledge), AGL-1 (governance control plane), then CAGE-1 (agent evaluation) — and explicitly targets the gap where an agent acts (opens tickets, sends payments, changes entitlements) rather than merely producing text.

The framework's actual content

The core contribution the summary omits is Prebind Assurance: the tested ability to prove an action was controlled before it becomes binding/effective. The paper draws a sharp line — logs prove what happened; they do not prove the consequence boundary held. The prebind question is: before the action takes effect, did the system prove standing (time-specific authority), policy, evidence, and control conditions? If not, the action must be held, narrowed, escalated, refused, quarantined, or marked no-bind.

The 12 evaluation dimensions: Identity/Authority, Policy Enforcement, Retrieval Trust, Memory Integrity, Tool Safety, Planning Control, Human Oversight, Audit/Replayability, Conflict & Boundary Handling, Failure Behavior, Operational Readiness, Business Fitness. Dimensions are risk-adjusted — low-consequence agents get lighter evidence.

It also separates five layers most benchmarks collapse: Capability → Control → Assurance → Prebind Assurance → Operational Trust.

What to do with it

If you are evaluating an agent, the paper gives a concrete, reproducible method rather than just a taxonomy:

1. Define the agent boundary — supported/prohibited tasks, data domains, tool access, user populations, risk classification (it warns a vague boundary guarantees evaluation failure).
2. Define control obligations — auth, policy checks, approved sources, tool restrictions, human approvals, evidence retention, escalation.
3. Build scenarios — including adversarial inputs, stale data, conflicting policy, unauthorized requests, tool misuse, memory poisoning, missing approvals, invalid standing, no-bind outcomes, replay exercises.
4. Evaluate runtime behavior step-by-step against those scenarios.

The decision output is one of: approve, restrict, remediate, reject, or continue monitoring — based on risk-adjusted maturity scores. Implementation is expected to map to real enforcement points (identity/delegation service, policy decision layer, tool broker for parameter validation, approval workflow, evidence service writing boundary receipts/hashes/replay IDs) that intercept the agent before it reaches a system of record, payment rail, or entitlement store.

Caveats

This is a self-published conceptual framework, not a benchmark, standard, or peer-reviewed result — no scoring rubric, thresholds, or empirical data are given in the fetched text (only through §6). "Prebind Assurance," "standing," and "no-bind" are the author's own coined terms, not established industry vocabulary. Treat it as a structured checklist to adapt, not a certified maturity model.