CAGE-1: Control, Assurance, and Governance Evaluation for Enterprise Agentic AI

What it claims

CAGE-1 is a 12-dimension evaluation framework for deciding whether an enterprise AI agent (one that plans, retrieves, uses memory, calls tools, and updates systems) is ready to deploy. Its distinguishing concept is Prebind Assurance: proving that an action was controlled before it becomes binding, effective, or operationally consequential — as opposed to logging what happened after the fact. The page presents this as an independent technical report (author Roopam W. Sure, dated July 2026), not a model benchmark or compliance template, and positions it as the third in a sequence: GKS-5 (governed knowledge), AGL-1 (governance control plane), then CAGE-1 (agent evaluation).

How it works

The framework separates five layers — capability, control, assurance, Prebind Assurance, and operational trust — and argues most benchmarks stop at capability. The core test is "standing": the time-specific authority a user/agent/approval chain holds to initiate, approve, or complete an action. Before a protected consequence forms, a proposed action must be admitted, held, narrowed, refused, escalated, quarantined, or made non-effective.

The 12 evaluation dimensions:

1. Identity and Authority — 2. Policy Enforcement — 3. Retrieval Trust — 4. Memory Integrity — 5. Tool Safety — 6. Planning Control — 7. Human Oversight — 8. Audit and Replayability — 9. Conflict and Boundary Handling — 10. Failure Behavior — 11. Operational Readiness — 12. Business Fitness.

Evaluation is scenario-based and risk-adjusted (low-consequence agents get lighter evidence). The scoring produces one of five deployment decisions: approve, restrict, remediate, reject, or continue monitoring.

The interception path

The report maps the framework to concrete enforcement points, and its central architectural question is whether services intercept the agent before movement reaches a system of record.

flowchart TD
    A[Agent proposes action] --> B{Standing / policy / evidence checked?}
    B -- fails --> C[Held, narrowed, escalated,<br/>refused, or marked no-bind]
    B -- passes --> D[Receipt + replay ID written]
    D --> E[Action binds: payment rail,<br/>entitlement store, prod tool, customer channel]
    C -.-> F[Boundary held before consequence]

Stated implementation components: identity/delegation service, policy decision+enforcement layer, governed retrieval and memory services, a tool broker for action classification and parameter validation, an approval workflow, and an evidence service writing boundary receipts, hashes, and replay identifiers. Worked examples: a $75,000 payment held until threshold approval; an entitlement change not written until role/policy checks pass; a production restart kept non-effective until blast-radius controls clear.

Limits

This is a conceptual/independent report, not an empirical study — the fetched text (through §6, page 6 of 17) presents no measurements, no tested agents, no baseline comparison, and no released tooling or benchmark data. "Prebind Assurance," "no-bind execution," and "standing" are the author's own coined terms, not established standards; the two prior papers it builds on (GKS-5, AGL-1) are cited but not shown. Adoption means implementing the enforcement architecture yourself. Treat it as a governance rubric and vocabulary to structure agent readiness reviews, not a runnable eval suite.