Agent Control Standard (ACS)

What it is

The reference implementation of Agent Control Standard (ACS) v0.1.0, an OWASP GenAI Security Project spec where a Guardian Agent adjudicates an AI agent's actions over JSON-RPC. The summary describes what it does; the page gives the exact procedure to make it deny a live command, plus two operational gotchas that decide whether it actually protects anything.

What to do

Run the Guardian against a real policy engine (Microsoft's AGT) with only Bun installed:

git clone https://github.com/GenAI-Security-Project/agent-control-standard
cd agent-control-standard/reference-implementations/agt
bun install
bun run guardian        # second terminal: bun run inspector

Wire a coding agent to it and test the destructive-pattern rule:

mkdir -p .claude && cp hosts/claude-code/settings.json .claude/settings.json
claude

Asking Claude Code to run echo rm -rf / returns a deny with reason code destructive_shell_command_blocked under policy agt_stock; ls -la in the same session runs. With no coding agent installed, pipe a hook payload straight into the shim for the same verdict:

echo '{"session_id":"demo","hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' \
  | bun run hosts/claude-code/acs-hook.ts

Two operational gotchas the summary omits

It fails open by default, silently. The startup banner reads Failure posture: proceed. A Guardian that crashes, hangs, or is unreachable stops governing and the host proceeds as if nothing was asked. Set ACS_ON_DECISION_FAILURE=deny before trusting it to fail closed. (This is the concrete fix for issues #32/#37 named in the summary.)

bun install does not install trash. trash is a system command the test/verification scripts call, not an npm package. Without trash-cli on PATH, bun test fails 26 tests — all in conformance and upstream-watch scripts that clean scratch directories. Install trash-cli or ignore those specific 26.

Detail worth knowing

The two live hooks are steps/toolCallRequest and steps/toolCallResult. The deterministic layer (OPA/Rego or Cedar) always runs first; delegation to an LLM "agent layer" is optional, and that LLM never reads policy source — it sees only intermediate output the deterministic layer hands over, and its answer must still clear the deterministic layer on the way back. Deterministic-only deployments are fully conformant. A modify verdict rewrites arguments in place (e.g., capping SELECT * FROM customers to LIMIT 100).

Caveats

The page states the Trace pillar is not deliverable under load: envelope and audit logs are synchronous file appends on the decision path with no batching, and no OpenTelemetry collector/exporter exists yet — the harness only measures which attributes could be emitted, not that any ship. The next spec release (v0.2.0) targets March 2027; no v1.0 date is set.