01 / Source and scope
Who acts, and what changes?
Principal and authority origin
Defense contractor agent. Contractor CUI handling policy and contract requirement.
Consequential action
Read or transmit controlled unclassified information.
02 / Action-time control
Make the requested effect testable.
CMMC obligations depend on the contract and assessment level. Keep agent actions inside CUI system boundaries; verify recipient and require authority for transmission.
OriginContractor CUI handling policy and contract requirement
RequestRead or transmit controlled unclassified information
DecisionEvaluate and enforce before effect
03 / Evidence and responsibility
Permission, execution, and outcome are separate.
CUI inventory, user/agent access, transmission decision and audit trail.
ProofGrid can support access evidence; contractors own scoping, implementation and assessment.
Primary source