01 / Source and scope
Who acts, and what changes?
Principal and authority origin
Agent service running inside or connected to a cloud offering. Agency authorization and cloud service boundary.
Consequential action
Invoke a federal system API.
02 / Action-time control
Make the requested effect testable.
FedRAMP authorization concerns a defined cloud service and controls, not a generic agent feature. Map agent identities, privileged calls, logging and external connections into the authorized boundary.
OriginAgency authorization and cloud service boundary
RequestInvoke a federal system API
DecisionEvaluate and enforce before effect
03 / Evidence and responsibility
Permission, execution, and outcome are separate.
Boundary diagram, control implementation, POA&M and access records.
ProofGrid is not itself evidence of a FedRAMP authorization; agencies and providers own the assessment and authorization.
Primary source