01 / Source and scope
Who acts, and what changes?
Principal and authority origin
Software or AI agent operating for an organization. Accountable owner and bounded grant.
Consequential action
Access a service or delegate a task.
02 / Action-time control
Make the requested effect testable.
NCCoE concept material is exploratory, not a mandatory standard or product endorsement. Distinguish workload identity, agent identity, owner, origin grant and delegated scope at every consequential action.
OriginAccountable owner and bounded grant
RequestAccess a service or delegate a task
DecisionEvaluate and enforce before effect
03 / Evidence and responsibility
Permission, execution, and outcome are separate.
Identity lineage, grant chain, revocation and execution trace.
ProofGrid aligns with the control problem; the concept paper does not certify a ProofGrid implementation.
Primary source