Agent Control Standard, mapped to BitEvo authority and evidence gates

For a consequential step: the agent and Guardian identities, the requested action and object, and the Guardian decision that is bound before the action proceeds.

ACS-Core is the mandatory v0.1.0 baseline. This mapping does not claim that Core alone makes a deployment secure or its policy strict.

A trace or event record that links the Guardian decision to the governed step with enough identity and time context to reconstruct what happened.

Trace is observability evidence. A trace event is not, by itself, proof that the external system reached the intended state.

The Agent Bill of Materials visible for the session: models, MCP servers, A2A peers, tools, knowledge sources and memory stores relevant to the scoped action.

We use the component inventory as evidence for the scoped workflow; this is not a software-composition certification.

The component mutation reported during the session and the control response when the component set changes after the original decision context.

We test the agreed change path and constrained response, not every possible runtime mutation.

Origin, source identifier and lineage available for decision-bearing fields at the control boundary.

We test whether the decision can bind to provenance evidence. We do not assign a universal trust score to the source.

Where the profile is in scope, the signed audit material, verification result and identity or key relationship used to attribute the record.

Cryptographic evidence does not turn an unsafe policy into a safe one, and this mapping is not a key-management or non-repudiation certification.

A reconstructable audit chain for the governed action and the defined response when required audit evidence is missing, broken or cannot be verified.

We test evidence continuity and constrained behavior for the agreed action. This is not an ACS conformance audit.