Multi-Agent Reference Architecture Controls
Controls that implement FINOS AIGF mitigations across the multi-agent architecture layers.
Preventive
Prevention and risk mitigation controls for the multi-agent architecture.
CCC.MARefArc.CN01Data Filtering From External Knowledge Bases
Sanitize, filter, and classify data ingested by the Knowledge Layer from internal and external source bases before it is embedded into the vector store or used for retrieval-augmented generation, preventing inadvertent exposure or manipulation of sensitive organizational knowledge.
CCC.MARefArc.CN01.AR01Data ingested into the Knowledge Layer MUST be scanned and filtered for sensitive content before it is embedded or indexed for retrieval.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN01.AR02Ingestion pipelines MUST enforce source-level allow and deny rules so that unapproved repositories cannot be embedded into the vector store.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH06CCC.MARefArc.TH07CCC.MARefArc.TH01CCC.MARefArc.TH02
FINOS-AIRAIR-PREV-002
CCC.MARefArc.CN02User, Application, and Model Firewalling
Establish enforced trust boundaries between the user, the application, and the models and tools by routing all traffic through the agent, LLM, and MCP gateways where guardrails inspect and constrain requests and responses.
CCC.MARefArc.CN02.AR01All traffic between the user-facing application and the agent layer MUST traverse the Agent Gateway guardrails; direct application-to-agent paths that bypass the gateway MUST be denied.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN02.AR02All model and tool invocations MUST traverse the LLM and MCP gateway guardrails respectively, with inputs and outputs inspected against policy.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH08CCC.MARefArc.TH09CCC.MARefArc.TH10CCC.MARefArc.TH14CCC.MARefArc.TH15CCC.MARefArc.TH11CCC.MARefArc.TH12CCC.MARefArc.TH13
FINOS-AIRAIR-PREV-003
CCC.MARefArc.CN03System Acceptance Testing
Validate agents, models, and end-to-end workflows against accuracy, robustness, bias, drift, and compliance criteria before promotion to production, and re-validate after material changes.
CCC.MARefArc.CN03.AR01Each agent and model configuration MUST pass a documented acceptance test suite covering accuracy, bias and fairness, and compliance criteria before being onboarded into the respective registry.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN03.AR02Acceptance testing MUST be repeated when a pinned model version, system prompt, or deployment configuration changes.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH23CCC.MARefArc.TH25CCC.MARefArc.TH19CCC.MARefArc.TH16CCC.MARefArc.TH17CCC.MARefArc.TH18
FINOS-AIRAIR-PREV-005
CCC.MARefArc.CN04Data Quality and Classification
Assess the quality of, and assign classification and sensitivity labels to, all data used for grounding, training, and fine-tuning, and enforce handling rules derived from those labels throughout the Knowledge and LLM layers.
CCC.MARefArc.CN04.AR01All data sources feeding the Knowledge Layer or used for fine-tuning MUST carry a classification and sensitivity label.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN04.AR02Data quality checks for accuracy, completeness, freshness, and bias MUST be applied to grounding and training data, and data failing thresholds MUST be quarantined from production use.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH06CCC.MARefArc.TH07CCC.MARefArc.TH22CCC.MARefArc.TH23CCC.MARefArc.TH25CCC.MARefArc.TH26CCC.MARefArc.TH01CCC.MARefArc.TH02CCC.MARefArc.TH03CCC.MARefArc.TH04CCC.MARefArc.TH05CCC.MARefArc.TH16
FINOS-AIRAIR-PREV-006
CCC.MARefArc.CN05Legal and Contractual Frameworks for AI Systems
Establish contractual controls with model and MCP service providers covering data handling, retention and deletion, intellectual property, liability, and supply-chain integrity.
CCC.MARefArc.CN05.AR01Every approved model and MCP server provider MUST be governed by a contract specifying data handling, retention and deletion, and intellectual-property terms before it is added to the registry.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN05.AR02Provider contracts MUST include supply-chain integrity and breach-notification obligations.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH25CCC.MARefArc.TH26CCC.MARefArc.TH01CCC.MARefArc.TH02CCC.MARefArc.TH20CCC.MARefArc.TH21CCC.MARefArc.TH15
FINOS-AIRAIR-PREV-007
CCC.MARefArc.CN06Quality of Service and DDoS Prevention
Protect model and tool availability by enforcing quality-of-service controls, rate limits, and abuse and DDoS mitigation at the gateways.
CCC.MARefArc.CN06.AR01The LLM and MCP gateways MUST enforce per-consumer rate limits and quotas.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN06.AR02Gateways MUST apply DDoS and abuse detection and load shedding to preserve availability under load.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH08CCC.MARefArc.TH09CCC.MARefArc.TH10
FINOS-AIRAIR-PREV-008
CCC.MARefArc.CN07AI Model Version Pinning
Pin and record explicit model versions in the Model Registry so that model behaviour is reproducible and provider-side changes are surfaced rather than silently absorbed.
CCC.MARefArc.CN07.AR01The Model Registry MUST pin an explicit, immutable model version for each approved model used in production.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN07.AR02A change to the underlying provider model version MUST require re-approval through the registry before use.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH19CCC.MARefArc.TH17
FINOS-AIRAIR-PREV-010
CCC.MARefArc.CN08Role-Based Access Control for AI Data
Enforce least-privilege, role-based access control over all AI data stores, including source bases, the vector store, and model artifacts.
CCC.MARefArc.CN08.AR01Access to AI data stores, including source bases, the vector store, and model artifacts, MUST be governed by role-based access control with least privilege.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN08.AR02Access grants MUST be reviewed periodically and revoked when no longer required.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH06CCC.MARefArc.TH07CCC.MARefArc.TH01CCC.MARefArc.TH02CCC.MARefArc.TH20CCC.MARefArc.TH21
FINOS-AIRAIR-PREV-012
CCC.MARefArc.CN09Encryption of AI Data at Rest
Encrypt AI data at rest, including the vector store and source repositories, so that storage-level access does not expose embeddings or sensitive content.
CCC.MARefArc.CN09.AR01The vector store and all AI data repositories MUST be encrypted at rest using managed keys.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN09.AR02Access to encryption keys MUST be restricted and audited.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH25CCC.MARefArc.TH03CCC.MARefArc.TH04CCC.MARefArc.TH05
FINOS-AIRAIR-PREV-014
CCC.MARefArc.CN10AI Firewall Implementation and Management
Implement and operate an AI firewall within the guardrail components that inspects prompts, content, and responses for injection, sensitive data, and policy violations.
CCC.MARefArc.CN10.AR01The gateway guardrails MUST include an AI firewall that screens inputs for prompt injection and policy violations and screens outputs for sensitive-data disclosure and harmful content.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN10.AR02AI firewall rules MUST be centrally managed and versioned.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH08CCC.MARefArc.TH09CCC.MARefArc.TH10CCC.MARefArc.TH14CCC.MARefArc.TH15CCC.MARefArc.TH11CCC.MARefArc.TH12CCC.MARefArc.TH13
FINOS-AIRAIR-PREV-017
CCC.MARefArc.CN11Agent Authority Least Privilege Framework
Constrain each agent's authority to the minimum set of tools, APIs, and data required for its task, enforced by the runtime and MCP guardrails, and prevent permission creep during operation.
CCC.MARefArc.CN11.AR01Each agent MUST be granted only the tools, endpoints, and scopes required for its registered purpose.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN11.AR02Agent permissions MUST be enforced at invocation time and MUST NOT expand during a session without explicit reauthorization.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH27CCC.MARefArc.TH14
FINOS-AIRAIR-PREV-018
CCC.MARefArc.CN12Tool Chain Validation and Sanitization
Validate tool selection, sanitize tool-call parameters, and constrain tool sequencing within the runtime and MCP guardrails to prevent manipulation of agent tool use.
CCC.MARefArc.CN12.AR01Tool-call parameters MUST be validated and sanitized against a schema before execution.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN12.AR02Tool selection and sequencing MUST be constrained to patterns authorized for the agent's task.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH27CCC.MARefArc.TH28CCC.MARefArc.TH11CCC.MARefArc.TH12CCC.MARefArc.TH13
FINOS-AIRAIR-PREV-019
CCC.MARefArc.CN13MCP Server Security Governance
Govern the onboarding, verification, and ongoing monitoring of MCP servers so that only approved, integrity-verified servers are reachable, and supply-chain compromise is detected.
CCC.MARefArc.CN13.AR01Only MCP servers registered and verified in the MCP Server Registry MUST be reachable by agents.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN13.AR02MCP server updates MUST be integrity-verified, and connections MUST be authenticated and transport-encrypted.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH29CCC.MARefArc.TH01CCC.MARefArc.TH02CCC.MARefArc.TH20CCC.MARefArc.TH21
FINOS-AIRAIR-PREV-020
CCC.MARefArc.CN14Multi-Agent Isolation and Segmentation
Isolate agents and their memory and state so that compromise or failure of one agent cannot propagate to others, and enforce segmentation of agent-to-agent communication.
CCC.MARefArc.CN14.AR01Each agent's runtime, memory, and workspace MUST be isolated such that one agent cannot read or modify another's state without authorization.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN14.AR02Agent-to-agent communication MUST be authenticated and segmented to prevent privilege inheritance and cascade failures.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH27CCC.MARefArc.TH30CCC.MARefArc.TH31
FINOS-AIRAIR-PREV-022
CCC.MARefArc.CN15Agentic System Credential Protection Framework
Prevent agents from discovering, extracting, or misusing credentials by brokering secrets outside agent-accessible surfaces and constraining tool access to credential stores.
CCC.MARefArc.CN15.AR01Credentials MUST be brokered by the runtime and MUST NOT be exposed to agent-accessible memory, prompts, logs, or the workspace file system.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN15.AR02Agent tools MUST be denied access to credential stores, environment secrets, and instance metadata except through the secure-execution broker.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH27CCC.MARefArc.TH29CCC.MARefArc.TH32
FINOS-AIRAIR-PREV-023
Detective
Detection, monitoring, feedback, and audit controls.
CCC.MARefArc.CN16AI Data Leakage Prevention and Detection
Detect leakage of sensitive data in model inputs and outputs and in telemetry, and alert and respond when disclosure is detected.
CCC.MARefArc.CN16.AR01Model outputs and telemetry MUST be monitored for disclosure of classified or sensitive data, with alerts raised on detection.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN16.AR02Detected leakage events MUST trigger a documented response and escalation workflow.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH01CCC.MARefArc.TH02
FINOS-AIRAIR-DET-001
CCC.MARefArc.CN17AI System Observability
Instrument every layer to emit logs, traces, metrics, and events to the Observability Layer so that behaviour, drift, availability, and data handling are continuously visible and auditable.
CCC.MARefArc.CN17.AR01Every layer MUST emit logs, traces, metrics, and events covering requests, model interactions, retrievals, and policy decisions to the Observability Layer.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN17.AR02Telemetry MUST be retained and queryable for the period required to support audit and incident investigation.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH22CCC.MARefArc.TH01CCC.MARefArc.TH02CCC.MARefArc.TH08CCC.MARefArc.TH09CCC.MARefArc.TH10CCC.MARefArc.TH19CCC.MARefArc.TH17CCC.MARefArc.TH18CCC.MARefArc.TH14
FINOS-AIRAIR-DET-004
CCC.MARefArc.CN18AI System Alerting and Denial of Wallet Monitoring
Monitor spend and usage of models and tools, and alert on anomalous consumption indicative of Denial of Wallet or runaway agentic loops.
CCC.MARefArc.CN18.AR01Model and tool consumption MUST be metered per consumer and monitored against budget and rate thresholds.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN18.AR02Anomalous spend or call volume MUST raise alerts and MUST be able to trigger throttling or suspension.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH08CCC.MARefArc.TH09CCC.MARefArc.TH10
FINOS-AIRAIR-DET-009
CCC.MARefArc.CN19Human Feedback Loop for AI Systems
Capture human feedback on agent outputs through the Feedback Engine and Human Supervision capabilities and feed it into evaluation and improvement of agents and models.
CCC.MARefArc.CN19.AR01The system MUST provide a mechanism for humans to rate, correct, or reject agent outputs, and MUST capture that feedback in the Feedback Engine.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN19.AR02Captured feedback MUST be reviewable and MUST inform retraining, prompt, or configuration changes.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH23CCC.MARefArc.TH19CCC.MARefArc.TH17CCC.MARefArc.TH18CCC.MARefArc.TH15
FINOS-AIRAIR-DET-011
CCC.MARefArc.CN20Citations and Source Traceability for AI-Generated Information
Attach citations and source traceability to AI-generated information so that outputs can be verified against retrieved sources and decisions can be explained.
CCC.MARefArc.CN20.AR01Outputs grounded in retrieved content MUST include citations identifying the source documents.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN20.AR02The system MUST retain the linkage between an output and the retrieved sources used to produce it.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH24CCC.MARefArc.TH25CCC.MARefArc.TH16CCC.MARefArc.TH15
FINOS-AIRAIR-DET-013
CCC.MARefArc.CN21Automated Evaluation Using LLM-as-a-Judge
Use automated model-based evaluation in the Evaluation Layer to assess output quality, grounding, bias, and policy compliance at scale.
CCC.MARefArc.CN21.AR01Agent outputs MUST be subject to automated model-based evaluation for grounding, accuracy, and policy compliance.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN21.AR02Automated evaluation results MUST feed runtime protection and human supervision when thresholds are breached.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH22CCC.MARefArc.TH23CCC.MARefArc.TH01CCC.MARefArc.TH02CCC.MARefArc.TH19CCC.MARefArc.TH16CCC.MARefArc.TH17CCC.MARefArc.TH18
FINOS-AIRAIR-DET-015
CCC.MARefArc.CN22Preserving Source Data Access Controls in AI Systems
Propagate the access controls of source data into the retrieval path so that retrieval and generation cannot expose content a requesting user is not authorized to see.
CCC.MARefArc.CN22.AR01Retrieval MUST enforce the access controls of the underlying source data for the requesting principal.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN22.AR02Embeddings and retrieved context MUST be filtered by the requester's entitlements before being supplied to the model.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH25CCC.MARefArc.TH03CCC.MARefArc.TH04CCC.MARefArc.TH05
FINOS-AIRAIR-DET-016
CCC.MARefArc.CN23Agent Decision Audit and Explainability
Record an auditable trace of agent decisions, including tool selections, inputs, and rationale, sufficient to explain and review autonomous actions after the fact.
CCC.MARefArc.CN23.AR01The system MUST record an auditable decision trace for each agent action, including the tools invoked and the inputs and rationale leading to them.
Applicability:
tlp-cleartlp-greentlp-ambertlp-redCCC.MARefArc.CN23.AR02Decision traces MUST be retained and reviewable to support explainability and post-incident analysis.
Applicability:
tlp-cleartlp-greentlp-ambertlp-red
CCC.MARefArc.THCCC.MARefArc.TH27CCC.MARefArc.TH28CCC.MARefArc.TH25
FINOS-AIRAIR-DET-021