AWS Publishes Four-Scope Agent Security Framework

The most practical agent security framework from a major cloud provider:

• Scope 1: Read-only, no autonomous changes
• Scope 2: Proposes changes, requires human approval
• Scope 3: Autonomous within bounds, no HITL after activation
• Scope 4: Self-initiating, continuous, minimal oversight

Each scope maps to specific controls for identity, memory protection, and behavioral monitoring. Scope 3-4 agents require advanced anomaly detection.

Builder action: Map your agent deployments to these four scopes and implement corresponding security controls. More immediately actionable than OWASP's risk taxonomy or NIST's standards initiative.

Source: AWS Security Blog