Trust & security · Control map

Threat, control, evidence.

How the controls on our trust page line up with MITRE ATLAS, OWASP, NIST and SOC 2, and what to ask us for in diligence.

Read this first. OneBee's controls align directionally to these framework outcomes, and we can produce evidence that supports your governance and assurance program. We are not NIST compliant, MITRE certified or ISO certified, and we won't say so unless a separate assessment supports it. Our public assurance claim is SOC 2 Type I.

Threat path	OneBee control	Evidence to request	Alignment
01 UNTRUSTED INPUT An instruction hidden in a document or email steers the agent.	Content labeled as data, sender-address authorization, citation verification; containment by allow-list and approvals. What an agent reads is handed to the model as data, not instructions. Email triggers authorize on the sender's address, never the display name. Every citation is checked against the stored page or dropped. We don't rely on the labeling: the allow-list and approvals contain what gets through. In the product	Injection test cases and results.	ATLAS M0030 partialOWASP ASI01/06AI RMF MEASURE
02 IDENTITY An agent's access turns into standing privilege.	Owner-bound agent identity, RBAC, tenant isolation, encrypted credentials. An agent acts as the person or organization that owns it, never a shared platform identity. Role-based permissions, per-tenant storage, credentials encrypted with AES-256-GCM. In the product	Role matrix, delegation model, tenant-isolation test results, offboarding procedure.	ATLAS M0026SP 800-207SOC 2 CC6
03 UNEVALUATED CHANGE An agent's model, instructions or connected apps change and nobody checks.	Automated checks on every code change, versioned agents with rollback, labeled-set evaluations, post-run quality checks. Every code change runs through automated checks: tests, type and style checks, a scan for leaked secrets and a review of third-party packages. Each agent's instructions and model are saved as versions, so you can roll back to an earlier one. Our document-reading pipelines are measured against hand-labeled examples with fixed pass marks, and finished agent runs are checked for quality afterwards. On request	Evaluation report for your workflow, version history, rollback criteria.	AI RMF MEASURECSF ID.IMSOC 2 CC3/CC7
04 DATA + SUPPLY CHAIN Your data crosses providers you can't see.	GCP home, named providers by purpose, no training, public list. Platform, agents and stored data in Google Cloud. Model calls go to named providers, none of which train on your data. Public list, notice before it changes. In the product	DPA Annex 3, data-flow diagram, processing locations, retention schedule.	CSF GV.SCSOC 2 CC9
05 TOOL MISUSE A legitimate tool becomes the attack path.	Explicit allow-list and scoped reach, one-click revoke. Every agent runs against an explicit allow-list: only the tools its task needs, revocable in one click. In the product	Tool-policy export, blocked-call sample, scope-change history, revoke demonstration.	ATLAS M0028OWASP ASI02CSF PR.AASOC 2 CC6
06 CONSEQUENTIAL ACTIONS A plausible answer gets trusted too fast.	Configurable per-action approval gates. Approval can be required on every action. The card shows the exact call and its arguments. An approver can still be fooled, which is why approvals sit behind the allow-list, not in place of it. Residual risk: a person can approve the wrong thing. In the product	Approval policy, sample approval record, approver identity, timeout behavior.	ATLAS M0029OWASP ASI09 residualSOC 2 CC6/CC7
07 INVISIBLE ACTION The agent acts and nobody can say why.	Tool, sub-agent, message and approval logs, exportable. Tool calls, sub-agent calls, messages and approvals are logged. Inspect and export the audit log. In the product	Sample export, retention policy, actor and timestamp fields.	ATLAS M0024CSF DE.CMSOC 2 CC7
08 DRIFT + INCIDENTS Detection arrives, authority stays live.	Fleet health on the dashboard, post-run scoring, one-click revoke, 72-hour incident notice. Failed runs, stuck runs and broken connectors surface on the agents dashboard. Completed runs are scored after the fact, and a reflection pass proposes fixes when quality slips. One-click revoke. Incident notice within 72 hours of confirmation, written into the DPA. In the product	Revoke demonstration, incident runbook, recovery test.	CSF DE/RS/RCSOC 2 CC7

01 UNTRUSTED INPUT

Threat path: An instruction hidden in a document or email steers the agent.
OneBee control: Content labeled as data, sender-address authorization, citation verification; containment by allow-list and approvals.What an agent reads is handed to the model as data, not instructions. Email triggers authorize on the sender's address, never the display name. Every citation is checked against the stored page or dropped. We don't rely on the labeling: the allow-list and approvals contain what gets through.
Evidence to request: Injection test cases and results.
Alignment: ATLAS M0030 partialOWASP ASI01/06AI RMF MEASURE

02 IDENTITY

Threat path: An agent's access turns into standing privilege.
OneBee control: Owner-bound agent identity, RBAC, tenant isolation, encrypted credentials.An agent acts as the person or organization that owns it, never a shared platform identity. Role-based permissions, per-tenant storage, credentials encrypted with AES-256-GCM.
Evidence to request: Role matrix, delegation model, tenant-isolation test results, offboarding procedure.
Alignment: ATLAS M0026SP 800-207SOC 2 CC6

03 UNEVALUATED CHANGE

Threat path: An agent's model, instructions or connected apps change and nobody checks.
OneBee control: Automated checks on every code change, versioned agents with rollback, labeled-set evaluations, post-run quality checks.Every code change runs through automated checks: tests, type and style checks, a scan for leaked secrets and a review of third-party packages. Each agent's instructions and model are saved as versions, so you can roll back to an earlier one. Our document-reading pipelines are measured against hand-labeled examples with fixed pass marks, and finished agent runs are checked for quality afterwards.
Evidence to request: Evaluation report for your workflow, version history, rollback criteria.
Alignment: AI RMF MEASURECSF ID.IMSOC 2 CC3/CC7

04 DATA + SUPPLY CHAIN

Threat path: Your data crosses providers you can't see.
OneBee control: GCP home, named providers by purpose, no training, public list.Platform, agents and stored data in Google Cloud. Model calls go to named providers, none of which train on your data. Public list, notice before it changes.
Evidence to request: DPA Annex 3, data-flow diagram, processing locations, retention schedule.
Alignment: CSF GV.SCSOC 2 CC9

05 TOOL MISUSE

Threat path: A legitimate tool becomes the attack path.
OneBee control: Explicit allow-list and scoped reach, one-click revoke.Every agent runs against an explicit allow-list: only the tools its task needs, revocable in one click.
Evidence to request: Tool-policy export, blocked-call sample, scope-change history, revoke demonstration.
Alignment: ATLAS M0028OWASP ASI02CSF PR.AASOC 2 CC6

06 CONSEQUENTIAL ACTIONS

Threat path: A plausible answer gets trusted too fast.
OneBee control: Configurable per-action approval gates.Approval can be required on every action. The card shows the exact call and its arguments. An approver can still be fooled, which is why approvals sit behind the allow-list, not in place of it.Residual risk: a person can approve the wrong thing.
Evidence to request: Approval policy, sample approval record, approver identity, timeout behavior.
Alignment: ATLAS M0029OWASP ASI09 residualSOC 2 CC6/CC7

07 INVISIBLE ACTION

Threat path: The agent acts and nobody can say why.
OneBee control: Tool, sub-agent, message and approval logs, exportable.Tool calls, sub-agent calls, messages and approvals are logged. Inspect and export the audit log.
Evidence to request: Sample export, retention policy, actor and timestamp fields.
Alignment: ATLAS M0024CSF DE.CMSOC 2 CC7

08 DRIFT + INCIDENTS

Threat path: Detection arrives, authority stays live.
OneBee control: Fleet health on the dashboard, post-run scoring, one-click revoke, 72-hour incident notice.Failed runs, stuck runs and broken connectors surface on the agents dashboard. Completed runs are scored after the fact, and a reflection pass proposes fixes when quality slips. One-click revoke. Incident notice within 72 hours of confirmation, written into the DPA.
Evidence to request: Revoke demonstration, incident runbook, recovery test.
Alignment: CSF DE/RS/RCSOC 2 CC7

ISO/IEC 42001, 27001, 27017, 27018 and 27701 are mapping targets, not certifications.

Talk to our security team