Wombat

WAF-AGN-100 – Agent Debt Register

Pillar: Agentic | Severity: Low | Category: Reliability Design | Automatable: High

Description

Known agent limitations must be documented in an Agent Debt Register. Limitations include: knowledge cutoff, tool availability, accuracy limitations, edge cases, and failure modes. The register must be reviewed quarterly with improvement plans.

Rationale

Risk Description

Risk

Undocumented agent limitations accumulate technical and regulatory debt.

Risk

Unknown weaknesses in agent systems expose the organization to emergent failure modes.

Requirements

  • Known agent limitations must be documented in an Agent Debt Register.

  • The register must be reviewed quarterly with improvement plans.

Implementation Guidance

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-agn-100.config.multi.agent-debt-register

Engine: config | Provider: multi | Automated: Yes

Agent Debt Register must be maintained

A version-controlled policy document must exist at docs/agentic/waf-agn-100-reliability-design.md and document the cross-provider implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/agentic/waf-agn-100-reliability-design.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/agentic/waf-agn-100-reliability-design.md must contain a normative requirement statement.

Remediation: Create or update docs/agentic/waf-agn-100-reliability-design.md. State the requirement, how it is implemented for cross-provider, the review cadence, and the owner.

Compliant
docs/agentic/waf-agn-100-reliability-design.md:
- The cross-provider implementation of WAF-AGN-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/agentic/waf-agn-100-reliability-design.md` is missing or does not contain a normative requirement.
# WAF-AGN-100 violation: cross-provider control is not documented

waf-agn-100.config.multi.knowledge-cutoff

Engine: config | Provider: multi | Automated: Yes

Knowledge cutoff date must be documented

A version-controlled policy document must exist at docs/agentic/waf-agn-100-reliability-design.md and document the cross-provider implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/agentic/waf-agn-100-reliability-design.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/agentic/waf-agn-100-reliability-design.md must contain a normative requirement statement.

Remediation: Create or update docs/agentic/waf-agn-100-reliability-design.md. State the requirement, how it is implemented for cross-provider, the review cadence, and the owner.

Compliant
docs/agentic/waf-agn-100-reliability-design.md:
- The cross-provider implementation of WAF-AGN-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/agentic/waf-agn-100-reliability-design.md` is missing or does not contain a normative requirement.
# WAF-AGN-100 violation: cross-provider control is not documented

waf-agn-100.config.multi.quarterly-review

Engine: config | Provider: multi | Automated: Yes

Agent limitations must be reviewed quarterly

A version-controlled policy document must exist at docs/agentic/waf-agn-100-reliability-design.md and document the cross-provider implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/agentic/waf-agn-100-reliability-design.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/agentic/waf-agn-100-reliability-design.md must contain a normative requirement statement.

Remediation: Create or update docs/agentic/waf-agn-100-reliability-design.md. State the requirement, how it is implemented for cross-provider, the review cadence, and the owner.

Compliant
docs/agentic/waf-agn-100-reliability-design.md:
- The cross-provider implementation of WAF-AGN-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/agentic/waf-agn-100-reliability-design.md` is missing or does not contain a normative requirement.
# WAF-AGN-100 violation: cross-provider control is not documented

waf-agn-100.config.multi.improvement-plan

Engine: config | Provider: multi | Automated: Yes

Improvement plan must be maintained for agent debt

A version-controlled policy document must exist at docs/agentic/waf-agn-100-reliability-design.md and document the cross-provider implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/agentic/waf-agn-100-reliability-design.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/agentic/waf-agn-100-reliability-design.md must contain a normative requirement statement.

Remediation: Create or update docs/agentic/waf-agn-100-reliability-design.md. State the requirement, how it is implemented for cross-provider, the review cadence, and the owner.

Compliant
docs/agentic/waf-agn-100-reliability-design.md:
- The cross-provider implementation of WAF-AGN-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/agentic/waf-agn-100-reliability-design.md` is missing or does not contain a normative requirement.
# WAF-AGN-100 violation: cross-provider control is not documented

waf-agn-100.config.aws.aws-reliability-design

Engine: config | Provider: aws | Automated: Yes

Known agent limitations must be documented in an Agent Debt Register

A version-controlled policy document must exist at docs/agentic/waf-agn-100-aws-reliability-design.md and document the AWS implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/agentic/waf-agn-100-aws-reliability-design.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/agentic/waf-agn-100-aws-reliability-design.md must contain a normative requirement statement.

Remediation: Create or update docs/agentic/waf-agn-100-aws-reliability-design.md. State the requirement, how it is implemented for AWS, the review cadence, and the owner.

Compliant
docs/agentic/waf-agn-100-aws-reliability-design.md:
- The AWS implementation of WAF-AGN-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/agentic/waf-agn-100-aws-reliability-design.md` is missing or does not contain a normative requirement.
# WAF-AGN-100 violation: AWS control is not documented

waf-agn-100.config.azurerm.azurerm-reliability-design

Engine: config | Provider: azurerm | Automated: Yes

Known agent limitations must be documented in an Agent Debt Register

A version-controlled policy document must exist at docs/agentic/waf-agn-100-azurerm-reliability-design.md and document the Azure implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/agentic/waf-agn-100-azurerm-reliability-design.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/agentic/waf-agn-100-azurerm-reliability-design.md must contain a normative requirement statement.

Remediation: Create or update docs/agentic/waf-agn-100-azurerm-reliability-design.md. State the requirement, how it is implemented for Azure, the review cadence, and the owner.

Compliant
docs/agentic/waf-agn-100-azurerm-reliability-design.md:
- The Azure implementation of WAF-AGN-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/agentic/waf-agn-100-azurerm-reliability-design.md` is missing or does not contain a normative requirement.
# WAF-AGN-100 violation: Azure control is not documented

waf-agn-100.config.google.google-reliability-design

Engine: config | Provider: google | Automated: Yes

Known agent limitations must be documented in an Agent Debt Register

A version-controlled policy document must exist at docs/agentic/waf-agn-100-google-reliability-design.md and document the GCP implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/agentic/waf-agn-100-google-reliability-design.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/agentic/waf-agn-100-google-reliability-design.md must contain a normative requirement statement.

Remediation: Create or update docs/agentic/waf-agn-100-google-reliability-design.md. State the requirement, how it is implemented for GCP, the review cadence, and the owner.

Compliant
docs/agentic/waf-agn-100-google-reliability-design.md:
- The GCP implementation of WAF-AGN-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/agentic/waf-agn-100-google-reliability-design.md` is missing or does not contain a normative requirement.
# WAF-AGN-100 violation: GCP control is not documented

waf-agn-100.config.stackit.stackit-reliability-design

Engine: config | Provider: stackit | Automated: Yes

Known agent limitations must be documented in an Agent Debt Register

A version-controlled policy document must exist at docs/agentic/waf-agn-100-stackit-reliability-design.md and document the STACKIT implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/agentic/waf-agn-100-stackit-reliability-design.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/agentic/waf-agn-100-stackit-reliability-design.md must contain a normative requirement statement.

Remediation: Create or update docs/agentic/waf-agn-100-stackit-reliability-design.md. State the requirement, how it is implemented for STACKIT, the review cadence, and the owner.

Compliant
docs/agentic/waf-agn-100-stackit-reliability-design.md:
- The STACKIT implementation of WAF-AGN-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/agentic/waf-agn-100-stackit-reliability-design.md` is missing or does not contain a normative requirement.
# WAF-AGN-100 violation: STACKIT control is not documented

waf-agn-100.config.ovh.ovh-reliability-design

Engine: config | Provider: ovh | Automated: Yes

Known agent limitations must be documented in an Agent Debt Register

A version-controlled policy document must exist at docs/agentic/waf-agn-100-ovh-reliability-design.md and document the OVHcloud implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/agentic/waf-agn-100-ovh-reliability-design.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/agentic/waf-agn-100-ovh-reliability-design.md must contain a normative requirement statement.

Remediation: Create or update docs/agentic/waf-agn-100-ovh-reliability-design.md. State the requirement, how it is implemented for OVHcloud, the review cadence, and the owner.

Compliant
docs/agentic/waf-agn-100-ovh-reliability-design.md:
- The OVHcloud implementation of WAF-AGN-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/agentic/waf-agn-100-ovh-reliability-design.md` is missing or does not contain a normative requirement.
# WAF-AGN-100 violation: OVHcloud control is not documented

waf-agn-100.config.hcloud.hcloud-reliability-design

Engine: config | Provider: hcloud | Automated: Yes

Known agent limitations must be documented in an Agent Debt Register

A version-controlled policy document must exist at docs/agentic/waf-agn-100-hcloud-reliability-design.md and document the Hetzner Cloud implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/agentic/waf-agn-100-hcloud-reliability-design.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/agentic/waf-agn-100-hcloud-reliability-design.md must contain a normative requirement statement.

Remediation: Create or update docs/agentic/waf-agn-100-hcloud-reliability-design.md. State the requirement, how it is implemented for Hetzner Cloud, the review cadence, and the owner.

Compliant
docs/agentic/waf-agn-100-hcloud-reliability-design.md:
- The Hetzner Cloud implementation of WAF-AGN-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/agentic/waf-agn-100-hcloud-reliability-design.md` is missing or does not contain a normative requirement.
# WAF-AGN-100 violation: Hetzner Cloud control is not documented

Evidence

Kind Required Description

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework Controls

ISO 27001:2022

* A.8.1 – Information security roles and responsibilities * A.8.2 – Privileged access rights

ISO 27017

* CLD.9.5 – Segregation in virtual computing environments

CIS Controls v8

* CIS 13 – Content Filtering

SOC 2 Type II

* CC4.1 – Monitoring activities * CC7.1 – Infrastructure and software monitoring

NIST SP 800-53

* RA-5 – Vulnerability scanning * SI-4 – Information system monitoring

NIST CSF 2.0

* DE.CM – Continuous monitoring * DE.AE – Anomalies and events

GDPR

* Art. 32 – Security of processing * Art. 5(1)(f) – Integrity and confidentiality

PCI DSS v4.0

* Req 6.4 – Secure development lifecycle * Req 6.5 – Secure coding practices

CSA STAR

* CCM Logging and Monitoring

BSI C5:2020

* OPS-01 – Operational monitoring

TISAX

* Information security – Monitoring and logging

ANSSI SecNumCloud

* Domain – Logging and monitoring

BIO

* BIO – Logboekhouding en monitoring

ENS High

* op.exp.6 – Gestión de cambios

UK NCSC CAF

* A4 – Policy and assurance

FedRAMP

* RA-5, SI-4 (Moderate baseline)

CMMC 2.0

* RA.L2-3.8.1 – Vulnerability scanning

IT-Grundschutz

* ORP.1 – Organisation

IRAP

* ISM – Logging and monitoring

CCCS PBMM

* RA-5 – Vulnerability scanning

MAS TRM

* Ch.9 – Change management

ISMAP

* Monitoring and logging controls

FISC

* Technical measures – Logging and monitoring