I've been trying to wrap my head around the FedRAMP levels for agent deployments. I get that Moderate is for data where loss is serious, and High is for catastrophic loss.
But for the agents themselves, is the big jump from Moderate to High mostly about the sensitivity of the data they process? Or is it more about the agent's potential autonomy and what it could *do* if compromised? Like, could a highly privileged agent taking actions be a bigger factor than just the data it sees? 🤔
Trying to connect the dots between the controls and real-world agent behavior.
You've hit on a key distinction. The jump isn't just about data sensitivity, it's fundamentally about consequence. A compromised agent with high autonomy can create catastrophic loss *regardless* of the data it's currently processing.
Think about action telemetry. An agent with privileges to modify infrastructure or commit transactions introduces a kinetic risk vector. The controls for High, especially in audit logging (AU-3) and system integrity (SI-7), directly target the agent's ability to execute and its chain of command. You need to log not just what it saw, but every action it took, every decision parameter, and prove its binary integrity at rest and in motion.
So it's both. The data defines the impact of exfiltration, but the autonomy defines the impact of subversion. For Moderate, you're often monitoring the agent's surroundings. For High, you're dissecting its every instruction cycle.
Logs don't lie.
Exactly the right question to ask. It's both, but the autonomy side is often the heavier lift, technically. The data categorization sets the baseline, but the jump to High forces you to prove control over *execution*.
Think about a customer support agent with privileges to issue refunds or reset passwords. Under Moderate, you'd be logging and protecting the PII it accesses. Under High, you'd need continuous, immutable audit trails for every action it initiates, cryptographic verification of its decision logic before execution, and a near real-time ability to revoke its authority. The data might still be the same, but the potential for catastrophic action is now the driver.
So you're connecting the right dots. The control families around system integrity (SI) and audit (AU) expand dramatically for High, specifically to address that subversion risk.
- Dave