Patterns
Key Resources
Guardrails ACS / Key Resources

Getting Started — Key Resources

Official Documentation

ACS Site (Control-Plane Framing)

agentcontrolstandard.org

  • Control-plane framing and architecture
  • Launch context and philosophy
  • Community governance information
  • Reference architecture diagrams

AOS Specification (Technical Contract)

aos.owasp.org

  • The technical contract — hooks, trace, inspect
  • Hook method specifications
  • Event schemas and verdict objects
  • Core concepts and environment model

AOS Supported Hooks Reference

aos.owasp.org/spec/instrument/hooks/

  • Complete list of supported hooks
  • Hook firing conditions
  • Required context for each hook
  • Typical Guardian Agent use cases

AOS Core Concepts

aos.owasp.org/topics/core_concepts

  • Agent environment model
  • Observed Agent responsibilities
  • Guardian Agent responsibilities
  • Instrument, Trace, Inspect fundamentals

GitHub Repositories

OWASP AOS GitHub Project

github.com/OWASP/www-project-agent-observability-standard

  • OWASP-hosted AOS specification
  • Apache 2.0 licensed
  • Community contributions welcome
  • Issue tracking and discussions

ACS GitHub Repository

github.com/Agent-Control-Standard/ACS

  • ACS reference implementation
  • MIT licensed
  • Guard the reference architecture
  • Implementation examples and guides

OWASP Resources

OWASP Top 10 for Agentic Applications (2026)

genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/

  • Complete risk catalog (ASI01–ASI10)
  • Risk descriptions and examples
  • Mitigation strategies
  • Mapping to ACS controls

OWASP Official AOS Project Page

owasp.org/www-project-agent-observability-standard-2

  • OWASP project overview
  • Project governance and leadership
  • Contribution guidelines
  • Roadmap and status

OWASP GenAI Security Project

genai.owasp.org

  • Broader OWASP GenAI security initiatives
  • Additional resources and tools
  • Community events and activities
  • Research and publications

Regulatory Frameworks

EU AI Act

  • Article 14 (Human Oversight) — requires high-risk AI systems to enable human monitoring, understanding, intervention, and halting
  • Enforcement: August 2, 2026 for high-risk system obligations
  • Relevance: Provides regulatory driver for ACS implementation

NIST AI Risk Management Framework

  • MEASURE Function — requires continuous monitoring and measurement
  • MANAGE Function — requires demonstrated capacity to disengage autonomous systems
  • Relevance: Provides U.S. regulatory context for ACS capabilities

Community and Support

Getting Involved

Ways to engage with the ACS/AOS community:

  • GitHub Issues — report bugs, request features, ask questions
  • GitHub Discussions — participate in community discussions
  • OWASP Slack — join the GenAI Security Project workspace
  • Conferences — attend AI Agent Security Summit and other events

Contributing

Types of contributions needed:

  • Implementation feedback — share lessons from production deployments
  • Documentation improvements — enhance guides and reference materials
  • Code contributions — submit implementations or integrations
  • Testing and validation — test specifications and implementations
  • Translation — help translate documentation into other languages

Reporting Security Issues

For security vulnerabilities or concerns:

  • Private disclosure — report security issues privately to maintainers
  • Coordinated disclosure — follow responsible disclosure practices
  • OWASP security processes — follow OWASP security reporting guidelines

Learning Resources

Background Reading

To understand the context and motivation for ACS:

  • Agentic AI Security Landscape — understand the evolving threat landscape
  • Model Context Protocol (MCP) — learn about the tool-calling standard
  • Agent-to-Agent (A2A) Protocol — understand inter-agent communication
  • OpenTelemetry — familiarize yourself with the observability standard
  • OCSF — learn about the Open Cybersecurity Schema Framework

Technical Prerequisites

Effective ACS implementation requires knowledge of:

  • Agent frameworks — LangChain, CrewAI, or your chosen framework
  • Policy languages — declarative policy development
  • Security engineering — threat modeling and security architecture
  • Observability — OpenTelemetry, SIEM integration, security monitoring
  • Supply chain security — SBOM management, component tracking

Vendor Integrations

Framework Support

Check current framework support before implementing:

  • LangChain — callback-based hook integration
  • CrewAI — middleware-based hook system
  • Other frameworks — verify current support status
  • Custom frameworks — guidance for implementing AOS hooks

Security Tool Integration

ACS can integrate with existing security tools:

  • SIEM systems — Splunk, IBM QRadar, ArcSight, etc.
  • DLP solutions — data loss prevention platforms
  • IAM systems — identity and access management
  • Threat intelligence — security threat feeds and platforms

Implementation Support

Professional Services

Consider engaging with:

  • ACS implementation partners — organizations with ACS expertise
  • Security consultants — firms specializing in AI security
  • System integrators — experienced with agent deployments
  • Managed service providers — for ongoing ACS operations

Training and Education

Build team capabilities through:

  • Official documentation — start with ACS and AOS guides
  • Community workshops — participate in hands-on sessions
  • Conferences and events — attend AI security conferences
  • Online courses — seek out AI security training programs

Staying Current

Version Tracking

Monitor for updates:

  • GitHub releases — track new ACS and AOS versions
  • Roadmap updates — follow progress on planned features
  • Specification changes — monitor for breaking changes
  • Security advisories — stay informed about security updates

Community Channels

Join the conversation:

  • GitHub Discussions — participate in technical discussions
  • OWASP mailing lists — subscribe to project announcements
  • Social media — follow key contributors and organizations
  • Blogs and publications — read community insights and analysis

Quick Reference

Key Contacts

  • OWASP GenAI Security Project — overall governance and coordination
  • ACS Maintainers — technical questions and issues
  • Community forums — peer support and discussion

Next Steps

  • Hooks Reference — detailed technical documentation of all supported hooks
  • Risk Control Mapping — condensed quick-reference for ASI to ACS mapping
← Back to Overview →
Jump to other sections:
📚 Overview ⏰ Why Runtime Control 🔗 ACS vs AOS 🏗️ Three Pillars 🎯 Three-Tier Architecture 📊 OWASP Risk Mapping 🔧 Implementation Guide 📐 Reference Architecture ✅ Governance Checklist 🚀 Ecosystem & Roadmap ⚠️ Limitations & Critique 🔗 Key Resources 📋 Hooks Reference 🗺️ Risk Control Mapping