The 10-Second Version

AI SAFE² is an engineering and governance contract for agentic AI. It defines what must be governed, what must be enforced, and what evidence must exist when autonomous systems act.

The framework contains 161 controls, organized across five operational pillars plus a Cross-Pillar Governance Layer. AI SAFE² v3.1 keeps the overall framework control total at 161 while materially updating the MCP security profile for the Model Context Protocol 2026-07-28 specification.

Version 3.1 also formalizes three enforcement planes:

AI SAFE² specifies the required outcomes and evidence. NEXUS is Cyber Strategy Institute's first-party reference implementation for agent-to-agent and agent-to-tool enforcement. Organizations may use NEXUS or another implementation that demonstrably satisfies the applicable AI SAFE² controls.

What AI SAFE² Is For

Production agents can drift without a code change. Retrieval changes, accumulated memory, delegated authority, tool calls, identity confusion, protocol behavior, or changes in external services can alter the effective operating environment while the source code remains unchanged.

AI SAFE² defines the operating envelope around those systems. It combines governance, identity, runtime enforcement, auditability, fail-safe behavior, adversarial testing, protocol security, and evidence requirements so an organization can reconstruct why an autonomous action was allowed, rejected, halted, or escalated.

What both builders and governors get

• A single control vocabulary across agent runtime, identity, memory, tools, delegation, and evidence.
• Runtime enforcement patterns rather than policy-only guidance.
• Named fail-safe authority and kill-switch governance.
• Agent replication and non-human identity controls.
• Memory and RAG governance.
• MCP security controls for both provider and consumer risk.
• Mapping to 32 governance, security, privacy, and AI frameworks.
• Challenge Lab experiments designed to falsify framework claims rather than merely demonstrate the framework.

What Changed in v3.1

AI SAFE² v3.1 is primarily a protocol-governance and enforcement-plane release.

MCP 2026-07-28 realignment

The MCP core became substantially more stateless. AI SAFE² v3.1 therefore removes governance dependencies on protocol-owned session concepts and instead binds governance to framework-owned constructs such as:

• verified principal identity;
• capability grants;
• delegation chains;
• provenance baselines;
• explicit trust-establishment events;
• principal-scoped state handles;
• policy and authorization evidence.

The governing design rule is:

A CP.5 profile MUST NOT bind a control to a construct owned by the protocol it profiles.

CP.5.MCP expands from 13 to 19 sub-controls

The six v3.1 additions are:

The overall AI SAFE² framework remains 161 controls. MCP-14 through MCP-19 are profile-level sub-controls within CP.5, not six additional top-level framework controls.

Compatibility

MCP 2025-11-25 remains a legacy compatibility binding for a twelve-month migration window. Mcp-Session-Id, when encountered in the legacy binding, is treated as a principal-scoped state handle rather than identity or the authorization boundary.

server/discover is optional under MCP 2026-07-28; AI SAFE² does not require its presence for conformance.

The Core Architecture

The framework is organized around 5 Operational Pillars plus the Cross-Pillar Governance Layer, which was introduced in v3.0 and remains the governance operating system in v3.1.

CP.5 in v3.1

CP.5 provides platform and protocol-specific security profiles without allowing the profiled protocol to define the governance boundary. The v3.1 MCP profile is the primary example of this principle.

See: CP.5.MCP, MCP Server Security Profile

Navigate the Framework

MCP Security in v3.1

AI SAFE² v3.1 treats MCP as an agent-to-tool security plane, not merely a transport feature.

The profile covers:

• tool invocation authorization;
• returned-content sanitization;
• server and binary integrity;
• evidence and audit attribution;
• economic ceilings;
• delegation lineage;
• extension negotiation;
• header/body integrity;
• principal-scoped state handles;
• MRTR binding and replay resistance;
• catalog and schema provenance;
• OAuth/resource/audience authorization integrity.

MCP Security Toolkit

The repository includes an agent-facing safe2 governance CLI and retains the three legacy MCP entry points during migration:

pip install -e ".[all]"
safe2 --help

See examples/mcp-security-toolkit/.

Agent-facing governance and AISM decisions

The unified CLI makes repository evidence directly callable by agents while preserving human decision authority:

safe2 scan project .
safe2 doctor . --format json --output environment-inventory.json
safe2 doctor . --assess --inspect-config --baseline trusted-inventory.json
safe2 doctor . --assess --card-format markdown --card-output environment-card.md
safe2 doctor . --assess --policy environment-policy.json --enforce-policy --output environment-decision.json
safe2 schema list
safe2 gate skill ./candidate-skill --strict
safe2 evidence nexus ./NEXUS --output nexus-evidence.json
safe2 evidence skillspector ./candidate-skill --output skillspector-evidence.json
safe2 evidence manifest environment-inventory.json nexus-evidence.json --subject-id governed-agent --output run-manifest.json --strict
safe2 evidence system safe2/data/system-identity-source-demo.json --output system-identity.json --strict
safe2 evidence diagnose safe2/data/failure-source-demo.json --system-identity system-identity.json --output failure-diagnosis.json --card failure-card.md --strict
safe2 evidence scope safe2/data/assessment-scope-source-demo.json --project-root . --system-identity system-identity.json --output assessment-scope.json
safe2 evidence truth operational-truth-policy.json harness-evidence.json task-receipt.json --output operational-truth.json --card operational-truth.md --strict
safe2 evidence changes . --baseline prior-agent-inputs.json --output current-agent-inputs.json --strict
safe2 aism ingest nexus-evidence.json --subject-id nexus-local --subject-name "NEXUS Local" --output assessment.json
safe2 aism score assessment.json --format markdown --output decision-card.md
safe2 aism remediation-init assessment.json --system-identity system-identity.json --assessment-scope assessment-scope.json --decision-owner "Accountable system owner" --output remediation-source.json
safe2 aism plan remediation-source.json assessment.json --system-identity system-identity.json --assessment-scope assessment-scope.json --output remediation-plan.json --card remediation-card.md --strict

safe2 doctor provides metadata-only discovery for multi-harness workstations, including known Codex, Claude Code, Antigravity, Hermes, OpenClaw, and Grok indicators, available shells, host details, CI markers, and WSL availability. It does not read configuration contents or credential values and does not treat inventory as proof of secure configuration. Named WSL distributions and explicit SSH-accessible Linux hosts or cloud VMs can use the same fixed, non-interactive metadata probe; the command never scans a network. Operational frustrations and false completion claims can be captured locally with safe2 feedback record and measured with safe2 feedback summary.

A reviewed safe2 doctor inventory can also serve as a trusted baseline. Later runs report harness, asset, redacted configuration-hash, target-coverage, and assessment-scope drift. Drift remains a review signal rather than proof of authorization, compromise, control conformance, or organizational maturity.

The AISM Decision Card separates facts, assumptions, conflicts, unknowns, alternatives, history, and recommendations. Machine-readable JSON remains the canonical exchange format. An automated pass is not a claim of full framework conformance or organizational maturity.

CLI 0.8 binds proposed remediation to the exact assessment, system identity, and deployment scope. It validates control and AISM-cell traceability, evidence, assumptions, owners, dependencies, alternatives, impacts, exit criteria, completion evidence, residual risk, and status history. It never executes or authorizes the proposed work and never increases the normative AISM score merely because an action is marked complete.

See the AISM implementation and remediation guide.

See the executable AISM Decision Card example. See the executable environment Decision Card workflow. Evidence ingestion is conservative: collectors suggest candidate AISM cells but never invent maturity ratings. Evidence without verification provenance is labeled and capped until a human confirms the mapping.

See the complete AI SAFE² CLI command and architecture guide. See the capability-gated CLI roadmap to 1.0.

CLI 0.3.0 adds task receipts and usage evidence: check artifact and test/tool claims, capture explicit local runs, recheck fresh pytest evidence, authenticate report bytes, and correlate declared per-task resource use. These checks do not establish task completion or verified billing.

The CLI includes a provider-neutral harness evidence intake that makes declared, observed, partial, and missing coverage visible before native harness adapters are introduced.

The agent system identity manifest adds the next layer, harness, tools, skills, memory, environment, policies, evaluator, authority and relationships to one assessment subject without claiming the declared deployment was independently verified.

Failure localization binds task observations and competing failure candidates to that complete system identity. It ranks where to investigate, exposes assumptions and contradictions, and recommends a repair owner and next action without claiming a verified root cause or probability.

Assessment scope inventories which repository paths are declared product, tests, adversarial fixtures, examples, research, generated artifacts, dependencies, third-party content, configuration, documentation, or unknown. It binds that declaration to system identity without reading file contents or claiming the declared boundary was independently verified.

Change attribution compares normalized findings against an explicitly trusted baseline, binds both revisions to their assessment scope artifacts, and separates inherited, introduced, changed, resolved, and unknown states without claiming causation or conformance.

Release readiness combines identity, scope, change attribution, required checks, risks, ownership, next actions, and rollback into agent JSON plus a human card while preserving human release authority.

Operational truth correlates provider-attributed harness evidence, task receipts, coverage, usage declarations, and completion claims without promoting agreement into verified completion or billing. Its bounded one-shot change monitor can inventory new or changed skills and named agent configuration in an explicitly supplied local or CI scope. It installs no daemon, sends no telemetry, exports no file content, and holds configuration changes for human review.

For release boundaries, verified behavior, and external checks that still require human or production execution, see the Stranger-Ready CLI Review, Security Policy, and Support Policy.

MCP-19 and legacy bearer tokens

Opaque static bearer tokens do not contain an audience claim. A deployment using them must not claim MCP-19 audience-validation conformance unless equivalent intended-resource binding is independently established and evidenced.

The AI SAFE² MCP server therefore retains static-token handling as a compatibility mechanism, not as proof of MCP-19 conformance. JWT/OAuth deployments should validate the intended resource or audience before protected dispatch.

NEXUS Reference Implementation

AI SAFE² and NEXUS intentionally serve different roles:

• AI SAFE² defines required governance outcomes, controls, evidence, and conformance criteria.
• NEXUS is CSI's first-party reference implementation for enforcing those requirements across agent-to-agent and agent-to-tool interactions.

A conformant implementation does not have to use NEXUS. It does have to satisfy the applicable control outcome and produce the required evidence.

The v3.1 NEXUS MCP adapter currently defines a fail-closed interface contract. Unimplemented enforcement methods raise rather than silently allowing traffic. It is not presented as production-ready until integrated and tested.

See NEXUS/adapters/mcp/.

Examples: Sovereign Runtimes in the Wild

The examples/ directory contains governed runtime patterns and integrations for common agent stacks, including Claude Code, Codex, AutoGen, CrewAI, LangChain, LangGraph, Make.com, xAI Grok, OpenClaw, MCP, and others.

Each implementation is intended to demonstrate how AI SAFE² controls can be enforced around an actual runtime rather than remaining policy-only statements.

See examples/.

Challenge Lab: Falsification Before Claims

The AI SAFE² Challenge Lab converts public incidents, evaluation findings, and credible agentic threats into reproducible experiments.

The framework is the subject of the test, not the source of its own proof.

Challenge 001, the Anthropic Multi-Agent Turf War challenge, is designed to test whether externally enforced authority can stop destructive multi-agent conflict without blocking legitimate collaboration.

For v3.1, validation claims are scoped to the enforcement planes actually exercised by preregistered scenarios. Successful east-west agent governance does not automatically establish MCP/tool-plane or model-provider-plane validation.

Material normative framework, protocol-profile, implementation, policy, or grader changes after preregistration require a new preregistration version before confirmatory evidence is pooled.

See Challenge 001.

The Challenge CLI workflow runs an offline fixture or an explicitly authorized, bounded external evaluator, independently grades recorded state, and translates third-party evidence through a versioned contract. Plans and receipts bind the evaluator, requests, responses, optional system identity, source, and normalized run. Bounded execution is not an OS sandbox, provider authentication, or independent replication. The synthetic TENIR example remains illustrative only.

5-Layer Architectural Coverage

AI SAFE² v3.1 models the broader operational stack, from model infrastructure through agent identity and protocol-mediated tool use.

The v3.1 Coverage Matrix

Interactive Dashboard

Explore the AI SAFE² taxonomy and control mappings through the live dashboard:

Launch the AI SAFE² Dashboard

The dashboard provides control search, pillar filtering, risk-level views, executive summaries, and framework mappings. Generated dashboard data should remain synchronized with the canonical framework data during release updates.

The Universal Rosetta Stone: 32 Frameworks

AI SAFE² maps its controls across 32 AI, cybersecurity, privacy, resilience, and enterprise governance frameworks so organizations can reuse evidence rather than run independent governance programs for every external standard.

Representative mappings include:

AI and Agentic Frameworks

• NIST AI RMF
• ISO/IEC 42001
• OWASP AIVSS
• OWASP Top 10 for LLM Applications
• OWASP Agentic Top 10
• MITRE ATLAS
• MIT AI Risk Repository
• Google SAIF
• CSA agentic and zero-trust guidance
• EU AI Act

Enterprise and Security Frameworks

• NIST CSF 2.0
• NIST SP 800-53 Rev. 5
• ISO/IEC 27001
• SOC 2
• PCI DSS
• HIPAA
• FedRAMP
• CMMC
• CIS Controls
• GDPR
• DORA
• Zero Trust architecture

The exact mapping remains control-specific. AI SAFE² alignment does not replace an organization's obligation to independently determine regulatory or certification applicability.

Why AI SAFE² Is Different

Fast-Track Implementation

This repository provides the framework definitions and open implementation examples. Cyber Strategy Institute also maintains implementation tooling and services for organizations that want a faster path from framework adoption to operational enforcement.

Core open assets include:

• framework taxonomy and control definitions;
• AISM maturity model;
• NEXUS reference implementation;
• MCP security toolkit;
• gateway and sovereign runtime patterns;
• scanner and validation tooling;
• Challenge Lab experiments;
• framework mappings and research notes.

Commercial implementation resources are available through Cyber Strategy Institute.

Framework Evolution

AI SAFE² is a living standard that adapts to changes in agent architectures, threat models, security research, and the protocols that connect autonomous systems.

See EVOLUTION.md for the full history.

Repository Structure

/
├── .github/                   # CI/CD workflows and contribution automation
├── 00-cross-pillar/           # CP.1 through CP.10, including CP.5 profiles
├── 01-sanitize-isolate/       # Pillar 1
├── 02-audit-inventory/        # Pillar 2
├── 03-fail-safe-recovery/     # Pillar 3
├── 04-engage-monitor/         # Pillar 4
├── 05-evolve-educate/         # Pillar 5
├── AISM/                      # Normative AI Sovereignty Maturity Model
├── safe2/                     # Unified agent-facing Python CLI and AISM runtime
├── NEXUS/                     # CSI reference implementation
├── challenges/                # Falsification and replication experiments
├── examples/                  # Governed runtime and integration examples
├── gateway/                   # Runtime enforcement gateway
├── research/                  # Threat research and control evidence
├── scanner/                   # Static and framework assessment tooling
├── skills/                    # AI assistant and MCP integration assets
├── dashboard/                 # Interactive framework explorer
├── EVOLUTION.md               # Release and framework evolution history
├── SECURITY.md                # Supported versions and vulnerability reporting
├── SUPPORT.md                 # Support, compatibility, and maintenance policy
├── README.md                  # Current framework overview
└── skill.md                   # Framework context for AI assistants

Companion Framework: Cognitive Sovereignty Framework

AI SAFE² secures and governs the AI system. The Cognitive Sovereignty Framework addresses the human operator's ability to remain capable of governing that system.

The two frameworks are complementary rather than substitutes.

CSF Learning Hub · Threat Explorer · CSF Repository

Citation

@misc{aisafe2_framework,
  title = {AI SAFE² Framework v3.1: Agentic AI Governance and Runtime Enforcement},
  author = {Sullivan, Vincent and {Cyber Strategy Institute}},
  year = {2026},
  publisher = {Cyber Strategy Institute},
  url = {https://github.com/CyberStrategyInstitute/ai-safe2-framework},
  note = {Version 3.1. 161 framework controls, CP.5.MCP profile aligned to MCP 2026-07-28, and mappings across 32 frameworks.}
}

Licensing and Usage Rights

Code, MIT License: Applies to code assets unless a subdirectory states a different license. NEXUS remains Apache 2.0 where explicitly designated.

Framework and documentation, CC BY-SA 4.0: Applies to AI SAFE² methodology text, pillar definitions, framework documentation, and derivative public documentation where designated.

See repository license files and subdirectory notices for authoritative terms.

Managed by Cyber Strategy Institute. Copyright © 2025-2026. All Rights Reserved.