All requirements
The 36 requirements of CTS-1 on one page. Each one links to its full text, with what is tested and the evidence examined.
How to read a requirement
An identifier has a letter for the risk, a number for the domain and a number for the requirement. S1.2 is the second requirement of the first Security domain. Each requirement states what must be true, when it applies, how Caudals verifies it and how often it is verified again.
The requirements
OOperational risk
| Requirement | Applies to | Verified by |
|---|---|---|
| O1.1Answers match the sources | Every agent | Testing |
| O1.2No invented facts | Every agent | Testing |
| O1.3Stays within its purpose | Every agent | Testing |
| O2.1Actions stay within authority | Agents that take actions | Testing |
| O2.2Hands over when it should | Every agent | Testing |
| O2.3Consistent answers | Every agent | Testing |
| O3.1Tested before every release | Every agent | Evidence review |
| O3.2Changes are controlled | Every agent | Evidence review |
| O3.3Monitored in production | Every agent | Evidence review |
| O4.1A named owner | Every agent | Evidence review |
| O4.2Ready for incidents | Every agent | Evidence review |
| O4.3Can be stopped and fails safely | Every agent | Testing and evidence review |
SSecurity risk
| Requirement | Applies to | Verified by |
|---|---|---|
| S1.1Resists prompt injection and jailbreaks | Every agent | Testing |
| S1.2Resists indirect injection | Every agent | Testing |
| S1.3Keeps its configuration confidential | Every agent | Testing |
| S2.1Does not leak personal data | Agents that handle personal data | Testing |
| S2.2Keeps confidential data and customers apart | Every agent | Testing and evidence review |
| S2.3Holds no secrets it could reveal | Every agent | Testing and evidence review |
| S3.1Least privilege for tools and data | Agents that take actions | Testing and evidence review |
| S3.2Acts with the user's permissions | Agents that take actions | Testing |
| S3.3Output is handled as untrusted | Every agent | Testing |
| S4.1Models and suppliers are vetted | Every agent | Evidence review |
| S4.2Hardened and protected against abuse | Every agent | Testing and evidence review |
| S4.3Attacks are logged, noticed, and tested again | Every agent | Evidence review |
LLegal and financial risk
| Requirement | Applies to | Verified by |
|---|---|---|
| L1.1People know it is an AI | Every agent | Testing |
| L1.2Purpose and limits are stated | Every agent | Evidence review |
| L1.3Records are kept | Every agent | Evidence review |
| L2.1Role and risk class are determined | Every agent | Evidence review |
| L2.2AI is governed | Every agent | Evidence review |
| L2.3Risks and impacts are assessed | Every agent | Evidence review |
| L3.1Personal data is handled lawfully | Agents that handle personal data | Evidence review |
| L3.2Decisions about people need human review | Agents that affect decisions about people | Testing and evidence review |
| L3.3People are treated alike | Agents that affect decisions about people | Testing |
| L4.1Money and commitments have limits | Agents that quote prices or move money | Testing |
| L4.2Exposure is quantified and allocated | Every agent | Evidence review |
| L4.3Regulated firms meet their sector's rules | Financial institutions and their suppliers | Evidence review |