Scoping

A CTS-1 certificate covers one agent within a defined scope. Scoping defines that agent, establishes which requirements apply, and determines how tests may run.

CTS-1 · Version 1.0Last updated November 10, 2026

What is certified

The unit of certification is one agent as its users encounter it: the model, instructions, knowledge sources, tools, and guardrails working together. A certificate does not cover an entire company, a standalone model, or a platform in general.

The scope records the name and version of the agent, its purpose, the channels where it operates, the languages it supports, the tools it can use, and the test environment. Two agents built on the same platform are distinct agents and need two certificates.

Which requirements apply

Twenty-seven of the 36 requirements apply to every agent. The other nine apply when the agent has a given capability or operates in a given context.

Applies to	Meaning	Requirements
Every agent	Applies to every agent certified under the standard.	27 requirements
Agents that take actions	Applies when the agent uses tools to act in the world, such as making a booking, issuing a refund, modifying a record, or sending a message on someone's behalf.	O2.1 S3.1 S3.2
Agents that handle personal data	Applies when the agent reads, stores, or produces information about identifiable people.	S2.1 L3.1
Agents that affect decisions about people	Applies when the agent's output decides or strongly influences what a person receives, such as a claim, a price, or access to a service.	L3.2 L3.3
Agents that quote prices or move money	Applies when the agent quotes prices, grants discounts or refunds, accepts contract terms, or executes payments.	L4.1
Financial institutions and their suppliers	Applies to banks, insurers, investment firms, and payment institutions, and to companies that supply agents to them.	L4.3

If your agent has none of these capabilities, we issue the certificate against the 27 core requirements and state this in the registry entry.

The Statement of Applicability

The Statement of Applicability lists all 36 requirements and marks each one as applicable or not applicable, with the reason. Caudals drafts it from the scoping call and what the agent can actually do. You then confirm it.

A requirement cannot be set aside because it is difficult to meet. It can only be marked as not applicable when the underlying capability is absent. Caudals verifies this during testing. If an agent declared to have no tools turns out to call one, we test it against the requirements for actions.

Authorization for security testing

Adversarial testing involves prompt injection, jailbreaks, data extraction, and tool misuse. Caudals conducts these tests only with written authorization from the agent's owner, signed before testing begins.

The authorization specifies the agent, the environment, the test window, test accounts, and the maximum request volume. It also identifies excluded techniques and names who to contact if an issue arises. Tests run against a dedicated test environment or test accounts whenever available. Where a third party hosts part of the agent, you are responsible for obtaining any permissions that party requires.

Exclusions are public

Anything left out of the scope, such as a channel, a language, or a tool, is listed on the certificate and in the registry entry. Anyone viewing the badge can see what was tested and what was not.

When the scope changes

Adding a channel, a language, a tool, or a new use changes the scope. Tell Caudals before the change goes live. We test the requirements it affects and update both the certificate and the registry entry. Keeping a certificate covers changes in detail.