Mapping into ISO 27001 and ISO 42001 does a specific job [3]. When an auditor asks how access control applies to software that selects its own tools at runtime, you hand over a control that names agent identity, authority, action guardrails and memory protection, along with the evidence that control expects to see [5]. The stated design principle, set by Vanta CEO Christina Cacioppo, is to avoid publishing a fifteenth framework and instead ship technology-specific controls that bolt onto ISO programs already in flight [8]. Errico's case for the open comment period comes from the same place: agent risk becomes concrete around delegation chains, credential scopes and the systems an agent can reach, and a control written by someone who has watched an agent fail in production is likelier to name evidence that can actually be collected [24].
The yield, counted in rows, is small. Early access was 61 controls across 12 domains, 40 for builders and 21 for users [9]. The builder baseline gained three and the user baseline one [19]. That is roughly 88 contributions per net new control [20]. The source does not say whether the rest landed as rewrites, tightened evidence requirements, or rejections, so the contribution total is not a count of inspectable changes.
The control count is a claim about someone else's audit scope, and two things have to be true before the buyer half does work in yours. Your auditor has to accept the mapping as evidence for the annex control it points at. Your vendor has to answer for inventories, credentials, vendor reviews, monitoring, oversight responsibilities and training on an agent whose internals you cannot inspect [6]. The second condition decides whether those 22 controls become a questionnaire with teeth or a filing exercise.
According to runtimewire, the library establishes what to govern and document and does not appear to include the layer that stops a prohibited action mid-run [13]. A control can require restricted tool access, runtime monitoring or human approval; making the requirement bite still needs identity infrastructure, a policy gateway or monitoring software [14]. The Cloud Security Alliance's AARM working group is drafting the vendor-neutral version of that layer, scoped to excessive privileges, prompt injection, irreversible actions and threats that only emerge across a sequence of individually permitted steps [15]. The last category is the interesting one, because a per-call policy check by construction cannot see it.
The enforcement layer already has sellers. WitnessAI released Agentic Control on June 17 to discover agents and Model Context Protocol servers, apply approved-tool policies and block activity at runtime [16]. NeuralTrust sells gateways, runtime security and agent inventory software, and has announced a $20 million round [17]. Runtimewire reads the release as Vanta defining the checklist enterprises may use to buy and audit agents while runtime vendors compete to enforce the rules [18]. Free controls are a cheap way to define the shape of the thing everyone else has to enforce.
If you already run an ISO 42001 program, evaluating this costs a scoping meeting and an afternoon with the buyer baseline. That price is low enough that the checklist question gets settled by whoever published first.
