Vendor-invented scores measure what the vendor is good at. A score worth acting on has to be anchored to standards that outlive any one vendor — and the standards landscape for AI agents is more mature than most teams realize.
Here is what the major frameworks actually require, and how they compose into a defensible agent trust score.
NIST AI RMF: the spine
The NIST AI Risk Management Framework organizes AI risk work into four functions — Govern, Map, Measure, Manage — and defines the characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; fair.
Applied to agents specifically, the functions translate into concrete questions:
- Govern: Is there a named accountable human? A policy for what the agent may and may not do autonomously? An escalation path when it encounters a decision above its authority?
- Map: Is the agent's context documented — what systems it touches, whose data it processes, which decisions it influences, and what happens downstream when it's wrong?
- Measure: Are there defined metrics for the agent's reliability, and are they measured against production behavior, not just pre-deployment tests?
- Manage: When measurement finds a problem, is there a mechanism that actually constrains the agent — a permission revoked, an approval gate added, a rollback executed?
Most agent deployments can partially answer Govern and Map. Measure and Manage — the functions that require ongoing instrumentation — are where scores collapse.
CSA: the security lens
The Cloud Security Alliance's body of guidance brings the security specifics: identity and credential management for non-human actors, least-privilege access, logging and monitoring, and the shared-responsibility clarity that cloud security learned over a decade. For agents, the CSA lens forces the uncomfortable questions: Does the agent have its own identity, or is it borrowing a human's? Are its credentials scoped and rotated? Can you revoke one agent's access without breaking ten others? Is its activity distinguishable from its operator's in the logs?
If your agents authenticate as shared service accounts, your trust score has a ceiling — no matter how good the model is.
KYA: know your agent
Borrowed deliberately from KYC in financial services, Know Your Agent is the emerging discipline of verifiable agent identity: who built this agent, who operates it, what is it authorized to do, and can those claims be verified by a counterparty rather than merely asserted? As agents begin transacting with other agents — negotiating, purchasing, exchanging data — KYA stops being a compliance nicety and becomes the precondition for any agent-to-agent economy. Emerging agent-identity standards — portable, verifiable registries of identity and reputation — are early infrastructure for exactly this. (More on that in a later piece in this series.)
Composing the score
A defensible agent trust score, then, is not one number from one test. It's a weighted composite across the three layers:
- Governance posture (NIST Govern/Map): accountability, scope, documentation — verified from artifacts, not questionnaires.
- Security posture (CSA): identity, least privilege, logging, revocability — verified from configuration, not policy PDFs.
- Behavioral evidence (NIST Measure/Manage + KYA): production reliability metrics, decision-log completeness, identity verifiability — measured continuously, decaying when stale.
That last property matters most: a trust score must decay. An agent scored 92 in March, on a model that was updated in April, is not a 92 in May. Any score without a freshness mechanism is a marketing asset, not an assurance instrument.
This composite — standards-anchored, artifact-verified, continuously refreshed — is what we built NGIQ-ATE to compute. Not because enterprises need another number, but because their review gates need a number they can defend to an auditor.