The Agentic Outbound Maturity Model (AOMM): Could Your Agents Reach Someone Else, And Would You Know Before They Told You?

Summary

The strongest single artefact in the collection. Every organisation asks whether it can withstand an attack; almost none asks whether its own agents could reach out and harm someone else — and whether it would find out before the other party told it. The AOMM corrects the lethal trifecta (untrusted content is one source of motive, not a necessary condition), sets five preconditions that must all hold (capability, motive, reach, freedom, silence), and defines a conjunctive five-level ladder from Unaware to Accountable. Budget and elapsed time are named as the two cheapest unimplemented containment controls.

Key concepts

• The five preconditions — capability, motive, reach, freedom, silence — removing any one breaks the chain
• The ladder — Unaware, Enumerated, Bounded, Observed, Contained, Accountable — conjunctive and computed
• The trifecta correction — the outbound case had no untrusted-content leg: specification gaming, not prompt injection
• Budget and time as containment — off-task spend is the cheapest anomaly signal obtainable

Key ideas

• Could it happen, has it happened, will it happen, and what can be done are four questions with different evidentiary bases — and the second is unanswerable in a market with disclosure incentives against it.
• Capability is the only precondition a defender cannot influence: assume it and design against the other four.
• Liability for outbound autonomous action is unresolved; check the insurance position before an incident, not during one.

On this site

Promoted to a native page: the AOMM framework page.

Infographic

Read the document